Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup own dns server inside company, but i can't get it to work. I installed Bind9 on Ubuntu 12.04. I always get status: SERVFAIL, when i try using it. This is sample of one of my tests:

; <<>> DiG 9.8.1-P1 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 25725
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;                    IN      A

;; Query time: 1 msec
;; WHEN: Mon Nov 25 12:39:13 2013
;; MSG SIZE  rcvd: 28

This are my files:

// Do any local configuration here

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

// Load internal VPL d.o.o. forward and  backward zones.
zone "" {
        type master;
        file "/etc/bind/vpl-zone/db.vpl";

zone "" {
        type master;
        notify no;
        file "etc/bind/vpl-zone/db.192";


; BIND data file for local loopback interface
$TTL    604800
@       IN      SOA (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS
@       IN      A
@       IN      AAAA    ::1

; A NAME Records
ldap    IN      A


; BIND reverse data file for local loopback interface
$TTL    604800
@       IN      SOA (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS
11      IN      PTR


# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)


eth0      Link encap:Ethernet  HWaddr 00:0c:29:2c:94:cb
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::20c:29ff:fe2c:94cb/64 Scope:Link
          RX packets:26142 errors:0 dropped:684 overruns:0 frame:0
          TX packets:6495 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2341216 (2.3 MB)  TX bytes:1168912 (1.1 MB)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:152 errors:0 dropped:0 overruns:0 frame:0
          TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16049 (16.0 KB)  TX bytes:16049 (16.0 KB)


options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

         forwarders {

        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

I really don't know what I'm doing wrong so any advice would be helpful.
Thank you.

share|improve this question
Check your logs. – Michael Hampton Nov 25 '13 at 16:16

2 Answers 2

up vote 2 down vote accepted

In this case, you are getting a SERVFAIL because the zone is not valid. It is missing glue records (RFC1912 Common DNS Operational and Configuration Errors, Sec 2.3).

You have the NS (nameserver) resource record specified:

@       IN      NS

But you do not have an A (IPv4) resource record associated with the domain If is the address of your nameserver, then you will want to add something like this:

ns      IN      A

It is very likely that BIND is warning you about this. If making this adjustment does not fix your issue, then please post the contents of your BIND error from the time following a service restart. There may be other issues as well.

Also, I have a hunch that you don't actually want to specify ::1 as your AAAA (IPv6) resource record for Doing this will cause any server performing a lookup to believe that it (localhost) is the IPv6 address of

If you don't have IPv6 deployed in your network, then don't specify a AAAA record. Almost all IPv6 networks are dual-stack, and will work just fine without AAAA resource records specified.

See also:

share|improve this answer
Thanks, that solved the problem. :) – maestro Nov 27 '13 at 0:47

In your option section do you allow query and recursion?

allow-query { localhost;; }

allow-recursion { localhost;; }

recursion yes;

share|improve this answer
Where can i find my option section? – maestro Nov 25 '13 at 13:50
Usually it is in your named.conf – Piotr Nov 25 '13 at 13:52
Hi, thanks for your advice. I added options file, is this where i should put it? – maestro Nov 25 '13 at 13:56
I don't have a ubuntu anywhere now to test ... but you are looking for options { } configuration block (usually in named.conf) – Piotr Nov 25 '13 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.