Is there a way to make bind answer some queries but forward all other queries (of the same domain) to another server, as in:

example.com A
www.example.com A

everything not on this list (example.com MX, ftp.example.com A etc) - ask (another DNS server)

Essentially I want to intercept some (but not all) queries going to (in this example) and answer for it.

example.com A- intercept
www.example.com - intercept
example.com MX - pass trough
ftp.example.com - pass trough

This is rather tricky to do with BIND. While it isn't quite what you asked have you considered using another DNS server like DNSMasq where this sort of thing is relatively simple?

  • Actually, DNSMasq looks like exactly what I want. Thank you – Pentium100 Oct 22 '13 at 6:07

Your BIND server will by default use the DNS servers in /etc/resolv.conf to resolve records that it isn't authoritative for, but only for localhost (i.e. itself) and localnets (see below). You should make sure that these are set accordingly.

Definition of localnets:

matches all the IP address(es) and subnetmasks of the server on which BIND is running. For example, if the server has a single interface with an IP address of and a netmask of (or then localnets will match to and (the loopback is always present and has a single address, that is a netmask of Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IP addresses, just like localhost though in this case it will apply to external and internal (same host) requests.

You can also explicitly define global forwarders like this, remembering to secure your environment:

options {
  recursion yes;
  allow-recursion-on {

  forwarders {;;

If you want to direct queries for a specific domain to specific servers, you can do this by configuring forwarders for individual domains:

zone "myothernet.local" {
  type forward;
    forwarders {;;

Further reading:

  • But can I split a domain, that is - lookup example.com locally, but ftp example.com from the other server (I'll edit the question to better explain it). – Pentium100 Oct 21 '13 at 13:08

I think you need subdomain delegation.. However, it is usually set up to point a specific subdomain in a zone to another server.

In your case, it might be easier to give the zone to your secondary server, set up a wildcard record in there, and set up subdomain delegation for that specific subdomain pointing to your primary server..

  • This was my first though as well, but the problem is that "example.com" should be answered by the primary server. Essentially I want to intercept some queries. – Pentium100 Oct 21 '13 at 13:26
  • Yeah, unfortunately wildcards are not valid in zones (although I could be mistaken) so it's hard to delegate "everything else" in that sense. – NickW Oct 21 '13 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.