From everything I've researched and tried, it appears that my named.conf is configured correctly, including the allow-transfer section.

EDIT I just took out the allow-transfer block and restarted bind. This should now allow anyone to do a transfer. The ones that could before still can, but the two servers that had problems before are still being denied! EDIT

Here is a sample of the errors. It is only happening with a couple of my secondary servers, but it is happening for every zone for those servers that are failing. One of the servers is attempting IXFR, the other AXFR. The result is the same:

18-Mar-2011 14:27:51.372 security: error: client zone transfer 'juansgaranton.com/IXFR/IN' denied

18-Mar-2011 14:32:18.015 security: error: client zone transfer 'cheshirecat.net/AXFR/IN' denied

Here is the relevant part of named.conf.

options {
        directory "/etc/bind";
        pid-file "/var/run/named/named.pid";
        files 4096;

        allow-transfer {;;;
               ;;;; };

logging {
channel "bind" {
    file "/var/log/bind.log" versions 3;
    print-time yes;
    print-severity yes;
    print-category yes;
    severity info;

category lame-servers { null; };
category "default" { "bind"; };
  • Do you have a more restrictive allow-transfer in your zone configuration blocks? – Zoredache Mar 18 '11 at 23:13
  • Nope, just the one global. – danielj Mar 18 '11 at 23:16
  • Have you tried briefly adding an allow-transfer setting into one of your zones? – Zoredache Mar 18 '11 at 23:18
  • At your suggestion, I just tried it. No difference. – danielj Mar 19 '11 at 2:21
  • 1
    Also verify that you're allowing TCP:53 to the server you're trying to transfer from. – Greeblesnort Apr 11 '11 at 20:48

Check your firewall to make sure you have port 53/tcp open from your slaves. If the zone is larger than 512 bytes the transfer needs to go across tcp versus udp.

| improve this answer | |

I know this is old and already answered, but I wanted to throw in another option that hit me.

Same error, but was caused by the local permissions on the filesystem. (technically I had forgotten to give it the correct path, so it was trying to write to a directory it had no access to). So if you see an error like this check the file stanza in your named.conf for the zone in question.


zone "example.net" {
  type slave;
  file "slave/example.net.db";
  masters {;
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.