Install and maintain BIND using your operating system's supported packages. Configure authoritative service and the intended nameservers. Create a zone include file dedicated to Domain Nexus and include it from the main BIND configuration. The module's Zone include file must point to that dedicated file, never directly to named.conf.

Provide an SSH account that can read and write the configured zone directory and include file, and execute the required rndc operations. Prepare those permissions administratively. The connection does not turn an arbitrary SSH account into root, and the rndc path field accepts an executable path rather than a shell command.

1. Choose BIND 9 (self-hosted, over SSH) under Servers.
2. Enter the host, SSH port and SSH user.
3. Copy the server's SHA256 host-key fingerprint through a trusted server console into Trusted SSH host-key fingerprint. Compare it independently of the network connection you are about to trust.
4. Paste a dedicated private key, including its header and footer, and its passphrase if required. Password authentication is the fallback when no private key is supplied.
5. Set the actual zone directory, dedicated include file and rndc path. Review the SOA primary nameserver, hostmaster and comma-separated apex nameservers.
6. Leave zone transfers restricted unless you run authorised secondaries. If you do, enter their permitted addresses according to the field format.

Create a test zone and verify its declaration, loaded serial and authoritative answers. A file written successfully is not enough if BIND refuses the reload. Investigate configuration errors and the service logs before another change. The adapter preserves an existing zone file on a rejected reload where a previous file is available; retain your own configuration backup as well.

Primary and secondary declarations are not interchangeable. Resolve a role conflict manually before adopting a zone. This adapter does not manage DNSSEC signing keys, so server-side signing requires a separate operated configuration and registrar DS coordination.

For a Debian-style BIND layout, an administrator might prepare a dedicated /etc/bind/nabtech-zones.conf file and add this line to the configuration that BIND actually loads:

include "/etc/bind/nabtech-zones.conf";

Set Domain Nexus's Zone include file to that dedicated file, not to /etc/bind/named.conf. The path is illustrative; use your distribution's real configuration layout. Prepare the separate zone directory and narrowly scoped write permissions for the configured SSH account. Do not grant that account permission to replace unrelated BIND configuration.

Before creating a test zone, validate the configuration from the authorised server console:

named-checkconf /etc/bind/named.conf

No diagnostic output with a successful exit status indicates that this syntax check passed. It does not prove public reachability or successful loading of every zone. Complete the test-zone reload and direct authoritative queries described above, and inspect the service logs if loading fails.

• Replace a BIND server SSH host key after verifying a legitimate rebuild
• Configure secondary DNS with an authorised transfer source
• Run a controlled DNS provider acceptance check before assigning customer packages
• Configure DNS backups and restore a reviewed record snapshot

• ISC BIND 9 Administrator Reference Manual
• ISC: Authoritative BIND practices

• ISC: BIND configuration reference
• ISC: named-checkconf reference