Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What will I need to configure on my Bind to use the IANA Blackhole servers for authoritative answers? Right now, if I run a query on a "private" address, I get, i.e.:

[david@foobar]$ nslookup
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

** server can't find NXDOMAIN

The XXX.XXX.XXX.XXX are my DNS IP address.

When I use a different DNS server, I get:

[david@varimathras]$ nslookup
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

Non-authoritative answer:      name =

Authoritative answers can be found from: nameserver = BLACKHOLE-2.IANA.ORG. nameserver = BLACKHOLE-1.IANA.ORG.
BLACKHOLE-1.IANA.ORG    internet address =
BLACKHOLE-2.IANA.ORG    internet address =

Both servers, "foobar" and "varimathras" are connected to the Internet and otherwise working properly.

share|improve this question
up vote 1 down vote accepted

If your server is able to access DNS via the Internet and is properly configured, it should automatically. The blackhole servers are registered in the DNS directory for the RFC1918 address revisions, which eliminates the DNS timeout as they should not resolve.

Being as that you are receiving a NXDOMAIN result, it leads me to believe things are operating as expected.


It looks like you have a PTR (reverse) zone for the subnet specified on your DNS. Remove the zone and it will go to the root.

share|improve this answer
Hmm, when I go to a different server, I get a different answer. I will amend my question to reflect this. – user1797 Jul 15 '10 at 15:59
Updated for your edit. – Warner Jul 15 '10 at 16:05
If I remove the forwarding --not PTR-- (I am actually forwarding queries for 10.171.238.XXX to another internal DNS not under my control), some applications that relay on gethostbyname (like NetBackup agents) will fail, since the reverse DNS lookup will not resolve. Any other ideas? Thanks! – user1797 Jul 15 '10 at 18:47
If you don't want specific entries to resolve, you're going to have to remove them from the DNS that's responding to the queries. It's that simple. If it doesn't respond for the zone, the authoritative will be contacted. You have limited to no options if you cannot influence the contents of the DNS not under you direct control. – Warner Jul 15 '10 at 18:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.