BIND 9
Ranked 2 of 6 DNS servers by recommenders
Mature, stable DNS server people trust for DNSSEC, zone replication and split views. Critics point to a long history of security vulnerabilities.
Mature, stable DNS server people trust for DNSSEC, zone replication and split views. Critics point to a long history of security vulnerabilities.
26 people gave an opinion
- recommend it
- 17
- criticize it
- 9
- approval share
- 65%
Recommended in 8 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 17 people recommend itNeeds 10 or more, met.
- 1.8 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 8 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Long deployment history, battle-tested
“No other DNS resolver is going to come close to it's number of deployment*years in operation.”
Comment from 27 Nov 2025 in “DNS Firewalling with MISP and Technitium DNS Server” “the most battle tested of them all”
Comment from 20 Nov 2025 in “Self-hosting DNS for no fun, but a little profit” Simple, stable and few issues
“I've been very happy with it, very few issues other than my own folly”
Comment from 25 Mar 2026 in “You Can Run a DNS Server” “It’s incredibly simple and stable and easy to understand”
Comment from 4 Jun 2026 in “DNS Is for People – Not for IT Infrastructure” Handles DNSSEC without issues
“modern bind9 seems to just handle DNSSEC with no issues when I've used it”
Comment from 27 Apr 2026 in “Revocation of X.509 Certificates” “I've run DNSSEC with all three and have no complaints.”
Comment from 25 Mar 2026 in “You Can Run a DNS Server” Split views and zone replication
“I use BIND and DNS replication (AXFR/IXFR) handles it.”
Comment from 6 May 2026 in “.de TLD offline due to DNSSEC?” “My favorite feature of bind is "split views"”
Comment from 30 Nov 2025 in “DNS Firewalling with MISP and Technitium DNS Server”
What people warn about
Each mark is one comment
Long history of security vulnerabilities
“it's just a badly engineered piece of software and had braindead vulnerabilities for decades”
Comment from 1 Dec 2025 in “DNS Firewalling with MISP and Technitium DNS Server” “bind9 is not a dns server but a collection of all available CVE types for further studying”
Comment from 28 Nov 2025 in “DNS Firewalling with MISP and Technitium DNS Server” “All software from ISC was/is littered with security vulnerabilities.”
Comment from 5 Dec 2025 in “Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server” - Comment from 28 Aug 2026 in “Saving 100 terabytes of memory by optimizing 1.1.1.1's DNS cache”
Bugs, including upgrade problems
“bind eating their query counter on IPv6 even if you don't have IPv6 routing”
Comment from 28 Apr 2026 in “Its always DNS: Why the default BIND setup is failing to resolve” “Bind is the Microsoft Windows of DNS servers - a lot of users and bugs”
Comment from 3 Dec 2025 in “DNS Firewalling with MISP and Technitium DNS Server” “they had an issue with BIND upgrade and it made up new keys”
Comment from 8 May 2026 in “.de TLD offline due to DNSSEC?” - Comment from 6 May 2026 in “Its always DNS: Why the default BIND setup is failing to resolve”
Arcane syntax and zone files
“arcane syntax that BIND 9 is apparently famous of”
Comment from 25 Mar 2026 in “You Can Run a DNS Server” “sick of maintaining BIND files”
Comment from 5 Feb 2026 in “When internal hostnames are leaked to the clown”
Other DNS servers people recommend
The four most recommended other DNS servers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| dnsmasq | 32 | 11 | 74% | 10 | — | Approved |
| BIND 9This page | 17 | 9 | 65% | 8 | — | — |
| PowerDNS | 15 | 0 | 100% | 10 | — | Approved |
| djbdns | 8 | 2 | 80% | 6 | — | — |
| Technitium DNS Server | 7 | 2 | 78% | 6 | — | — |
What people said
29 of the 32 comments that mention it, newest first. Each links to the original comment.
“just don't reimplement all the CVEs that BIND had in the 90s”
“Run your own instance of bind9 or whatever, with the cache disabled.”
“It’s incredibly simple and stable and easy to understand”
“they had an issue with BIND upgrade and it made up new keys”
“I use BIND and DNS replication (AXFR/IXFR) handles it.”
“Unfortunately bind is as buggy as it always been.”
“I tried to report this to the upstream, but it was closed as "not a bug"”
“bind eating their query counter on IPv6 even if you don't have IPv6 routing”
“modern bind9 seems to just handle DNSSEC with no issues when I've used it”
“arcane syntax that BIND 9 is apparently famous of”
“I've been very happy with it, very few issues other than my own folly”
“it works well enough across a bunch of domains”
“BIND is still my go-to because I am familiar with it.”
“I've run DNSSEC with all three and have no complaints.”
“I use bind 9 and nginx for that”
“you can limit an hmac-secret to one TXT record, so each webserver that uses rfc2136 for certificate renewals is only capable of updating its specific record”
“I like this because it means an attacker who compromises "bob" can only get certs for "bob".”
“sick of maintaining BIND files”
“someone running their own recursive DNS server (like Bind9 or Unbound) can trivially bypass these restrictions”
“All software from ISC was/is littered with security vulnerabilities.”
“Bind is the Microsoft Windows of DNS servers - a lot of users and bugs”
“And yet somehow, the internet has much bigger problems...”
“it's just a badly engineered piece of software and had braindead vulnerabilities for decades”
“at work, we use Windows DNS and Bind in parallel”
“My favorite feature of bind is "split views"”
“bind9 is not a dns server but a collection of all available CVE types for further studying”
“No other DNS resolver is going to come close to it's number of deployment*years in operation.”
“the most battle tested of them all”
“RPZ allow DNS resolvers to lie to clients by returning (nxdomain or redirects to other domains)”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.