Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am experiencing an issue with bind. If i want to resolve any domain name that is on the zone file. It works fine. However, when I try to resolve anything that does not belong to the zone file. I know that actual DNS servers that are being forwarded are working fine. But somehow bind9 fails to use them. The content of /etc/bind/named.conf.options is:

options {
directory "/var/cache/bind";
forwarders {;;
dnssec-validation auto;
auth-nxdomain no;    # conform to RFC1035
listen-on-v6 { any; };

I have also tried to use only one ip address and it still did not work. also the content of /etc/bind/named.conf is:

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

So there is no problem with including options file. Any recommendations for fixing this problem?

share|improve this question
up vote 13 down vote accepted

I had this issue before with recent version of Bind (9.8.1).

The following option solved the problem for me :

dnssec-validation no;

share|improve this answer
That solved my problem, but do you know the reason why it does not work when it is auto? – Sarp Kaya Sep 20 '12 at 4:01
Maybe it's because I'm using a fake root zone like intra. or local. Are you in the same situation ? – profy Sep 20 '12 at 9:07
save my day. Hadnt take this parameter too serious. – MealstroM Jan 15 '13 at 19:08
Was dnssec-validation auto; changed to 'no' - now forwarding works. -thanks! – Jason Morgan Oct 16 '13 at 15:09

You need to differentiate between your bind misconfiguration and not-working forwarders.

You can verify whether the forwarders are working or not using a command like:

$ dig @

If you received a valid response, it is a working DNS server and so on.

You may need to add an explicit allow-recursion in your bind configuration. It is recommended to restrict this to specific IPs/subnets.

share|improve this answer
DNS servers are working. My question is bind9 does not forward any requests to these forwarders. – Sarp Kaya Sep 19 '12 at 7:48
Better way is to use dig @nameserver -trace sitename, this will show where the answer is being gotten. – MealstroM Jan 15 '13 at 19:09
allow-recursion was the key for me. Thanks. – Diego F. Durán Aug 5 '14 at 15:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.