Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I'm using Fedora for desktop use and I:

yum -y install caching-nameserver
service named restart
chkconfig --level 5 named on

on it, and set the nameserver to If I:

dig | grep SERVER

Then I can see it's ok … I'm using my previously installed local DNS cache server! Hurrah! (no more crappy DNS from my ISP..)

Then I tried tcpdump:

tcpdump -n -i eth0 dst port 53

All I can see that my Local DNS server doesn't use my ISP's DNS server for resolving, rather it uses the root servers (IP address) DNS server to resolve my domain names (the ones I type in my webbrowser).

Question #1: Does my local DNS caching server really only uses just the root servers DNS server for resolving?

Question#2: If using DNSSEC gives me more security regarding DNS, then how could I set my pc/local dns cache to only use and only allow DNSSEC? I think DNSSEC is deployed years (?) ago on the root DNS servers.

Update: I had misunderstood something, and to use only DNSSEC I would need that: all the NS's of the domains that I'm visiting must be configured to use DNSSEC - and that's not very widely used, so I can't use only DNSSEC.

share|improve this question

2 Answers 2

up vote 8 down vote accepted
  1. The local resolver you've set up will not use your ISP's resolver at all by default. It'll starting asking the root directly for answers for everything it needs. The root will hand back answers that say things like "I don't know where is; you should go talk to com and here are a set of addresses for how to talk to com" (and off you'd go trying to talk to com, which would refer you to". In the end, you'll follow the chain until you got your answer. If you ever needed to find, your local resolver would have a "cache" that will allow it to go straight to the servers, or if you wanted it would go straight to the com servers and wouldn't ask the root.

  2. For DNSSEC, much of the world has deployed it from the top down but the lower domains haven't. The root has been signed, com has been signed, net has been signed, etc. But,, etc hasn't. Fortunately DNSSEC has been designed to allow for this and software that tries to securely follow DNS records will eventually get to a nameserver (com for examplethat says "I don't know wherewww.facebook.comis and you should go talk` and oh, by the way, they're not secured yet". IE, DNSSEC offers you something called provably insecure. This lets you know with certainty that a parent of a zone says the child isn't signed (which is a simplification; they could have signed but not "chained" yet).

It's worth noting that DNSSEC is not enabled by default and you need to turn it on within the bind configuration files. I think the default fedora named.conf now has DNSSEC enabled, but you should check. In your named.conf file you'll find hopefully a section that has a trusted-key for the root:

trusted-keys {
  . 257 3 8 "AwEAAagAIKlVZr...";

And an options section that turns on DNSSEC validation:

options {
    dnssec-enable yes;
    dnssec-validation yes;

With this on, if you do a dig +dnssec, for example, you should see the AD flag returned in the output. The AD flag means that the record has been verified through DNSSEC. If you search for you won't see this flag.

# dig +dnssec
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
share|improve this answer

You should configure forwarders in you local server to point to your ISP servers. You could also set forward-only.

Not sure about #2.

share|improve this answer
I don't want to use my ISP's DNS servers. :\ –  LanceBaynes May 21 '11 at 20:34
But I think the rest of the Internet wants you to. ;-) As long as you're caching locally it shouldn't be a problem. You might also use Googles public DNS servers. –  Keith May 21 '11 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.