I'm trying to setup own dns server inside company, but i can't get it to work. I installed Bind9 on Ubuntu 12.04. I always get status: SERVFAIL, when i try using it. This is sample of one of my tests:

; <<>> DiG 9.8.1-P1 <<>> ns.vpl.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 25725
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;ns.vpl.net.                    IN      A

;; Query time: 1 msec
;; WHEN: Mon Nov 25 12:39:13 2013
;; MSG SIZE  rcvd: 28

This are my files:

// Do any local configuration here

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

// Load internal VPL d.o.o. forward and  backward zones.
zone "vpl.net" {
        type master;
        file "/etc/bind/vpl-zone/db.vpl";

zone "192.168.3.in-addr-arpa" {
        type master;
        notify no;
        file "etc/bind/vpl-zone/db.192";


; BIND data file for local loopback interface
$TTL    604800
@       IN      SOA     vpl.net.        jure.vpl.net. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      ns.vpl.net.
@       IN      A
@       IN      AAAA    ::1

; A NAME Records
ldap    IN      A


; BIND reverse data file for local loopback interface
$TTL    604800
@       IN      SOA     vpl.net.        jure.vpl.net. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
@       IN      NS      ns.vpl.net.
11      IN      PTR     ldap.vpl.net.


# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
domain          vpl.net
search          vpl.net


eth0      Link encap:Ethernet  HWaddr 00:0c:29:2c:94:cb
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::20c:29ff:fe2c:94cb/64 Scope:Link
          RX packets:26142 errors:0 dropped:684 overruns:0 frame:0
          TX packets:6495 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2341216 (2.3 MB)  TX bytes:1168912 (1.1 MB)

lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:152 errors:0 dropped:0 overruns:0 frame:0
          TX packets:152 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16049 (16.0 KB)  TX bytes:16049 (16.0 KB)


options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

         forwarders {

        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

I really don't know what I'm doing wrong so any advice would be helpful.
Thank you.


2 Answers 2


In this case, you are getting a SERVFAIL because the zone is not valid. It is missing glue records (RFC1912 Common DNS Operational and Configuration Errors, Sec 2.3).

You have the NS (nameserver) resource record specified:

@       IN      NS      ns.vpl.net.

But you do not have an A (IPv4) resource record associated with the domain ns.vpl.net. If is the address of your nameserver, then you will want to add something like this:

ns      IN      A

It is very likely that BIND is warning you about this. If making this adjustment does not fix your issue, then please post the contents of your BIND error from the time following a service restart. There may be other issues as well.

Also, I have a hunch that you don't actually want to specify ::1 as your AAAA (IPv6) resource record for vpl.net. Doing this will cause any server performing a lookup to believe that it (localhost) is the IPv6 address of vpl.net.

If you don't have IPv6 deployed in your network, then don't specify a AAAA record. Almost all IPv6 networks are dual-stack, and will work just fine without AAAA resource records specified.

See also:


In your option section do you allow query and recursion?

allow-query { localhost;; }

allow-recursion { localhost;; }

recursion yes;

  • Where can i find my option section?
    – maestro
    Nov 25, 2013 at 13:50
  • Usually it is in your named.conf
    – Piotr
    Nov 25, 2013 at 13:52
  • Hi, thanks for your advice. I added options file, is this where i should put it?
    – maestro
    Nov 25, 2013 at 13:56
  • I don't have a ubuntu anywhere now to test ... but you are looking for options { } configuration block (usually in named.conf)
    – Piotr
    Nov 25, 2013 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.