Hi there Serverfault folks!

First of all: sorry about the title, I had some problem coming up with the proper title.

I have a little home server set up, for internet sharing, samba, basic http, dlna mediaserver and what not, and I happend to have a domain at hand, so I thought why not direct it to this computer?

I have a BIND 9.8.0 installed, and - afaik - configured it properly.

For a few days, the public view did not worked, and I really did not cared, since the local view worked. But now suddenly, even the local view fails.

If I try to query the nameserver for anything in my domain, it returns the following error:

$ nslookup andromeda.dafaces.com
;; Got SERVFAIL reply from ::1, trying next server
;; Got SERVFAIL reply from ::1, trying next server

** server can't find andromeda.dafaces.com.dafaces.com: SERVFAIL

Also, the public view points to the old ip address of the domain, probably because of the same error.

Some information about the system:

$ uname -a
Linux tressis 2.6.37-ARCH #1 SMP PREEMPT Tue Mar 15 09:21:17 CET 2011 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ AuthenticAMD GNU/Linux

$ named -v
BIND 9.8.0

And the named.conf file:

# cat /etc/named.conf
// /etc/named.conf

include "/etc/rndc.key";

#controls {
#       inet allow {localhost; } keys { "dnskulcs"; };

options {
        directory "/var/named";
        pid-file "/var/run/named/named.pid";
        auth-nxdomain yes;
        datasize default;
// Uncomment these to enable IPv6 connections support
// IPv4 will still work:
        listen-on-v6 { any; };
        listen-on { any; };
// Add this for no IPv4:
//      listen-on { none; };

// Default security settings.
//      allow-recursion {; ::1;; };
//      allow-recursion { any; };
        allow-query { any; };
        allow-transfer {; ::1;;;; };
        allow-update { key "dnskulcs"; };
        version none;
        hostname none;
        server-id none;
        zone-statistics yes;

        forwarders {;;;;;; 2001:470:20::2; };

view "local" {

        match-clients {;; ::1; fec0:0:0:ffff::/64; };
        recursion yes;

        zone "localhost" IN {
                type master;
                file "localhost.zone";
                allow-transfer { any; };

        zone "0.0.127.in-addr.arpa" IN {
                type master;
                file "127.0.0.zone";
                allow-transfer { any; };

        zone "." IN {
                type hint;
                file "root.hint";

        zone "dafaces.com" IN {
                type master;
                file "internal/dafaces.com.fw";
                allow-update { key "dnskulcs"; };

        zone "1.168.192.in-addr.arpa" IN {
                type master;
                file "internal/dafaces.com.rev";
                allow-update { key "dnskulcs"; };

view "public" {
        match-clients { any;};
        recursion no;

        zone "dafaces.com" IN {
                type master;
                file "external/dafaces.com.fw";
                allow-transfer {

//zone "example.org" IN {
//      type slave;
//      file "example.zone";
//      masters {
//    ;
//      };
//      allow-query { any; };
//      allow-transfer { any; };

logging {
        channel xfer-log {
                file "/var/log/named.log";
                print-category yes;
                print-severity yes;
                print-time yes;
                severity info;
        category xfer-in { xfer-log; };
        category xfer-out { xfer-log; };
        category notify { xfer-log; };

All help would be highly appreciated!

EDIT: Zone files:

# cat /var/named/internal/dafaces.com.fw
$TTL 3600       ; 1 hour
dafaces.com             IN SOA  tressis.dafaces.com. postmaster.dafaces.com. (
                                2011032201 ; serial
                                28800      ; refresh (8 hours)
                                7200       ; retry (2 hours)
                                2419200    ; expire (4 weeks)
                                3600       ; minimum (1 hour)
                        NS      tressis.dafaces.com.
                        MX      10 mail.dafaces.com.
$ORIGIN _tcp.dafaces.com.
_http                   SRV     0 5 80 www.dafaces.com.
_ssh                    SRV     0 5 22 tressis.dafaces.com.
$ORIGIN dafaces.com.
acrisius                A
andromeda               A
andromeda-win7          CNAME   andromeda
aspasia                 A
athena                  A
callisto                A
db                      A
management              A ; web management for the router functions
haley                   A
hoth                    A
mail                    A
satelite                A
sony-player             A
                        TXT     "310f16de2d2712dfc4ae6e5c54f60f828e"
torrent                 A
tracker                 A
tressis                 A
www                     A
zeus                    A


# cat /var/named/external/dafaces.com.fw
$TTL 3600
dafaces.com             IN SOA  ns.dafaces.com. postmaster.dafaces.com. (
                                        2011032405; serial
                                        28800; refresh
                                        7200; retry
                                        2419200; expire
                                        3600; minimum

                        NS      ns.dafaces.com.
                        NS      ns0.xname.org.
                        NS      ns1.xname.org.
                        NS      ns2.xname.org.

