Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Bind9 instance acting as a caching (forwarding) name server for a group of mail servers. Basically it queries a few specific upstream nameservers only when the domains arent in the cache.

This name server is not authoritative for any domain (here are no zones).

I would like to use this Bind instance to 'blacklist' a few domains, similar to a DNSBL; I'd like to simply return 'NXDOMAIN' for domain ''. How can I do this?

I don't need any complex rbld or similar, it's just going to be for a few domains that I don't want anything to do with.

Relevant named.conf options:

options { 
        forwarders {
share|improve this question
up vote 1 down vote accepted

You could add the blacklisted domains in named.conf as a zone directive.

zone "" { type master; file "bad_domains"; };

then create bad_domains zonedata with only a SOA record in it.

Regards, jgr

share|improve this answer

I know only one method that BIND return NXDOMAIN:

zone "" {
        type slave;
        masters {; };

I prefer:

zone "" {
        type master;
        file "/etc/bind/";

; BIND data file for local loopback interface
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      localhost.
@       IN      A
*       IN      A

or without *

share|improve this answer
Bind returns NOERROR for in this case. If I remove everything but the SOA record from the data file, it returns SERVFAIL. Is there a way to get it to return NXDOMAIN? – mikewaters Dec 8 '10 at 19:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.