Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's my named.conf

// named.caching-nameserver.conf
// Provided by Red Hat caching-nameserver package to configure the
// ISC BIND named(8) DNS server as a caching only nameserver
// (as a localhost DNS resolver only).
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// DO NOT EDIT THIS FILE - use system-config-bind or an editor
// to create named.conf - edits to this file will be lost on
// caching-nameserver package upgrade.
options {
        listen-on port 53 {; any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";

        forward only;
        forwarders {
        # the following IP addresses are my ISPs DNS Servers. These will be used for looking up
        # hostnames that I don't locally manage, i.e. the REST OF THE INTERNET!
        XXX;     # my ISPs DNS Server #1
        XXX;     # my ISPs DNS Server #2

        // Those options should be used carefully because they disable port
        // randomization
        // query-source    port 53;
        // query-source-v6 port 53;

        allow-query     { localhost; };
        allow-query-cache { localhost; };
        allow-recursion { localhost; };

logging {
        channel default_debug {
                file "data/";
                severity dynamic;
view localhost_resolver {
        match-clients      { localhost; };
        match-destinations { localhost; };
        recursion yes;
        include "/etc/named.rfc1912.zones";

        zone "" {
                type master;
                file "";
include "/etc/rndc.key";

Here's my zone file:

; Zone file for
$TTL 14400 86400   IN      SOA     (
                                                2013032213 ;Serial Number
                                                86400 ;refresh
                                                7200 ;retry
                                                3600000 ;expire
                                                86400   ) 86400   IN      NS 86400   IN      NS 14400 IN    A       xxx 14400 IN    A       xxx 14400   IN      A       xxx

localhost       14400   IN      A

www     14400   IN      CNAME
ftp     14400   IN      A       xxx

Bind is running. named-checkconf and named-checkzone return ok. The domain nameservers were also created at the domain registrar. The server also has the IPs in eth0:x...eth0:n. Any ideas what could I be doing wrong?

share|improve this question
Could you please provide the sample output of dig including the address of server you're doing dig against? And also above mentioned configuration is not serving this zone to internet, in case you're expect it to. – abbe Mar 24 '13 at 18:24
I am actually wanting to serve internet. I put it inside local_resolvers because named_checkconf asked me to do so. Or is something else what I'm doing wrong? I'm trying to reach and dig does not return anything, it just hangs. – Lucas Gomez Mar 24 '13 at 18:33
a quick whois indicates your nameservers are in-zone (i.e for the domain) - do you have a glue record in place with the domain registrar, so it knows where to find your name server? – Mark Regensberg Mar 24 '13 at 19:38
@MarkRegensberg Yup, created the nameservers in namecheap too. – Lucas Gomez Mar 24 '13 at 19:57
Why did you install the caching-nameserver package? This is strictly for local resolvers that aren't serving any zones. This is what the text at the top of named.conf is warning you about. – Michael Hampton Mar 24 '13 at 21:50
up vote 5 down vote accepted

I see two problems with your configuration:

  1. Inside the options you have defined allow-query { localhost; };. This instructs your bind DNS server to answer only to localhost and to silently drop all queries from other IP addresses.
  2. Your domain is defined only inside your localhost_resolver view. This instructs bind to read and serve the zone's contents only to IP addresses that match the match-clients and match-destinations options.

Because of these two problems your DNS server(s) are not answering to any requests for the domain:

$ host -t ns -v
Trying ""
;; connection timed out; no servers could be reached

I suggest you create an additional view, for serving your public zones. You don't need recursion enabled in there, nor the blackhole zone and it should match and answer queries from any IP address.

view "external-in" in {
    match-clients { any; };
    notify yes;
    recursion no;
    additional-from-auth no;
    additional-from-cache no;
    auth-nxdomain no;    # conform to RFC1035
    allow-query { any; };

    zone "" in {
        type master;
        file "";
        allow-transfer { xferservers; };

Note that you will need to add an ACL called xferservers with the IP addresses that should be able to initiate AXFR and IXFR zone transfers and adapt the zone snippet for your slave DNS server.

PS. Always check your config before applying it.

share|improve this answer
Even though this wasn't exactly the issue causing my problem in particular this config helped me greatly to keep things running smoother! Thanks! – Lucas Gomez Mar 25 '13 at 0:36

zorlem has the best answer based upon the information you have provided, but I also wanted to add that there are several excellent diagnostic web sites that reduce the burden of te many different "dig" commands you have to do to fully diagnose DNS issues.

One that I use a lot is which has the following to say regarding your domain:


50.0% recvfrom failed from; Connection refused - recvfrom(2) at (    
50.0% recvfrom failed from; Connection refused - recvfrom(2) at (

So at the very least, your named is not listening for connections on those IPs.

share|improve this answer
This probably would have worked better as a comment to zorlem's answer. While you wouldn't have had the space for the example, this really isn't adding anything other than a tool recommendation. – Andrew B Mar 24 '13 at 22:59
Oh sorry. I went to do that but the tooltip saying "ask author for clarification about this post" put me off, as I wasn't. Still rather new at this. – grifferz Mar 25 '13 at 21:36
No problem. :) The general rule is "don't reply with an answer unless it provides a different solution". If an existing answer can be built upon, either leave a comment or provide an edit. (unless the answer was lazy and you are doing the work for them) – Andrew B Mar 25 '13 at 21:46
Even if the format is wrong... is super handy and a valid suggestion for later troubleshooting. – cpt_fink Apr 8 '13 at 3:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.