                        MX      10 mail.dafaces.com.

$ORIGIN dafaces.com.
_ssh._tcp               SRV     0 5 22 tressis
_http._tcp              SRV     0 5 80 www

ns                      A
hoth                    A
www                     A
mail                    A
db                      A

torrent                 A
tracker                 A


Ohh, hell I almost forgot. Since the node is connected to the internet via a residential connection, there is a possibility, that the public ipv4 address will change(but thank god, it is a very rare case), so I daily update the external IP address in the zone file with a shellscript:

# cat /etc/cron.daily/dnsupdate

SERIAL=$(date +%Y%m%d05)
PUBLIC_IP=$(ifconfig internet |sed -n "/inet addr:.*{s/.*inet addr://; s/ .*//; p}")

cat $FILE | sed --posix 's/^.* serial$/\t\t\t\t\t'$SERIAL'; serial/' | sed --posix 's/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/'$PUBLIC_IP'/'  > /tmp/ujzona
mv /tmp/ujzona $FILE
/etc/rc.d/named reload
  • What do you have in file "internal/dafaces.com.fw"?
    – laurent
    Mar 25, 2011 at 2:03
  • zone file for the internal network
    – estol
    Mar 25, 2011 at 3:08
  • 1
    sure but you may have an error there like a missing dot
    – laurent
    Mar 25, 2011 at 3:17
  • good point, posted both zone files.
    – estol
    Mar 25, 2011 at 4:32
  • I am guessing the nslookup appends the domain to the name you are querying because you do not have a search domain in /etc/resolv.conf
    – topdog
    Jul 29, 2012 at 7:59

2 Answers 2


Try changing the lines:

dafaces.com             IN SOA  tressis.dafaces.com. postmaster.dafaces.com. (


dafaces.com. IN SOA tressis.dafaces.com. postmaster.dafaces.com. (

  • Should work for the internal part but how do you manage the external part with dynamic ip? Do you have a DynDNS or something like that pointing to your IP? Which NS did you use on the domain registrar?
    – laurent
    Mar 25, 2011 at 13:11
  • It is kind of tricky. Done through ipv6, since that address is static. This would be off topic, but if you are intrested, I am happy to share in pm, or in another discussion. Also, tried the possible solution, no change, still serverfail.
    – estol
    Mar 25, 2011 at 14:17
  • A lack of the final dot causes it to add the $ORIGIN to the end. Usually $ORIGIN is the zone name so the first example (in this answer) would end up creating an SOA record for 'dafaces.com.dafaces.com'. However, in the files posted $ORIGIN is explicitly set to '.', so the lack of a dot should have no effect in this instance.
    – USD Matt
    Nov 30, 2012 at 12:05

The usual mantra: "what's changed?" By any chance have you fiddled with /etc/resolv.conf, maybe trying to tighten down the timeout a little? (Or is it possible the machine that's running BIND is quite a bit more heavily loaded and significantly slower than it was at first?)

Only a network trace (wireshark?) would tell for sure, but it looks to me like the first request for foo.bar.baz isn't being returned fast enough, so the resolver is timing out and then trying foo.bar.baz.bar.baz (append "domain" to whatever ...even if it's a silly duplication). That second query probably never did work right even before (possibly because of the missing trailing dot mentioned in another response), but it didn't matter during your initial testing because the query never got sent anyway.

Now the query is being sent, and tickling the incorrect behavior that was latent in your BIND configuration all along. Try turning the option timeout:N in /etc/resolv.conf way up and see if it stops happening. (Or turn the option way down so it tickles the problem all the time, then fix the root problem, then turn the option back up to a reasonable value.)

  • @estol If you fixed it, how'd you fix it? (And re: the above snark about "bumping threads", this isn't a forum, and it's not just about you... if you found a solution, give back to the community and post it up, else helpful folks like Chuck will keep spending their time trying to offer you solutions).
    – Camden S.
    Sep 20, 2013 at 16:49
  • @Camden S. didn't fix it, abandoned that setup, and got a static ipv4 from my ISP.
    – estol
    Sep 20, 2013 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.