Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up an authoritative DNS server with bind9 (9.7.3) on Ubuntu 11.04 and I am encountering some problems.

External problem

When trying to check my DNS configuration with the following tools solvedns.com/biotechnics.ro and dnscheck.pingdom.com/?domain=biotechnics.ro they fail with output messages like "Name server ns1.biotechnics.ro ( does not answer queries" or "Your name server ns1.biotechnics.ro is NOT responding to NS record queries!"

Also, external online dig tools such as this give back the following output:

; <<>> DiG 9.8.4-P1 <<>> @ns1.biotechnics.ro -t NS biotechnics.ro

; (1 server found)

;; global options: +cmd

;; connection timed out; no servers could be reached

Primary TLD from Parent

The parent is set up the following way:

; <<>> DiG 9.8.4-P1 <<>> @primary.rotld.ro -t NS biotechnics.ro
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7740
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;biotechnics.ro.            IN  NS

biotechnics.ro.     10800   IN  NS  ns2.biotechnics.ro.
biotechnics.ro.     10800   IN  NS  ns1.biotechnics.ro.

ns1.biotechnics.ro. 10800   IN  A
ns2.biotechnics.ro. 10800   IN  A

;; Query time: 279 msec
;; WHEN: Tue Feb 12 05:40:50 2013
;; MSG SIZE  rcvd: 100

Configuration on ns1

rsavu@host:/etc/bind$ head -40 named.conf
// ----------------------- Options -----------------------
options {
    // all relative paths use this directory as a base
    directory "/var/cache/bind";
    // version statement changed for security (to avoid hacking known weaknesses)
    version "not currently available";
    // This prevents bind from serving other than authoritative requests:
    recursion no;
    // disables all zone transfer requests for performance as well as security reasons
    dnssec-enable no; // zone not signed
    minimal-responses yes; // optional - improved performance
    additional-from-auth no; // optional - improved performance
    additional-from-cache no; // optional - minimal performance change

// ----------------------- Logging -----------------------
// log to /var/log/named/zytrax-named all events from info UP in severity (no debug)
// uses 3 files in rotation swaps files when size reaches 250K
// failure messages up to this point are in (syslog) /var/log/messages
    channel custom_log{
        file "/var/log/bind9_info.log" versions 3 size 250k;
        severity debug;
    category default{

// ----------------------- Zones -----------------------
zone "biotechnics.ro" in{
    type master;
    file "/etc/bind/db.biotechnics.ro";
    allow-transfer {; };
    also-notify {; };
    allow-query { any; };

Zone file

$TTL 36000      ; 10 hours
biotechnics.ro          IN SOA  ns1.biotechnics.ro. admin.biotechnics.ro. (
                                2013021201 ; serial
                                28800      ; refresh (8 hours)
                                7200       ; retry (2 hours)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
                        NS      ns1.biotechnics.ro.
                        NS      ns2.biotechnics.ro.
 $ORIGIN biotechnics.ro.
ftp                     A
ns1.biotechnics.ro.                     A
ns2.biotechnics.ro.                     A
www                     A

What I checked

  • There is no problem with the firewall (i disabled it for the moment)
  • Dig from inside the hosts work
  • Dig from slave works
  • Putting recursion yes; doesn't solve the problem
  • Netstat shows that port 53 is in use on UDP and TCP by named
  • named-checkconf and named-checkzone issue no warning.

What can be the problem? Any ideas? I don't understand what's happening and why isn't my host replying to queries.

[Later edit] The slave is on Debian 4.0 and works very well (as you can see in the dns solvers above.

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.