bindantic

bindantic - a library for managing BIND9 DNS server configuration via Pydantic models.

Instead of manually editing named.conf , you describe the configuration in Python, and the library generates correct BIND9 syntax and (optionally) places files into the required directories.

Features

• Full support for all named.conf blocks:
  • acl, controls, dnssec-policy, http, key, key-store, logging, options, remote-servers, server, statistics-channels, tls, trust-anchors, view, zone.
• All common resource record types:
  • A, AAAA, CAA, CERT, CNAME, DNAME, DNSKEY, DS, HINFO, LOC, MX, NAPTR, NSEC, NS, PTR, RP, RRSIG, SOA, SPF, SRV, SSHFP, TLSA, TXT.
• Built-in validation - pass strings, numbers, IP addresses, durations – the library will format them correctly for BIND.
• Syntax generation in one line
  • model.model_bind_syntax() - for any block or the whole named.conf,
  • zone.model_bind_syntax_zone_file() - for a ready-to-use zone file.
• Generate files without writing / write to disk
  • config.generate_files() - returns a list of generated files
  • config.write_files("./my_config") - creates named.conf, zones, keys, DNSSEC policies and organises them into subdirectories.
• Python - 3.10+, static typing, 96% test coverage.
• No extra dependencies - only Pydantic

Installation

pip install bindantic

⚠️ NOTE:

The named-checkconf utility from the bind-utils package may be older than your BIND server and may not recognise new directives.

bindantic generates syntax according to the latest stable BIND 9.20.x version. If you check the configuration with an older utility you may get errors. Always use the same version of named-checkconf as your server, if possible.

Quick Start

Example of a minimal configuration

from bindantic import (
    ARecord,
    NamedConfig,
    NSRecord,
    OptionsBlock,
    SOARecord,
    ZoneBlock,
    ZoneTypeEnum,
)

config = NamedConfig(
    options_block=OptionsBlock(
        directory="/etc/bind",
        recursion=True,
        allow_recursion=["localhost", "localnets"],
        listen_on=["any"],
        listen_on_v6=["any"],
    ),
    zone_blocks=[
        ZoneBlock(
            comment="optional comment",
            name="example.com",
            zone_type=ZoneTypeEnum.PRIMARY,
            file="zones/example.com.zone",
            resource_records=[
                SOARecord(
                    mname="ns1.example.com",
                    rname="admin.example.com",
                    serial=2026010101,
                    refresh=10800,
                    retry=3600,
                    expire=604800,
                    minimum=3600,
                    origin="example.com",
                    ttl=3600,
                ),
                NSRecord(nsdname="ns1.example.com", comment="optional comment"),
                ARecord(name="@", address="192.168.1.1"),
            ],
        )
    ],
)

options {
    allow-recursion {
        localhost;
        localnets;
    };
    directory "/etc/bind";
    listen-on {
        any;
    };
    listen-on-v6 {
        any;
    };
    recursion yes;
};

# optional comment
zone example.com. {
    type primary;
    file "zones/example.com.zone";
};

$TTL 3600
$ORIGIN example.com.
@                    IN   SOA ns1.example.com. admin.example.com. (
                                     2026010101 ; Serial number (YYYYMMDDNN)
                                     10800      ; Refresh time
                                     3600       ; Retry time
                                     604800     ; Expire time
                                     3600       ; Minimum TTL
                     )
@                    IN   NS         ns1.example.com. ; optional comment
@                    IN   A          192.168.1.1

[
    GeneratedFile(
        path=PosixPath("/etc/bind/zones/example.com.zone"),
        content="<CONTENT>",
        type="zone",
    ),
    GeneratedFile(
        path=PosixPath("/etc/bind/named.conf"),
        content="<CONTENT>",
        type="config",
    ),
]

example_bind/
├── named.conf
└── zones/
    └── example.com.zone

# Automatically generated by bindantic - please adjust!

options {
    allow-recursion {
        localhost;
        localnets;
    };
    directory "examples/example";
    listen-on {
        any;
    };
    listen-on-v6 {
        any;
    };
    recursion yes;
};

# optional comment
zone example.com. {
    type primary;
    file "zones/example.com.zone";
};

$TTL 3600
$ORIGIN example.com.
@                    IN   SOA ns1.example.com. admin.example.com. (
                                     2026010101 ; Serial number (YYYYMMDDNN)
                                     10800      ; Refresh time
                                     3600       ; Retry time
                                     604800     ; Expire time
                                     3600       ; Minimum TTL
                     )
@                    IN   NS         ns1.example.com. ; optional comment
@                    IN   A          192.168.1.1

The file ./examples/manual_example.py contains usage examples for all supported models.

More examples

Focused, runnable scripts for common real-world setups:

• examples/multi_view_split_horizon.py - split-horizon DNS: internal clients see private records, everyone else sees public ones.
• examples/secondary_zone_tsig.py - a primary/secondary zone pair with TSIG-authenticated zone transfers.
• examples/dnssec_signed_zone.py - a DNSSEC-signed zone, end to end: key-store, dnssec-policy (KSK+ZSK), and a zone using that policy.

Versioning

bindantic follows Semantic Versioning.

• Public API - everything importable from the top-level bindantic package (models, enums, field type aliases) is covered by semver guarantees.
• Internal - any module prefixed with _ (e.g. bindantic._base_model, bindantic._base_types_validation) is an implementation detail and may change without notice.
• Major - removing/renaming a public model or field, or a change that makes previously valid input invalid, or a change to the generated BIND syntax output.
• Minor - new models, new optional fields, support for new BIND directives.
• Patch - bug fixes that don't change the public API surface.

bindantic targets the latest stable BIND 9.20.x release; tracking a new BIND directive is treated as a minor bump unless it conflicts with existing behavior.