Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a djbdns dnscache running; is there a way to have it return a specific IP instead of NXDOMAIN?

share|improve this question

dnscache is literally that: a DNS cache. If you wanted to specify A (forward resolution) records for a domain under your control, you would need to run a full-featured DNS such as BIND or djbdns.

To respond with an IP when a NXDOMAIN response is sent, you would be breaking the RFC. NXDOMAIN rewriting is a controversial practice that is not recommended and generally not supported, as it breaks the RFC. Neither djbdns nor BIND have native support for this.

From what I understand, there are only commercial solutions currently implementing this. This includes Barefruit and several others.

This is an interesting post from a mailing list where someone who appears to be Keith Mitchell, the ISC Director of Engineering, states that he doesn't want to introduce support in BIND.

If you have a legitimate need, we might be able to be able to offer you an alternative technical solution.

share|improve this answer
I was thinking of running a local tinydns instance along with dnscache, that returns say for every A record. The only problem is getting dnscache to use that 'fake' server when the root servers say that the domain doesn't exist. I'm not stuck at djbdns at this point, and i'll gladly use something else (even BIND), if it makes this easier. – user39221 Mar 30 '10 at 16:09
Basically i want NXDOMAIN rewriting - whoever is using my dnscache and wants to get an A record for a nonexistent domain, it returns – user39221 Mar 30 '10 at 16:21
@Warner - yes, that post was written by Keith @ ISC – Alnitak Mar 30 '10 at 23:36

It's a requirement of our intranet setup; i know it's controversial and whatnot, but that's beside the point.

I managed to get it to work - i don't know if it will break anything else though; so far it seems ok.

After watching dnscache logs, i found out that, after trying the root servers to resolve, it will try to resolve (where is the name of localhost). So i set up tinydns on the loopback interface ( to serve for * Then i added the loopback ip as a server for in dnscache/root/servers.

The only drawback with this setup is that lookups for resolve to, but that's not an inconvenience.

share|improve this answer
+1 a clever solution. – Warner Mar 30 '10 at 18:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.