Here is an example from performing an nslookup from a Unix server (IPs and domains all fake):

$ nslookup
> set type=srv
> _kerberos._tcp.example.com

Non-authoritative answer:
_kerberos._tcp.example.com service = 0 100 88 dc01.example.com.
_kerberos._tcp.example.com service = 0 100 88 dc02.example.com.

Authoritative answers can be found from:
.       nameserver = h.root-servers.net.
.       nameserver = e.root-servers.net.
.       nameserver = a.root-servers.net.
.       nameserver = l.root-servers.net.
.       nameserver = d.root-servers.net.
.       nameserver = f.root-servers.net.
.       nameserver = k.root-servers.net.
.       nameserver = i.root-servers.net.
.       nameserver = b.root-servers.net.
.       nameserver = m.root-servers.net.
.       nameserver = c.root-servers.net.
.       nameserver = j.root-servers.net.
.       nameserver = g.root-servers.net.
dc00.example.com      internet address =
dc01.example.com      internet address =

Is there a way I can prevent BIND from sending that extra section and just return the Non-authoritative answers?

EDIT 1: I took out the part where I said I don't think Windows nslookup knows what to do with the results. It does know, but it just doesn't label it as such.

EDIT 2: When using a Windows DNS server, it doesn't include the root servers as part of the answer.

EDIT 3: We've only noticed this with SRV records.

  • May I ask why are you asking? What is the real problem you are asking this for? This seems like an unusual thing to be worried about.
    – Zoredache
    Oct 5 '18 at 23:09
  • @Zoredache Windows admin having issues getting some application to work when using a BIND nameserver versus using a Windows DNS server.
    – roartechs
    Oct 5 '18 at 23:13
  • 2
    Try turning on minimal-responses in BIND if this is what you really want. This might increase the number of queries your server gets if the client eventually needs some of that additional info what would have been included in the original query. Oct 5 '18 at 23:25
  • 1
    It's a misconfiguration issue with your bind9, it's returning all of that due to your zone file having an error, run checkzone on your file
    – hello moto
    Oct 6 '18 at 6:13

Comment from Brandon Xavier worked. Placing the following in the global options block of named.conf prevented BIND from sending the additional data:

minimal-responses yes;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.