I have a working DNS server for local domain mydomain.local. I am trying to configure bind9 to work in default configuration, except for this zone, for which I want to forward queries to local DNS server. Here's config I have (ubuntu 14.04):


zone "mydomain.local" IN {
    type forward;
    forward only;
    forwarders {;

But when I try to nslookup server.mydomain.local I'm getting following in syslog:

error (broken trust chain) resolving 'server.mydomain.local/A/IN':

It is my understanding that this is because of DNSSEC. I don't want to disable DNSSEC globally, but I do want to disable DNSSEC for this very zone. Is it possible?

Please do not suggest using type slave; zone. I want to achieve this with forward zone


I found an answer. Following line in /etc/bind/named.conf.options fixes it:

--->        dnssec-must-be-secure mydomain.local no;   <---

So, full text of /etc/bind/named.conf.options will be (skipping comments):

options {
        directory "/var/cache/bind";

        forwarders {

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-must-be-secure mydomain.local no;

        auth-nxdomain no;
        listen-on-v6 { any; };

UPDATE: Actually, at this point I cannot tell if I indeed fixed bind with that line or didn't. Somehow all queries succeed now, with or without this line. If an expert is present here, please chip in

  • 5
    This answer only works if you have dnssec-validation set to yes, if its set to the default auto then it won't work – Ferrybig Sep 16 '15 at 8:25
  • For me it works also with dnssec-validation auto; – Alex Mar 7 at 23:40

But if you create a zone "local", the parent zone for "mydomain.local" and designate as ns the ip of the server you forward.this will make dnssec function with value auto.

More details https://netfuture.ch/2014/10/adding-your-fritzbox-as-a-secure-dns-resolver-for-the-fritz-box-pseudo-domain/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.