Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have around 200k same entries in my /var/log/messages received from named, like:

Oct 29 15:48:34 server named[878]: client 75.100.*.*#56448: view external: query (cache) '' denied

Where is an external domain not related to my site and being blocked for some reasons. External view is configured as below:

view    "external" {
    recursion no;

    zone "." IN {
        type hint;
        file "/var/named/";

zone "" {
        type master;
        file "/var/named/example2.db";

Where is my own domain. Could you please explain what actually does the log entry mean and what should I do to prevent it from being logged?


Configuration: CentOS 6, BIND 9.7

share|improve this question

It seems you have users querying your server for names that aren't yours. If the 200k log events are all from the same client IP address, I'd block that IP in my firewall for 24-48 hours to see if they stop and report them to their ISP. If they're from many different addresses (especially from different ISPs and different parts of the world), I'd spend some time to figure out why they're querying your server.

dig NS

Does the above command mistakenly list your name server as an authoritative one for their domain? If so, contact them using their whois contact information.

share|improve this answer
All IPs are different and ISP's as well. Interesting, but many domains are not existent and many of them are from porno resources. I've blocked most popular IP's but that didn't help much. Possible a DOS attack on my server? – Andrew Oct 30 '11 at 0:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.