How can I tell BIND to stop forwarding queries to my provider's DNS servers for a specific list of domains, but to forward for everything else?

I'm using BIND as an authorative nameserver for my domain. It also provides DNS resolution for other queries on the host, by forwarding them to my provider's DNS servers:

forward first;
forwarders {;;

However I am running SpamAssassin and my queries to various DNS blocklists are being rejected, since they are going through my provider's nameservers (along with many of my fellow customers) and reaching the limit for free queries originating from their IP addresses. Since I only have a small number of queries myself (maybe 5-10 a day) I would like to configure BIND so that it does NOT forward DNSBL queries to my provider's servers, but it DOES forward everything else.

This should allow me to continue to use DNS blocklists to spam check the small amount of e-mail I get, without having to turn off the forwarding/caching entirely.

How can I tell BIND not to forward just a handful of domains, but keep it forwarding everything else?

  • 1
    Is there any particular reason why you don't want to perform your own recursion? forwarders are meant to be exceptions to your recursion policy.
    – Andrew B
    Jun 7 '13 at 22:27
  • Only because there are so many people using my provider's servers it is significantly faster than performing recursion myself.
    – Malvineous
    Jun 7 '13 at 22:43

Try configuring zones for your blacklists, and configure them not to forward. Something like this should work. You will need one of these for each blacklist zone.

zone "blacklist.example.com" {
    type static-stub;
    recursion yes;

You will also need to setup the root zone so recursion will work. You likely already have done this.

  • Thanks for the suggestion - unfortunately it looks like this only works with BIND 9.8.0 and newer, but my server is running Debian which is still on 9.7.3, so I get an error about static-stub being an unknown type.
    – Malvineous
    Jun 8 '13 at 0:16

Thanks to @BillThor I was able to come up with this entry which works with older (9.7.3) versions of BIND:

zone "blacklist.example.com" {
    type forward;
    forwarders {};

On my Debian machine I added it to /etc/bind/named.conf.local

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.