Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently upgraded BIND on my DNS server and now DNS isn't working for any of my websites. Performing an nslookup results in a timeout, and using dig on a different server tells me there are no authoritative sections returned in the query. Using dig locally on the server, however, produces the expected results.

I tried the tool found on DNSsy.com which tells me there are no A records for my nameserver, which appears to be incorrect based on my zone file. Below is one of the zone files I have configured (the actual domain names and IP addresses are substituted/masked):

example.com.zone

$ORIGIN example.com.
$TTL 1W
@       IN      SOA     ns.example.com. example.example.com.  (
                                      2011060701 ; Serial
                                      28800      ; Refresh
                                      14400      ; Retry
                                      604800     ; Expire - 1 week
                                      10800 )    ; Minimum
    IN  NS  ns
    IN  MX  10 mail

localhost IN A     127.0.0.1
@         IN A     x.x.x.x
ns        IN A     x.x.x.x
mail      IN A     x.x.x.x
www       IN CNAME @

named.conf

acl "xfer" {
        none;
};

acl "trusted" {
        127.0.0.0/8;
        ::1/128;
};

options {
        directory "/var/bind";
        pid-file "/var/run/named/named.pid";

        listen-on-v6 { ::1; };
        listen-on { 127.0.0.1; };

        allow-query {
                trusted;
        };

        allow-query-cache {
                trusted;
        };

        allow-recursion {
                trusted;
        };

        allow-transfer {
                none;
        };

        allow-update {
                none;
        };

        forward first;
        forwarders {
                8.8.8.8;                // Google Open DNS
                8.8.4.4;                // Google Open DNS
        };
};

logging {
        channel default_log {
                file "/var/log/named/named.log" versions 5 size 50M;
                print-time yes;
                print-severity yes;
                print-category yes;
        };

        category default { default_log; };
        category general { default_log; };
};

include "/etc/bind/rndc.key";
controls {
        inet 127.0.0.1 port 953 allow { 127.0.0.1/32; ::1/128; } keys { "rndc-key"; };
};

zone "." in {
        type hint;
        file "/var/bind/root.cache";
};

zone "localhost" IN {
        type master;
        file "pri/localhost.zone";
        notify no;
};

zone "127.in-addr.arpa" IN {
        type master;
        file "pri/127.zone";
        notify no;
};

zone "x.x.x.in-addr.arpa" IN {
  type master;
  file "pri/x.x.x.zone";
  notify no;
};

zone "example.com" IN {
  type master;
  file "pri/example.com.zone";
  notify no;
};

Output running named-checkconf

None, which I assume means it's okay.

Output running named-checkzone

named-checkzone example.com /var/bind/pri/example.com.zone zone example.com/IN: loaded serial 2011060701 OK

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

The allow-query directive is limited to only the trusted acl containing only localhost. This is why you get a response only from localhost. You need to change this to any.

Also note the listen-on and listen-on-v6 stanzas need to have IP addresses other than localhost in them - otherwise outside clients will never be able to connect to your nameserver.

share|improve this answer
    
I also needed to change listen-on to any. With that and your change, it works! –  cowgod Jun 7 '11 at 22:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.