Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.


To get our internal libravatar server working, I need to setup a SRV record for our public domain company.com:

_avatars._tcp.company.com.     IN SRV 0 0 80  avatars.internal

As you see the avatar server is on an internal domain that is not accessible from outside, thus the SRV record should not be available publicly.


We have a BIND DNS server that resolves requests for internal domains. This server forwards requests forward company.com to the public DNS server (and that should be kept that way so we only have to manage public names on one server).

Now how can I override the _avatars._tcp.company.com SRV record on our local BIND server, while forwarding all other requests to the public server?

I know this is easy with subdomains (just define a master zone for the subdomain, done), but I fail to do that for SRV records for the main domain. What can I do?

What I've tried

With the following setup, resolution works for the subdomain, but not for the main domain:

$ dig @localhost +short SRV _avatars._tcp.company.com
$ dig @localhost +short SRV _avatars._tcp.bookmarks.company.com
0 0 80 avatars.internal.


zone "_avatars._tcp.company.com" {
  type master;
  file "/etc/bind/db._avatars._tcp.company.com";
  allow-update { none; };

zone "bookmarks.company.come" {
  type master;
  file "/etc/bind/db.bookmarks.company.com";
  allow-update { none; };


$TTL    86400
@               IN SOA  @       root (
                                        2012082201      ; serial 
                                        3H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum

@               IN      NS      ns.company.com.
@               IN      A
_avatars._tcp.bookmarks.company.com.     IN SRV 0 0 80  avatars.internal.


$TTL    86400
@               IN SOA  @       root (
                                        2012082201      ; serial
                                        3H              ; refresh
                                        15M             ; retry
                                        1W              ; expiry
                                        1D )            ; minimum
@                              IN NS          ns.company.com.
@                              IN SRV 0 0 80  avatars.internal.
_avatars._tcp.company.com.     IN SRV 0 0 80  avatars.internal.

(yes the last two lines are identical, but just to make sure)

share|improve this question

1 Answer 1

Add a zone for the specific name (_avatars._tcp.company.com.) to your internal DNS server, containing the single record you wish to override.

A SRV record is not special - it is just a DNS record, and it behaves like any other DNS record.

The override zone should look similar to what's below

$TTL    3600

@       IN      SOA     dev.company.com. root.company.com. (
                                   2009071505  ; serial
                                   10800       ; refresh
                                   3600        ; retry
                                   3600000     ; expire
                                   86400 )     ; minimum

@   IN  NS  inside-ns.company.com.

_foo.dev.company.com.       IN  SRV 0   0   80  google.co.uk.
share|improve this answer
I tried it; it did not work. –  cweiske Aug 21 '12 at 18:12
Provide more details - I promise you it does work if done correctly (created on the nameserver your inside clients are querying, no rogue nameservers usurping the record). –  voretaq7 Aug 21 '12 at 18:35
voretaq7, I 've updatet the question. –  cweiske Aug 22 '12 at 5:50
@cweiske Your zonefile for _avatars.tcp.company.com1 is malformed (you need an NS record) -- named_checkzone should have caught this (and BIND should have cried about it when you loaded the zone). See my example (or your properly formatted file for bookmarks.company.com`) –  voretaq7 Aug 22 '12 at 6:31
I've added the NS entry, and named-checkzone does not error out anymore. However, resolving still does not work and named-checkzone tells me: warning: _avatars._tcp.company.com: bad name. And yes, the bind error log says that the zone does not get loaded because of bad name. –  cweiske Aug 22 '12 at 7:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.