Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a lot of this entries in /var/log/syslog , 1 each 20 seconds. I see that are rejected but nevertheless I don't think is a good thing that somebody is pinging my server for DNS checks or whatever they are.

Feb  2 14:54:14 KAW001 named[2398]: client query (cache) '' denied
Feb  2 14:54:34 KAW001 named[2398]: client query (cache) '' denied
Feb  2 14:54:54 KAW001 named[2398]: client query (cache) '' denied

Any suggestions?

share|improve this question
Suggestion - change your title to something like "Lots of DNS queries" or something similar. – mfinni Feb 2 '11 at 14:23
up vote 10 down vote accepted

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network.

I wouldn't be worried.. It happens when you put a DNS server public..

share|improve this answer
so no suggestions? just let them ping me to the end of internet? maybe something is wrong on their part and I should tell them. – Elzo Valugi Feb 2 '11 at 14:20
@Elzo - welcome to the world of administering a service that's open to the whole internet. Don't worry about other people's systems unless you're being actively attacked. – mfinni Feb 2 '11 at 14:24
thanks to all of you – Elzo Valugi Feb 2 '11 at 14:34

You didn't specify whether this DNS server is public or private.

If it is an internal / private server, then you really need to take a look at your firewall configuration, because packets should not be hitting the DNS server in the first place. You have probably correctly configured your DNS server to disallow external queries, but your firewall should not allow these queries in the first place, in which case you should look at blocking port 53.

If this is an open, public DNS server, then it's likely that you have a problem in your config file. On the other hand, if you are only authorative for certain domains, then the logs you are seeing is the correct behaviour.

share|improve this answer
thx for the suggestions. this server is private and now the port is blocked by firewall – Elzo Valugi May 4 '11 at 20:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.