Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this in /etc/named.conf, I commented the default values and set my own under it. My domain would not load in browser unless I set allow-query to "any", is this OK, what should I edit? If is localhost or;; domain would not load. I tried the 127.. thing because it mentioned it here:

Bind version is 9.7.0-P2-RedHat-9.7.0-5.P2.el6_0.1 OS is CentOS 6.0.

options {
        // listen-on port 53 {; };
        listen-on port 53 { any; };
        //listen-on-v6 port 53 { ::1; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        //allow-query     { localhost; };
        allow-query     { any; };

        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
share|improve this question
up vote 5 down vote accepted

When you listen-on or localhost or ::1, and/or allow-query from localhost only, bind will answer only to queries originating from the same computer that runs bind. (It set this way in "testing" probably because they probably just meant to test that bind works without opening it to outside for security reasons.)

It is normal to set those to "any" so that it will be accessible from outside.

share|improve this answer
Some online articles mentioned that it might be exposed to DOS attacks if "any". If I understood correctly. – adrianTNT Nov 12 '11 at 17:49
Well, even if that's true, without "any" it won't work ;) – Sandman4 Nov 12 '11 at 18:15
Btw, what your server purpose is ? Is it only authoritative for some your zone ? Who should be able to access your server ? – Sandman4 Nov 12 '11 at 18:17
It is an image hosting site, it will host multiple domains on same IP. Domain is at godaddy where I set two "hosts" ns1.domain ns2.domain and associated these NS with my server IP. – adrianTNT Nov 12 '11 at 19:56
Ok, so it should be accessible from outside. Thus it must be "any". And you better set "recursion no" if you afraid of attacks. But doesn't godaddy provide nameservers for you ? – Sandman4 Nov 12 '11 at 20:04

If your DNS server is a local caching server, set

allow-query { <your subnet>; }; 

in options. And, in each zone:

allow-query { any; };

If you are not using it as a caching server, set it on options to none;

allow-query { none; };

Basically, you don't want your server answering to domains you are not authoritative.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.