I am experiencing an issue with bind. If i want to resolve any domain name that is on the zone file. It works fine. However, when I try to resolve anything that does not belong to the zone file. I know that actual DNS servers that are being forwarded are working fine. But somehow bind9 fails to use them. The content of /etc/bind/named.conf.options is:

options {
directory "/var/cache/bind";
forwarders {;;
dnssec-validation auto;
auth-nxdomain no;    # conform to RFC1035
listen-on-v6 { any; };

I have also tried to use only one ip address and it still did not work. also the content of /etc/bind/named.conf is:

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

So there is no problem with including options file. Any recommendations for fixing this problem?

2 Answers 2


I had this issue before with recent version of Bind (9.8.1).

The following option solved the problem for me :

dnssec-validation no;

  • 1
    That solved my problem, but do you know the reason why it does not work when it is auto?
    – Sarp Kaya
    Commented Sep 20, 2012 at 4:01
  • 1
    Maybe it's because I'm using a fake root zone like intra. or local. Are you in the same situation ?
    – profy
    Commented Sep 20, 2012 at 9:07
  • @profy I also had to do this with my xxxxxx.local forward zone so this may be the issue!
    – Allison
    Commented Aug 4, 2017 at 15:46
  • 1
    This worked also for me...I am very curios on the why!
    – Zioalex
    Commented Jun 6, 2020 at 15:25
  • 1
    It is because local created zone are not (and cannot be) signed with dnssec.
    – profy
    Commented Nov 9, 2020 at 10:48

You need to differentiate between your bind misconfiguration and not-working forwarders.

You can verify whether the forwarders are working or not using a command like:

$ dig @ www.google.com

If you received a valid response, it is a working DNS server and so on.

You may need to add an explicit allow-recursion in your bind configuration. It is recommended to restrict this to specific IPs/subnets.

  • DNS servers are working. My question is bind9 does not forward any requests to these forwarders.
    – Sarp Kaya
    Commented Sep 19, 2012 at 7:48
  • Better way is to use dig @nameserver -trace sitename, this will show where the answer is being gotten.
    – MealstroM
    Commented Jan 15, 2013 at 19:09
  • 1
    allow-recursion was the key for me. Thanks. Commented Aug 5, 2014 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .