> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BIND

> Guides configuration of KMES Series 3 with BIND using Futurex PKCS #11 libraries.

This document provides information about configuring the KMES Series 3 with BIND by using Futurex PKCS #11 libraries. For additional questions related to your KMES Series 3 see the [KMES Series 3 user guide](https://docs.futurex.com/Legacy_Products/bam/6.3.6.x/product-specific/kmes-series-3/admin-guide).

## About BIND

BIND is a software suite for interacting with the DNS . Its most prominent component, named, performs both primary DNS server roles, acting as an authoritative name server for DNS zones and as a recursive resolver within the network. As of 2015, it is the most widely used domain name server software and is the de facto standard on Unix-like operating systems. Also contained in the suite are various administrative tools, such as **nsupdate** and **dig**, as well as a DNS resolver interface library.

## How the BIND integration works

The integration involves the following steps:

1. **Zone data creation/update:** User defines / updates DNS zone file
2. **Key reference request:** BIND identifies required signing keys
3. **HSM login:** BIND authenticates to KMES Series 3 via PKCS#11
4. **Signing key access:** KMES Series 3 locates requested signing keys
5. **HSM signing operation:** KMES Series 3 generates digital signatures using private keys
6. **Zone file update:** Signed DNS records are added to zone data
7. **Zone publication**: BIND loads and serves signed zone data
8. **Resolver validation:** DNS resolvers verify signatures using DNSSEC public keys

## PKCS #11 in BIND

The PKCS #11 support in BIND comes in two forms:

* **Native PKCS #11** - BIND interfaces directly with the KMES Series 3 provided library through the PKCS #11 API. This allows BIND to interact directly with the PKCS #11 provider for public key cryptography (DNSSEC).
* **OpenSSL-based PKCS #11** - BIND uses an OpenSSL PKCS #11 provider (such as `pkcs11-provider` from the Latchset project) to interact with KMES Series 3 indirectly.

This integration guide uses the **OpenSSL-based PKCS #11 method** because it is the **only method** compatible with Futurex's KMES Series 3.


## Related topics

- [BIND](/Integrations/HSM/DNS/BIND/BIND.md)
- [Inline Signing with BIND](/Integrations/HSM/DNS/BIND/Appendices/Inline_Signing_with_BIND.md)
- [Bind the certificate in IIS](/Integrations/CryptoHub/TLS_offloading/Microsoft_IIS/Bind_the_certificate_in_IIS.md)
- [Create an application partition for BIND](/Integrations/HSM/DNS/BIND/Integration_steps/Configure_the_Vectera_Plus/Create_an_application_partition_for_BIND.md)
- [Install and bind the certificate on the NDES server](/Integrations/CryptoHub/Endpoint_management/Microsoft_Intune/Install_and_bind_the_certificate_on_the_NDES_server.md)