Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I'm attempting to set up a DNS server that points to two other internal DNS servers.

Internal DNS servers: // My box: .. name is kerrigan.zipp

I've got bind configured and clients can hit internal addresses but can't seem to grab anything external.

[root@zeratul ~]# ping kerrigan.zipp
-- Ping succeeds --

[root@zeratul ~]# ping
ping: unknown host

In doing a tcpdump on Kerrigan.zipp, I can see that the request for is being made to dns1 ( and a reply is coming back.

15:30:37.775949 IP kerrigan.zipp.50825 > 13756+ A? (28)
15:30:37.776383 IP > kerrigan.zipp.50825: 13756 4/13/8 A, A, A, A (491)

It appears as though kerrigan.zipp is getting the replies and then not doing anything with them. If I take the ip address returned from dns1, I can ping it without a problem.

[root@zeratul ~]# ping
-- Ping succeeds --

Any ideas? Oh, and I turned off the firewall just to be sure. Port 53 tcp / udp were open.

Result of the dig commands.. These show that I can get it from my forward DNS but not my new, local DNS:

[root@kerrigan named]# dig @

; <<>> DiG 9.7.3-RedHat-9.7.3-1.fc14 <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33681
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 13, ADDITIONAL: 8

;            IN  A

;; ANSWER SECTION:     256 IN  A     256 IN  A     256 IN  A     256 IN  A

;; Query time: 1 msec
;; WHEN: Wed Mar  2 16:33:26 2011
;; MSG SIZE  rcvd: 491

[root@kerrigan named]# dig @

; <<>> DiG 9.7.3-RedHat-9.7.3-1.fc14 <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61769
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;            IN  A

;; Query time: 1 msec
;; WHEN: Wed Mar  2 16:33:36 2011
;; MSG SIZE  rcvd: 28
share|improve this question
The all-important bind.conf snippet, showing the world how you've told your local machine's DNS server to forward query resolution off to other DNS servers in the first place, is missing. – JdeBP Mar 3 '11 at 3:57
You mean these? (/etc/named.conf) forwarders {;; }; forward only; I set it to 'forward only' for testing. I plan on running it as 'forward first' – Zipp Mar 3 '11 at 16:06

Well, I got it.

/var/log/messages was showing this:

Mar  2 21:35:32 kerrigan named[8138]: error (broken trust chain) resolving '':

So I figured something was up with dnssec. Previously I had commented them out; I explicitly set them to 'no' in /etc/named.conf

dnssec-enable no;
dnssec-validation no;

My client can hit the interpipes and ping my bind server's master zones. >:3

share|improve this answer

Try using the host command to see what the servers are returning. The command host will tell you what believes the addresses of are. (Google should have multiple addresses, most sites have one.) Try it with each of your DNS servers.

Also try getent hosts This will give the resolver's version of addresses for You should get roughly the same results for all four commands.

EDIT: To run the host command you may need to install the bind9-host package to get the host command. However, it is often installed by other packages.

EDIT2: If one of the DNS servers is not returning a result to you, check its security setting. You may also want to temporarily enable logging on the DNS server. The following is the logging specification block I have used on my bind server.

logging {
        channel query.log {
                file "/var/log/query.log";

                // Set the severity to dynamic to see all the debug messages.
                severity debug 3;

        // Selectively Enable logging
        category default { query.log; };
        category general { query.log; };
        category client { query.log; };
        category unmatched { query.log; };
        category network { query.log; };
        category queries { query.log; };
        category security { query.log; };
        category dispatch { query.log; };
        category delegation-only { query.log; };
share|improve this answer
I just appended some digs, if you'd like to take a look. – Zipp Mar 2 '11 at 21:38
@Zipp. I added some bind logging code I used to debug configuration issues. – BillThor Mar 2 '11 at 21:52
Mar 2 17:32:20 kerrigan named[8138]: received control channel command 'querylog' Mar 2 17:32:20 kerrigan named[8138]: query logging is now on – Zipp Mar 2 '11 at 22:33
dumping master file: tmp-84AJoGtrui: open: permission denied << This seems odd. Shows up in /var/log/messages – Zipp Mar 2 '11 at 22:39
Bind needs to be started as root or the file pre-created wit appropriate accesd to enable logging to the specified file. Log level likely duplicates to messages, but it can be more difficult to watch it than a dedicated file. – BillThor Mar 2 '11 at 22:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.