BIND does not use the forwarders to resolve any more. It just goes to the root servers. I do not know when this started happening since everything worked transparently, but for sure bind configuration was not altered. It was upgraded though using apt.

I am on Debian 7 and current bind version is BIND 9.8.4.


options {
    directory "/var/cache/bind";
    forwarders {;;
    forward only;
    dnssec-validation no;
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };

Any ideas to re enable forwarding?

  • Can you try adding allow-recursion { any; }; ? – krisFR Apr 7 '14 at 21:24

but for sure bind configuration was not altered. It was upgraded though using apt.

Upgrading the core engine is enough to make things not working, even if the configuration has not been altered !

As mentioned here :

In versions of BIND prior to (and including) BIND 9.4.1, the default behavior of BIND servers was to allow recursion for all clients (unless otherwise specified.)

So you should explicitely allow recursion because it is needed to make Forwarders work :

allow-recursion { any; };

To retain the same behaviour you have previously i would suggest to add these directives into your options { ... } block :

allow-recursion { any; };
allow-query { any; };
allow-query-cache { any; };
| improve this answer | |
  • Added all the options suggested, still no luck. From what I see, bind always uses the root servers to resolve. Added "recursion yes" well, still no luck. – yannisf Apr 10 '14 at 21:10
  • @yannisf Did you check logs to get some clues ? – krisFR Apr 10 '14 at 23:45
  • Checked the logs, no hint there. I am confident that for some reason the forwarder I used so far (Norton ConnectSafe: does not work with the above options. When I switched to OpenDNS it worked. The strange thing is that Norton ConnectSafe works when in resolv.conf (you may check it if you want). – yannisf Apr 12 '14 at 11:58

Forwarders only work if you have recursion enabled.

Also, you should use your ISPs DNS servers, not Google's.

| improve this answer | |
  • 1
    Any technical reason not to use Google's DNS servers? – ojrask Nov 18 '16 at 13:26
  • If there's an issue with Google's DNS, you have no legs to stand on, so to speak. If it's your ISP, at least you can call somebody and notify them of the issue, and have a chance of getting it resolved. – Vasili Syrakis Nov 22 '16 at 6:07
  • Valid point. :) – ojrask Nov 22 '16 at 7:14
  • 4
    @VasiliSyrakis: I believe that if Google DNS fail, they will be fixed quicker than I would realize that something is wrong. They are "monitored" by half of Internet using them and probably maintained much better than my ISP's ones. YMMV. – WoJ Feb 19 '17 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.