Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web server, port 53 is open for DNS. I am getting thousands of lines in my /var/log/messages that look like:

Jan 27 08:34:21 server named[14051]: client query (cache) '' denied

Jan 27 08:34:23 server named[14051]: client query (cache) '' denied

Jan 27 08:34:24 server named[14051]: client query (cache) '' denied

Jan 27 08:59:17 server named[14051]: client query (cache) '' denied

Jan 27 08:59:25 server named[14051]: client query (cache) '' denied

I am just wondering if this is normal, and if not what should I do about it?

share|improve this question
I don't think this is default for Red Hat/CentOS RPM. Did you install from other source? It's normal in the sense that you shouldn't be concerned but it is very noisy. I submitted an answer below that will help you move queries to their own file. – Aaron Copley Jan 27 '12 at 22:20
Is your "server" the authoritative nameserver for a domain you own? If not, you can deny port 53 from the internet. – dmourati Jan 27 '12 at 22:27
up vote 3 down vote accepted

You can customize how BIND logs. I send all queries to their own file.

From named.conf:

logging {  
    channel query_logging {  
        file "/var/log/query.log";  
        severity debug 3;  
        print-time yes;  
    category queries { query_logging; };  

Make sure to setup log rotation for your new query log in /etc/logrotate.d/named.

share|improve this answer

No need to worry. The lines tell you that someone is trying to query your nameservers for domains you are not authoritative for.

Also, you deny recursive lookups. Unless you really want to serve as a recursive name server to the world, it looks as it should

The last thing that could be the case is, that the person who owns those domains somehow pointed them towards your name server. Maybe it's an IP address that has been owned by someone else with name servers earlier?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.