Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to configure bind9 to be a local DNS only with no internet access at all. So I have 5 PCs in my virtual domain Within this domain there is no access to the internet.

The DNS server has entries like:

  • IN A
  • IN A
  • .
  • .
  • IN A

Bind is configured correctly but when I do a "dig @localhost pc1" on the DNS server it does not work because he gets stuck contacting the root servers. But I only want him to be local and to answer which IP pc1 has.

How can I achieve this?

share|improve this question
In addition to the answer below, you need you actually lookup a record that's on the server. "pc1" and "" are not the same and a DNS server will not make assumptions for you. – Chris S Jan 6 '12 at 14:03
Ok I guess "pc1 IN CNAME" will do the job, right? – JohnnyFromBF Jan 6 '12 at 14:08
In a zone file, names without a trailing period will be assumed to be relative to the zone itself. So if you have a zone, and records in it www IN A and ftp IN A then the FQDN version of those records is and respectively. You should not configure TLDs or records in that namespace. You should configure your clients with a domain name and search domains (if there are multiple), DHCP option 15 and 119 respectively. – Chris S Jan 6 '12 at 14:36
up vote 9 down vote accepted

To achieve this you need to create a fake root zone to replace the "root.hints" zone that's normally configured.

In named.conf put this:

zone "." IN {
        type master;
        file "fake.root";

and in fake.root put this:

$TTL    300
.               IN      SOA ns. (
                        20120101 1800 900 604800 86400
.               IN      NS      ns
ns              IN      A

This will prevent all attempts to access the internet to obtain the real root hints.

You can also put your entries directly into that root zone, too - there's no need for them to be in their own zone file, so you can just append the following to fake.root:

pc1             IN      A
pc2             IN      A
pc3             IN      A
pc4             IN      A
pc5             IN      A

Apart from any options { } that you may need (ACLs?) that's it - nothing else required.

share|improve this answer

You need to disable recursion:

Add to the config:

allow-transfer {“none”;};

allow-recursion {“none”;};

My config "named.conf" looks like this (on RHEL system):

options {
        allow-query {
allow-recursion {
share|improve this answer
Ok in which file do I have to put this? named.conf.options, named.conf.local or or db.10.10.1? – JohnnyFromBF Jan 6 '12 at 14:09
I added both to named.conf.options but now I don't get an answer on "dig @localhost" but the WARNING: recursion requested but not available. – JohnnyFromBF Jan 6 '12 at 14:38
For me it is named.conf, but I know what my distro is, I do not know what yours is.. – Tim Jan 6 '12 at 14:43
It's Debian 6. So you put both into the options section of named.conf? – JohnnyFromBF Jan 6 '12 at 14:46
It is declared right after "options" section. See the update to my answer. – Tim Jan 6 '12 at 16:31

You did not describe your configuration in enough detail. I think you are missing the authoritative part. You need to have a block like this in your config files:

zone "domain.lan" {
        type master;
        file "master/db.domain.lan";
        allow-update { none; };

where master/db.domain.lan should point to the zone file which should contain the records you posted above. Also, the zone file should have SOA (start of authority) record in its header. The zone file should like like:

domain.lan.     86400   IN SOA  dns.domain.lan. root.dns.domain.lan. ( 1 10800 3600 6044800 86400 )
                86400   IN NS   dns.domain.lan.

dns.domain.lan.      86400   IN   A
pc.domain.lan.    86400   IN   A

You can customize the names/values/IPs according to your needs.

share|improve this answer
@khalid I do have a zone just like you posted it, but bind tries to ask the root servers even if I dig for and thus times out. that sucks :( – JohnnyFromBF Jan 6 '12 at 15:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.