Bind9 fails to resolve specific domain while allowing all others

Question

I have a problem with bind9 running on Ubuntu Server 12.10. It refuses to resolve the external domain housing.org.uk even though it resolves all other external domains. I can do:

dig housing.org.uk @8.8.8.8

and it works fine. If I do:

dig housing.org.uk +trace

it ends with:

housing.org.uk.         172800  IN      NS      b.adns.mdnx.net.
housing.org.uk.         172800  IN      NS      a.adns.mdnx.net.
dig: couldn't get address for 'b.adns.mdnx.net': failure

There are no forwarders and DNS works fine for everything else. Disabling the firewall briefly made no difference. Any ideas?

Answer 1

If bind9 doesn't have recursion turned on you won't be able to resolve outside domain names.

This type of configuration is recommended:

acl "trusted" {
     192.168.0.0/16;
     10.153.154.0/24;
     localhost;
     localnets;
 };

 options {
     ...
     allow-query { any; };
     allow-recursion { trusted; };
     allow-query-cache { trusted; };
     ...
 };

Adjust the ACL to fit your needs. You should not have a public recursive server as this is a Very Bad Thing™.

Reference: https://kb.isc.org/article/AA-00269/0/What-has-changed-in-the-behavior-of-allow-recursion-and-allow-query-cache.html