Here's my named.conf

// named.caching-nameserver.conf
// Provided by Red Hat caching-nameserver package to configure the
// ISC BIND named(8) DNS server as a caching only nameserver
// (as a localhost DNS resolver only).
// See /usr/share/doc/bind*/sample/ for example named configuration files.
// DO NOT EDIT THIS FILE - use system-config-bind or an editor
// to create named.conf - edits to this file will be lost on
// caching-nameserver package upgrade.
options {
        listen-on port 53 {; any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";

        forward only;
        forwarders {
        # the following IP addresses are my ISPs DNS Servers. These will be used for looking up
        # hostnames that I don't locally manage, i.e. the REST OF THE INTERNET!
        XXX;     # my ISPs DNS Server #1
        XXX;     # my ISPs DNS Server #2

        // Those options should be used carefully because they disable port
        // randomization
        // query-source    port 53;
        // query-source-v6 port 53;

        allow-query     { localhost; };
        allow-query-cache { localhost; };
        allow-recursion { localhost; };

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
view localhost_resolver {
        match-clients      { localhost; };
        match-destinations { localhost; };
        recursion yes;
        include "/etc/named.rfc1912.zones";

        zone "domain.com" {
                type master;
                file "domain.com.db";
include "/etc/rndc.key";

Here's my zone file:

; Zone file for domain.com
$TTL 14400
domain.com. 86400   IN      SOA     ns1.domain.com.      user.email.com.     (
                                                2013032213 ;Serial Number
                                                86400 ;refresh
                                                7200 ;retry
                                                3600000 ;expire
                                                86400   )

domain.com. 86400   IN      NS      ns1.domain.com.
domain.com. 86400   IN      NS      ns2.domain.com.
ns1.domain.com. 14400 IN    A       xxx
ns2.domain.com. 14400 IN    A       xxx

domain.com. 14400   IN      A       xxx

localhost       14400   IN      A

www     14400   IN      CNAME   domain.com.
ftp     14400   IN      A       xxx

Bind is running. named-checkconf and named-checkzone return ok. The domain nameservers were also created at the domain registrar. The server also has the IPs in eth0:x...eth0:n. Any ideas what could I be doing wrong?

  • Could you please provide the sample output of dig including the address of server you're doing dig against? And also above mentioned configuration is not serving this zone to internet, in case you're expect it to.
    – abbe
    Mar 24, 2013 at 18:24
  • I am actually wanting to serve internet. I put it inside local_resolvers because named_checkconf asked me to do so. Or is something else what I'm doing wrong? I'm trying to reach lucasgomez.com and dig does not return anything, it just hangs. Mar 24, 2013 at 18:33
  • a quick whois indicates your nameservers are in-zone (i.e ns1.lucasgomez.com for the lucasgomez.com domain) - do you have a glue record in place with the domain registrar, so it knows where to find your name server? Mar 24, 2013 at 19:38
  • @MarkRegensberg Yup, created the nameservers in namecheap too. Mar 24, 2013 at 19:57
  • 2
    Why did you install the caching-nameserver package? This is strictly for local resolvers that aren't serving any zones. This is what the text at the top of named.conf is warning you about. Mar 24, 2013 at 21:50

2 Answers 2


I see two problems with your configuration:

  1. Inside the options you have defined allow-query { localhost; };. This instructs your bind DNS server to answer only to localhost and to silently drop all queries from other IP addresses.
  2. Your domain is defined only inside your localhost_resolver view. This instructs bind to read and serve the zone's contents only to IP addresses that match the match-clients and match-destinations options.

Because of these two problems your DNS server(s) are not answering to any requests for the domain:

$ host -t ns -v lucasgomez.com.
Trying "lucasgomez.com"
;; connection timed out; no servers could be reached

I suggest you create an additional view, for serving your public zones. You don't need recursion enabled in there, nor the blackhole zone and it should match and answer queries from any IP address.

view "external-in" in {
    match-clients { any; };
    notify yes;
    recursion no;
    additional-from-auth no;
    additional-from-cache no;
    auth-nxdomain no;    # conform to RFC1035
    allow-query { any; };

    zone "example.com" in {
        type master;
        file "example.com.db";
        allow-transfer { xferservers; };

Note that you will need to add an ACL called xferservers with the IP addresses that should be able to initiate AXFR and IXFR zone transfers and adapt the zone snippet for your slave DNS server.

PS. Always check your config before applying it.

  • Even though this wasn't exactly the issue causing my problem in particular this config helped me greatly to keep things running smoother! Thanks! Mar 25, 2013 at 0:36

zorlem has the best answer based upon the information you have provided, but I also wanted to add that there are several excellent diagnostic web sites that reduce the burden of te many different "dig" commands you have to do to fully diagnose DNS issues.

One that I use a lot is http://dns.squish.net/ which has the following to say regarding your domain:


50.0% recvfrom failed from; Connection refused - recvfrom(2) at ns1.lucasgomez.com (    
50.0% recvfrom failed from; Connection refused - recvfrom(2) at ns2.lucasgomez.com (

So at the very least, your named is not listening for connections on those IPs.

  • This probably would have worked better as a comment to zorlem's answer. While you wouldn't have had the space for the example, this really isn't adding anything other than a tool recommendation.
    – Andrew B
    Mar 24, 2013 at 22:59
  • Oh sorry. I went to do that but the tooltip saying "ask author for clarification about this post" put me off, as I wasn't. Still rather new at this.
    – grifferz
    Mar 25, 2013 at 21:36
  • No problem. :) The general rule is "don't reply with an answer unless it provides a different solution". If an existing answer can be built upon, either leave a comment or provide an edit. (unless the answer was lazy and you are doing the work for them)
    – Andrew B
    Mar 25, 2013 at 21:46
  • Even if the format is wrong... dns.squish.net is super handy and a valid suggestion for later troubleshooting.
    – cpt_fink
    Apr 8, 2013 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.