Invoke named with privilege of bind:bind.

Change pidfile location to /var/run/named/pid.

etc/defaults/rc.conf

@@ -121,8 +121,7 @@ inetd_flags="-wW"		# Optional flags to inetd
 #
 named_enable="NO"		# Run named, the DNS server (or NO).
 named_program="named"		# path to named, if you want a different one.
-named_flags=""			# Flags for named
-#named_flags="-u bind -g bind"	# Flags for named
+named_flags="-u bind -g bind"	# Flags for named
 
 #
 # kerberos. Do not run the admin daemons on slave servers

etc/mtree/BSD.var.dist

@@ -55,6 +55,8 @@
     preserve
     ..
     run
+        named           uname=bind gname=bind
+        ..
     ..
     rwho            gname=daemon mode=0775
     ..

etc/namedb/named.conf

@@ -8,6 +8,7 @@
 
 options {
 	directory "/etc/namedb";
+	pid-file "/var/run/named/pid";
 
 // In addition to the "forwarders" clause, you can force your name
 // server to never initiate queries of its own, but always ask its