I am trying to configure a DNS for an Ubuntu server. Initially I had problems pinging the server or doing any kind of dig. The relevant info up to that point is visible below under "Old Issues". Through much assistance I have gotten the DNS to respond to a ping request via its IP, and most importantly it is now acknowledging the dig -x command.

These prior issues came about due to an error in my name server syntax in the Forward Zone File (eg. db.example.com.).

Currently the issue remains that the server can not be called by the example.com. I can only assume that this is a problem with my reference to the recursive DNS server, however I am unsure of how to fix this. All help is appreciated.

Old Issues
As per requested, below are the results for various ping requests, digs, and what is entered into bind named.config prior to any suggestions.

"ping example.com" times out and outputs:

ping: unknown host example.com

"ping" (net ip) outputs:

10 packets transmitted, 10 received, 0% packet loss, time 8999ms
rtt min/avg/max/mdev = 0.688/0.960/3.221/0.754 ms

"ping" (local ip) outputs:

PING ( 56(84) bytes of data.
--- ping statistics ---
21 packets transmitted, 0 received, 100% packet loss, time 19999ms

"ping" outputs:

5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 32.742/33.081/33.544/0.411 ms

bind named.conf file:

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

resolv.conf file:
version 1


version 2

search example.com

nslookup google.com


Non-authoritative answer:
Name:   google.com
Name:   google.com
Name:   google.com

New Issues

dig -x this line seems to be of concern, shouldn't these 0's be 1's?

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

cat /etc/bind/named.conf.options

tail -n 100 /var/log/syslog

cat /var/log/syslog | grep bind


zone "example.com"{
        type master;
        file "/etc/bind/db.example.com";

zone "1.168.192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.233";
  • OK, the new information is useful, but it's still unclear which machines are reporting which problem? You're asking to be recursive, but is this also the recursive server you're using (per my original response). Frankly, I'm still none the wiser about your overall network architecture. – Alnitak Nov 20 '09 at 8:40
  • i definitely do not want the server to be recursive. is this because of the in the resolv.conf file? – storm Nov 20 '09 at 20:07
  • well, if your own server (localhost?) is only authoritative then your resolv.conf should point to your ISPs recursive server, and not – Alnitak Nov 20 '09 at 20:43
  1. Check you network is UP and running
  2. Check you routing and if default rote is installed ( netstat -rn )
  3. Check internet connection by pinging ( ping )
  4. Check your dns configs ( cat /etc/resolv.conf )
  5. Check that name resolution works with other DNS server (nslookup google.com
  6. You can use nameserver in your /etc/resolv.conf , if you want just name resolution working aka pinging any site by name.
  7. Share your bind named.conf, by the way, it must work out of the box as caching server.
|improve this answer|||||
  • After trying netstat -rn I found that I lacked a destination and many of the gateways are rather than *. Is this a problem? – storm Nov 19 '09 at 19:32
  • Have you pinged – TiFFolk Nov 19 '09 at 19:41
  • ping was sucessful. I'll put the output in an edit above. – storm Nov 19 '09 at 19:44
  • so now show your /etc/resolv.conf and add there nameserver – TiFFolk Nov 19 '09 at 20:50
  • resolv.conf has been added above as well as nameserver. – storm Nov 19 '09 at 21:35

You need to clarify for us what particular DNS function this server is supposed to be doing - in particular, is it:

  1. recursive - offering global DNS lookups for your LAN
  2. authoritative - serving data for a zone that you run
  3. both - possible, but strongly recommended against for security reasons

EDIT now confirmed as authoritative.

Given the reported problems with ping it's likely that you've got an underlying network problem to solve first before we start worrying about the DNS server config, though. Your original question is unclear though - you appear to be reporting three separate problems:

  1. ping example.com times out
  2. ping says "no host"
  3. the DNS Server returns SERVFAIL

(1) and (2) don't make sense as reported - if anything I'd expect the errors to be the other way around. Please supply (redacted) examples of the output of those two commands.

Once that's resolved, we can start to address (3) - the SERVFAIL error normally indicates misconfiguration rather than access control problems. However I see that it's taking 4 seconds to produce that response - SERVFAIL can also indicate failure to reach an upstream DNS server which would be consistent with you having network problems.

|improve this answer|||||
  • It will be an authoritative dns. The network issue seems possible. I am currently running tests on the server at a dynamic IP before sending it to a colo facility. The dns was hosted until about 3 days ago, but the new IP should have updated by now. – storm Nov 19 '09 at 7:00
  • When you say "the server", do you mean the DNS server, an application server, or some box that's doing both? – Alnitak Nov 19 '09 at 7:43
  • It's both a DNS and an application server. I understand that it is best to separate these, but that will have to wait for greater resources. Also, I forgot to mention that "named-checkzone" came out "ok". So I assume that the forward and reverse zone files are not the culprit. – storm Nov 19 '09 at 7:55
  • please supply the ping output logs per my edit above – Alnitak Nov 19 '09 at 7:57
  • "ping example.com" outputs - "ping: unknown host example.com". "ping @" (local ip) outputs - "ping: unknown host @". "ping @" (net ip) outputs - "ping: unknown host @" My method of obtaining a forwarding IP for my ISP's DNS may have been in error. I understood that I could use any DNS that is owned by my provider. Is there a more concise method? thank you for the extensive assistance. – storm Nov 19 '09 at 8:25

try putting a "recursion yes;" in your named.conf - this will allow your server to give you dns records out of it's control.

This should be in your "options" section. I would also create an ACL limiting access to this feature.

acl homenet {;; };

options {
  recursion yes;
  allow-recursion { homenet; };
|improve this answer|||||
  • updated the answer to include where to include the recursion option. Also removed the allow-clients as it is a "view" option that I use - instead use the allow-recursion option as I've put in the answer. – Eddy Nov 19 '09 at 15:04
  • placing "recursion yes;" in named.conf results in a failed restart of bind9. however I have placed the above code into named.conf.options and successfully restarted bind9. – storm Nov 19 '09 at 20:53
  • I see your able to resolve domains outside of your control now so the recursion is working but it seems that you are configuring a local domain example.com that is not working. I would guess a configuration issue in the zone file - if you "tail -f /var/log/messages" and restart the nameserver do you get any error messages? – Eddy Nov 19 '09 at 23:10
  • "tail -f /var/log/messages" gave the same output before and after the restart. after the restart I was still unable to ping example.com by its name and dig still results in "no servers could be reached". Were you thinking of a different error test? – storm Nov 20 '09 at 0:01

"a DNS"? DNS is a protocol. This is like saying "I'd like an HTTP."

Could you describe whether you want a DNS authoritative server, secondary server, client, caching server, private root, DNSsec, etc?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.