Setup a Secure Resolver using BIND

The purpose of the lab is to setup the resolver on the first server. You should install either BIND or Unbound -- not both.

Install BIND as the resolver.

sudo apt-get update
sudo apt-get upgrade
sudo apt-get install bind9

Change the configuration in BIND so that it only listens on the localhost. Note that some of the options below may already be present in the default configuration file.
```
sudo vim /etc/bind/named.conf.options
```
File contents:
```
options {
    dnssec-validation auto;
    listen-on-v6 { ::1; };
    listen-on { 127.0.0.1; };
};
```
Instruct the operating system to use the local nameserver:
```
sudo vim /etc/resolv.conf
```
Change the nameserver line into:
```
nameserver 127.0.0.1
```
Restart BIND9
```
sudo systemctl restart bind9
```
Verify by using dig. Notice that the AD-flag is set.
```
dig +dnssec www.opendnssec.org
```
Also try resolving a domain where DNSSEC is broken.
```
dig www.trasigdnssec.se
```
But we can see that in fact the domain does contain the information if we bypass the DNSSEC validation:
```
dig +cd www.trasigdnssec.se
```

Provide feedback