Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up an authoritative DNS server with bind9 (9.7.3) on Ubuntu 11.04 and I am encountering some problems.

External problem

When trying to check my DNS configuration with the following tools and they fail with output messages like "Name server ( does not answer queries" or "Your name server is NOT responding to NS record queries!"

Also, external online dig tools such as this give back the following output:

; <<>> DiG 9.8.4-P1 <<>> -t NS

; (1 server found)

;; global options: +cmd

;; connection timed out; no servers could be reached

Primary TLD from Parent

The parent is set up the following way:

; <<>> DiG 9.8.4-P1 <<>> -t NS
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7740
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;            IN  NS

;; AUTHORITY SECTION:     10800   IN  NS     10800   IN  NS

;; ADDITIONAL SECTION: 10800   IN  A 10800   IN  A

;; Query time: 279 msec
;; WHEN: Tue Feb 12 05:40:50 2013
;; MSG SIZE  rcvd: 100

Configuration on ns1

rsavu@host:/etc/bind$ head -40 named.conf
// ----------------------- Options -----------------------
options {
    // all relative paths use this directory as a base
    directory "/var/cache/bind";
    // version statement changed for security (to avoid hacking known weaknesses)
    version "not currently available";
    // This prevents bind from serving other than authoritative requests:
    recursion no;
    // disables all zone transfer requests for performance as well as security reasons
    dnssec-enable no; // zone not signed
    minimal-responses yes; // optional - improved performance
    additional-from-auth no; // optional - improved performance
    additional-from-cache no; // optional - minimal performance change

// ----------------------- Logging -----------------------
// log to /var/log/named/zytrax-named all events from info UP in severity (no debug)
// uses 3 files in rotation swaps files when size reaches 250K
// failure messages up to this point are in (syslog) /var/log/messages
    channel custom_log{
        file "/var/log/bind9_info.log" versions 3 size 250k;
        severity debug;
    category default{

// ----------------------- Zones -----------------------
zone "" in{
    type master;
    file "/etc/bind/";
    allow-transfer {; };
    also-notify {; };
    allow-query { any; };

Zone file

$TTL 36000      ; 10 hours          IN SOA (
                                2013021201 ; serial
                                28800      ; refresh (8 hours)
                                7200       ; retry (2 hours)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
ftp                     A                     A                     A
www                     A

What I checked

  • There is no problem with the firewall (i disabled it for the moment)
  • Dig from inside the hosts work
  • Dig from slave works
  • Putting recursion yes; doesn't solve the problem
  • Netstat shows that port 53 is in use on UDP and TCP by named
  • named-checkconf and named-checkzone issue no warning.

What can be the problem? Any ideas? I don't understand what's happening and why isn't my host replying to queries.

[Later edit] The slave is on Debian 4.0 and works very well (as you can see in the dns solvers above.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.