I've read a lot of other ServerFault BIND9 DNS not forwarding questions and answers. Queries (using DiG) for FQDNs I expect to be forwarded respond as if the public internet has the authoritative answer. Beyond DiG, what tools can I use to trace through my BIND9 configuration? It appears the zone I'm trying to forward is not forwarding.

Specifically, I am at home with a VPN to my work. I want to access my home zone (myhome.com., with DNS server at and also my work zone (mywork.com., with DNS server at

Using DiG to query hostname.mywork.com, DiG reports the AUTHORITY to be the public nameserver. The local resolver seems to ignore the BIND forwarding zone (db.mywork.com).

In /etc/bind/zones/db.mywork.com
// forwards mywork queries to the mywork DNS servers
zone "mywork.com" {
        type forward;
        forwarders {; };

bind.conf: include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones"; include "/etc/bind/rndc.key"; include "/etc/bind/named.conf.logging";

controls {
  inet port 953
  allow {; } keys { "rndc-key"; };


acl goodclients {;

options {
        directory "/var/cache/bind";
        forwarders {
      ;        # Google DNS #1
      ;        # Google DNS #2
        recursion yes;
        allow-query { goodclients; };

        dnssec-enable no;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        listen-on port 53 { localhost; };

and named.conf.local

# Forward zone
zone "myhome.com." {
        type master;
        file "/etc/bind/zones/db.myhome.com";

# Reverse zone
zone "73.71.10.in-addr.arpa" IN {
        type master;
        notify no;
        file "/etc/bind/zones/db.10";
  • 1
    What you have quoted is configuration (which goes in named.conf or a file it references with include) but the filename you mention sounds like something I would expect to be a zone file (holding data). I think it would be good if you clarified exactly if/how the db.mywork.com file is used, if that is indeed where the configuration for the type forward zone is located. – Håkan Lindqvist May 9 '15 at 23:44
  • Have you considered using unbound instead ? it's much lighter and more suitable for cases when only the resolver is needed. – b0fh May 10 '15 at 1:20
  • I should really learn BIND9. When it was suggested I use nginex instead of httpd, httpd kept popping up in my life. Unbound may be a more appropriate solution for this problem. Thanks for suggesting it. I will use it as my plan 'B'. – ndemarco May 12 '15 at 20:36
  • I chose to stay with BIND as the DNS server because it is the common solution. My work requires me to be familiar with common solutions. – ndemarco Dec 29 '15 at 14:31
  • It would be nice if you could show us how you use the dig program and what its exact output is. – Tommiie Oct 3 '18 at 8:24

In this case, I used tail to monitor the log file at /var/log/syslog by using $ tail -f /var/log/syslog. My configuration had multiple issues:

  • I had put my forwarding directive within a zone definition. I moved it to /etc/bind/named.conf.options.
  • As a separate problem, some public DNS queries were not resolving. By monitoring the syslog file, I found the server's time was not synchronized. I configured ntp on the server to resolve this issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.