Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've setup an Ubuntu 10.04 BIND9 DNS server in my companies server room so that it has a redundant network, power supply, etc... It shares that room with 2 other servers. If I do an nslookup from those 2 servers to gmail.com it respond with a Non-authoritative answer without a problem. If I ask it to resolve an internal name it will also respond correctly.

I have two offices, A and B that are connected to that server room through a VPN. A normal windows laptop can resolve an internal name correctly, but when I try to resolve gmail.com it says *** UnKnown can't find gmail.com: Query refused.

I've haven't changed any of the options except add this to the forwarders:;;

Since this happens in both of my offices, but not in the server room I suspect it has something to do with our subnets. The server room is in th 10.0.2.x/24 subnet, office A is in the 10.0.5.x/24 subnet and office B is in the 10.0.4.x/24 subnet. Am I on the right track or is this totally wrong?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Change option 'recursion' and 'allow-recursion' for server or view. Set recursion to 'yes'. allow-recursion defines list of IP-address which are allowed to issue recursive queries. You could do this:

allow-recursion {;; };
share|improve this answer
You are right, acorrding to zytrax.com/books/dns/ch7/queries.html If recursion yes; (default) then, if allow-recursion is NOT present, defaults to allow-query-cache {localnets; localhost;};. Local cache access permitted to localnets and localhost only. –  Hiro2k Jan 27 '11 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.