Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


I have a question regarding NXDOMAIN/Unqualified Domain searches in BIND/DNS

What we want: We want the ability to have unresolved queries or unqualified searches go against a default bind zone. The reasoning for this is we have no dhcp server at our location and we have a lot of client machines we would have to end up adding suffixes for. This is undesired. What we are looking for is a replication of AD DNS global dns or the above.

Example: When user queries john.mydomain.com the local bind server sees this address and responds back with its information. When the user hits the dns server with an unqualified name such as john. It will try and resolve a TLD.

I have looked at origin directives and forwarding but come up short. We would like any DNS server or setup that works with this intended need, except for anything Microsoft.

Does anyone have any DNS ideas?

share|improve this question
So... you want a GlobalNames zone - without having to use a Microsoft DNS Server, the only product that features such a zone type? –  Mathias R. Jessen Dec 9 '13 at 14:39
... are you trying to reimplement WINS? –  MikeyB Feb 3 at 19:43

2 Answers 2

DNS servers return results for the names you ask them for.
If you ask for an unqualified name and the DNS server has no zone matching said name the proper result is to return NXDOMAIN ("That domain / name does not exist").

The only standards-conformant way to do anything close to what you're describing is to configure an appropriate DNS suffix search list on your clients.
If they are behaving properly they'll append the search suffixes to unqualified names (in the order the suffixes are specified) until they find a match or exhaust the list (and accept the NXDOMAIN response).

share|improve this answer
@user19039 I'm going to be blunt: If you do that you're breaking the internet. Your DNS server should conform to the RFC-specified behavior, not some foolish hack you want to implement to work around broken clients. –  voretaq7 Dec 9 '13 at 18:48
@user19039 For the record, I didn't edit my comment, and I stand by its original phrasing. What you are proposing is Bad And Wrong, and the fact that the folks responsible for BIND are implementing the functionality is equally Bad And Wrong. –  voretaq7 Dec 9 '13 at 19:50
This answer did not solve the problem. –  user19039 Jan 23 at 19:50
up vote -3 down vote accepted

Tested and confirmed working with bind 9.9.2

In bind 9.9.2 global name spaces are defined as using a redirect zone. So in named.conf.local the following zones were added.

zone "." {
        type redirect;
        file "/etc/bind/db.redirect" ;

db.redirect in /etc/bind

$TTL 300
@ IN SOA ns3.example.net hostmaster.example.net 0 0 0 0 0
@ IN NS ns.example.net
; NS records do not need address records in this zone as it is not in the
; normal namespace.
john.                                         IN      A
carmine.                                      IN      A

DNS entries from a domain authenticated pc will always append the domain suffix to unqualified queries. To account for this an added entry was done like

carmine.mydomain.local                         IN      A

Also note redirect zones cannot be slaves or updated. So to have a secondary server with this info. I created a ssh key and issued a scp copy from /etc/bind/db.redirect to the remote server from the remote server. Then a bind restart or reload will reload the zone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.