I am experiencing an issue with bind. If i want to resolve any domain name that is on the zone file. It works fine. However, when I try to resolve anything that does not belong to the zone file. I know that actual DNS servers that are being forwarded are working fine. But somehow bind9 fails to use them. The content of /etc/bind/named.conf.options is:

options {
directory "/var/cache/bind";
forwarders {;;
dnssec-validation auto;
auth-nxdomain no;    # conform to RFC1035
listen-on-v6 { any; };

I have also tried to use only one ip address and it still did not work. also the content of /etc/bind/named.conf is:

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

So there is no problem with including options file. Any recommendations for fixing this problem?

2 Answers 2


I had this issue before with recent version of Bind (9.8.1).

The following option solved the problem for me :

dnssec-validation no;

  • 1
    That solved my problem, but do you know the reason why it does not work when it is auto?
    – Sarp Kaya
    Sep 20, 2012 at 4:01
  • 1
    Maybe it's because I'm using a fake root zone like intra. or local. Are you in the same situation ?
    – profy
    Sep 20, 2012 at 9:07
  • @profy I also had to do this with my xxxxxx.local forward zone so this may be the issue!
    – Allison
    Aug 4, 2017 at 15:46
  • 1
    This worked also for me...I am very curios on the why!
    – Alex
    Jun 6, 2020 at 15:25
  • It is because local created zone are not (and cannot be) signed with dnssec.
    – profy
    Nov 9, 2020 at 10:48

You need to differentiate between your bind misconfiguration and not-working forwarders.

You can verify whether the forwarders are working or not using a command like:

$ dig @ www.google.com

If you received a valid response, it is a working DNS server and so on.

You may need to add an explicit allow-recursion in your bind configuration. It is recommended to restrict this to specific IPs/subnets.

  • DNS servers are working. My question is bind9 does not forward any requests to these forwarders.
    – Sarp Kaya
    Sep 19, 2012 at 7:48
  • Better way is to use dig @nameserver -trace sitename, this will show where the answer is being gotten.
    – MealstroM
    Jan 15, 2013 at 19:09
  • 1
    allow-recursion was the key for me. Thanks. Aug 5, 2014 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.