Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Debian 4.3.2-1 and Apache 2 on my production server. Watching the logs, I noticed Apache is resolving client's hostnames even with HostnameLookups Off in apache2.conf. I want to avoid these lookups so I'm guessing Apache is making this DNS query because I have mod_authz_host enabled. When I try to unlink this module, I get several modules complaining because they use the Order directive.

How is the clean way to go? Should I comment all Order directives like

Order allow,deny
Deny from all

Is this the only way to stop Apache from making DNS requests? I would like to deny access to .htaccess files and some rules like that.

share|improve this question

mod_authz_host will only perform DNS lookups, if you actually use domain names in any Allow/Deny directive (and then this will happen irrespective of the HostnameLookups setting). So if you don't want those DNS lookups happening, get rid of the domain-name based authorisation config, if that's at all possible.

share|improve this answer
Does 'Allow from localhost' perform a lookup? I have only 'All', 'None' and localhost names in my directives. Thank you very much for your help. it's nice i can keep the module working. – odeceixe Jul 22 '10 at 15:02
Most likely, yes, but this lookup won't be costly (assuming you have an entry for localhost in /etc/hosts). But if that bothers you, better use Allow from instead (also add ::1 if you have IPv6 enabled). – earl Jul 22 '10 at 15:46
thank you earl, i think my problem was LogFormat using %h, which to my surprise forces a dns lookup ignoring HostNameLookup. Wonder why debian's apache 2 has %h on default config when it's rarely needed... LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined i found it here – odeceixe Jul 22 '10 at 18:56
I doubt that's really the problem. %h is in Apache's default LogFormat alongside HostnameLookups switched off. I also use %h on many of my hosts with hostname lookups turned off (mostly Apache 2.2.9 on Debian Lenny), and don't see any resolved IPs in my logfiles. But if using a different LogFormat fixes things for you, it's great. – earl Jul 22 '10 at 20:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.