Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have:

  1. internal DNS server ns1.internal with IP
  2. external DNS server with an external TLD and internal IP It's accessible both from the Internet (via a static NAT rule) and from the local network.

I'm trying to setup my external DNS server to forward zone to the internal DNS server. The internal DNS server is authoritative for this zone.

Important: I can't modify the internal DNS server configuration. I can read it, however, if that's needed to diagnose the issue.

File /etc/named.conf on the external DNS server:

options {
  directory "/var/named";
  version "get lost";

  recursion yes;
  allow-transfer {"none";};
  allow-query { any; };
  allow-recursion { any; };

  channel example_log{
   file "/var/log/named/named.log" versions 3 size 2m;
   severity info;
   print-severity yes;
   print-time yes;
   print-category yes;
 category default{

// Zones:

zone "" {
  type master;
  file "";

zone "" {
  type forward;
  forwarders {; };

File /var/named/ on the external DNS server:

$TTL 1
@             IN      SOA (
                        2003080800 ; se = serial number
                        60         ; ref = refresh
                        60         ; ret = update retry
                        60         ; ex = expiry
                        60         ; min = minimum

@             IN      NS

So, now I try to resolve some DNS records. The external server zone seems to work.

workstation$ dig NS +tcp +short

But the forwarded zone does not work:

workstation$ dig NS +tcp

; <<>> DiG 9.8.1-P1 <<>> NS +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36887
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;        IN      NS

;; AUTHORITY SECTION:    1       IN      SOA 2003080800 60 60 60 60

;; Query time: 3 msec
;; WHEN: Thu Jul 19 17:27:54 2012
;; MSG SIZE  rcvd: 108

The results are identical when these commands are executed on remote Internet host and on an internal host.

If I try to resolve from external name server AND specify the internal server explicitly, I get:

mydns$ dig @ NS

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-16.P1.el5 <<>> @ NS
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 87
;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 3

;        IN      NS

;; ANSWER SECTION: 3600 IN NS      ns1.internal.

ns1.internal.      3600    IN      A

;; Query time: 613 msec
;; WHEN: Thu Jul 19 18:20:55 2012
;; MSG SIZE  rcvd: 163

What's wrong? How do I configure the forwarding DNS zone to work as I expect?

share|improve this question
My suspicion (I 'm not sure how to check it) is that the external DNS server fetches the records from the internal one and does not overwrite the fact that ns1.internal is responsible for the zone. So, the client's resolver tries to resolve that name (ns1.internal) and fails. – vadipp Jul 19 '12 at 12:14
try a dig +trace to see what exactly is happening. Also use nscd to enable query logging and check for errors. – coredump Jul 19 '12 at 12:38
First, increase the log level of the external bind to log individual requests. My speculation is that there has to be a delegation of the zone to the DNS server itself. Try to add this to the zonefile: subzone IN NS (i assume the zonefile has somewhere also the A record for, correct?) – Nils Toedtmann Sep 12 '14 at 8:07

Add a 'forward only;' statement to the forwarded zone:

zone "" {
    type forward;
    forward only;
    forwarders {; };
share|improve this answer

You have to configure the A RR for the NS "" on your external DNS. It's named "glue record" and will correspond to the IP of your internal DNS. Currently, your external DNS is not capable to known the IP of the internal DNS. Regards

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.