Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Ubuntu 12.04 with BIND9, working just as a caching server (forwarding to

When I use, for example, dig +norecurse @l.root-servers.net www.uniroma1.it, I obtain the following output

; <<>> DiG 9.8.1-P1 <<>> +norecurse @l.root-servers.net www.uniroma1.it

; (1 server found)

;; global options: +cmd

;; connection timed out; no servers could be reached

Using Wireshark I discovered that the outgoing queries are correct, but there aren't any incoming answers. Why?

P.S. Using simply dig www.uniroma1.it I obtain the correct answers.

share|improve this question
I asume that when you use just dig without @<nameserver> it uses your own dns server that you setup and specified in /etc/resolv.conf? Did you firewall yourself? – delh Nov 15 '12 at 12:44
In /etc/resolv.conf is present only the server, and I think it's right. I've no firewall, but probably my ISP does. – JustTrying Nov 16 '12 at 19:47
up vote 1 down vote accepted

Your command works fine here. My guess is that a firewall, either at your location or at your ISP, is blocking the DNS requests or responses. The normal dig www.uniroma1.it likely works because said firewall is allowing requests to certain servers, like the ones provided by your ISP and maybe

share|improve this answer

The Root servers will not answer queries for domains that they are not authoritative for. If you run the command without the +norecurse argument, it should return a list of referrals for the .it domain. You will never get an A record response from the Root servers.

share|improve this answer
But you should get NS records in an AUTHORITY section, not "connection timed out". – Jim Paris Nov 15 '12 at 15:43
@Jim Paris But my answer wasnt wrong. Why did you down vote it? You only answered part of the question yourself. You didnt address the fact that he was querying the root servers directly, which was the first part of his problem – midnightsteel Nov 26 '12 at 13:01
I downvoted because it is wrong. The root servers will answer queries, with a NS record pointing to the next server in the hierarchy that may be able to answer. They will not simply drop queries and send no response, which is what the asker was seeing. – Jim Paris Nov 26 '12 at 18:31
I never said that it will drop queries. No where in my answer said it will drop queries. If you can point out in my answer where I said that it will drop queries, you can have those points. If you read further you will see that I mentioned that root will give referrals for the .it domain. I didn't specifically address his time out issue. I addressed the fact that he was asking root for an A record. – midnightsteel Nov 28 '12 at 13:34
You said: "Root servers will not answer queries". The root server will answer. It will say, "I don't know, here are the nameservers to ask next." Anyway, regardless of how nitpicky you want to get, your answer was not useful, which is exactly what a downvote is for. The asker was having problems with a firewall blocking replies, and you discussed unrelated details about how root nameservers don't include A responses in their answers. – Jim Paris Nov 28 '12 at 19:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.