[Unit]
Description=Berkeley Internet Name Domain (DNS)
After=network-online.target
After=time-set.target
Wants=network-online.target
Wants=nss-lookup.target
Wants=time-set.target

[Service]
Type=forking
KillMode=process
EnvironmentFile=/etc/sysconfig/named
ExecStartPre=+/usr/libexec/bind/named.prep
ExecStart=/usr/sbin/named -u named -t /var/lib/named $NAMED_ARGS
ExecReload=/usr/bin/kill -HUP $MAINPID
ProtectSystem=strict
ReadWritePaths=/var/lib/named /run/named /var/log/named
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectKernelLogs=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes

[Install]
WantedBy=multi-user.target
Alias=bind9.service