Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a VPS with BIND set up. It works well for several months.

Recently I want to set up another DNS program to manage subdomain on this VPS. I've setup these in IN NS IN A  xx.xx.xx.xx

Since BIND listens on 53/udp, I configured it to listen on port 5353 and in named.conf:

zone "" {
 type forward;
 forwarders{ port 5353; };

I think this configuration will forward all queries for * to the second DNS program. But when I test it...

On the VPS itself:

dig @ -p5353 works good.

dig @ works good.

On my laptop:

dig -p5353 works good.

dig works good.

dig @ -t ns works good.

dig @ returns SERVFAIL.

Replacing with other DNS servers gets same results and there is nothing wrong with TTL.

Is there anyone knows what's wrong with my configuration? Here is more info:

Other BIND9 configuration:

options {
  directory "/var/cache/bind";
  notify yes;
  allow-transfer { xx.xx.xx.xx; };
  dnssec-enable yes;
  dnssec-validation auto;
  auth-nxdomain no;    # conform to RFC1035
  listen-on-v6 { any; };
  recursion yes;
  allow-recursion { any; };

And, specifically, the "second DNS program" is iodine, which tunnels IP over DNS queries. I followed this guide to set it up behind BIND9:

PS: I've tried another server with dnsmasq set up and use server=/ to test. Still gets errors.

Could anyone help? Thanks in advance.

share|improve this question
Well, I gave up forwarding a zone. I bought another IP and make iodine listen on that IP port 53. – Zhuoyun Wei Sep 21 '12 at 6:38
up vote 0 down vote accepted

First of all, I would suggest you use something other than 5353 as an alternate port for DNS servers. 5353 conflicts with zeroconf/mDNS.

The reason it only works when you use as a recursive resolver is because that's the only recursive server that's been told that it needs to go to a special DNS server on port 5353 to find

Because you can't specify a port number in an NS record, it's generally impossible to have a an authoritative server on a port other than 53. All of the recursive nameservers in the world are going to find the NS record for the domain in question and are going to try to contact that server on port 53. If you wanted them to use a different port, you'd have to configure every one of them with a forward zone pointing to port 5353.

By the way, it isn't clear why you want to host on a separate nameserver on a different port (or IP address). Why don't you just add the zone to the same authoritative nameserver that serves

share|improve this answer
Thanks for answering! My are hosted on, and my VPS serves other domains. I added NS record for on to make all queries for this subdomain to my VPS. Doesn't BIND on my VPS handle these queries and forward them to the second DNS program, getting the answer and tell the outside? I just followed this guide: – Zhuoyun Wei Sep 22 '12 at 1:41
No. When other nameservers ask your VPS's BIND for an answer, they don't ask for recursion. So your VPS's BIND answer only for what it knows authoritatively, and it doesn't have authority over (i.e. it is not serving that zone). – Celada Sep 23 '12 at 20:30
Thanks! I think I understood now. – Zhuoyun Wei Sep 24 '12 at 2:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.