Of course it will fails since you disallowed read/write/execution permissions on /etc/bind/named.conf
. Try using chmod ugo+r /etc/bind/named.conf && chown root /etc/bind/named.conf
and try again.
Explaining why
Let's see how named reads the file.
sudo strace -f /usr/sbin/named -fg -d 10 2> named
This will show all the calls over files that named/bind does. Now processing:
grep conf named
read(5, "#\n# OpenSSL example configuratio"..., 4096) = 4096
write(2, "08-Feb-2014 14:01:42.372 built w"..., 39108-Feb-2014 14:01:42.372 built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2'
[pid 25348] write(2, "08-Feb-2014 14:01:42.395 loading"..., 7508-Feb-2014 14:01:42.395 loading configuration from '/etc/bind/named.conf'
[pid 25348] open("/etc/bind/named.conf", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)
[pid 25348] write(2, "08-Feb-2014 14:01:42.396 open: /"..., 7108-Feb-2014 14:01:42.396 open: /etc/bind/named.conf: permission denied
[pid 25348] write(2, "08-Feb-2014 14:01:42.399 load_co"..., 6308-Feb-2014 14:01:42.399 load_configuration: permission denied
[pid 25348] write(2, "08-Feb-2014 14:01:42.400 loading"..., 6608-Feb-2014 14:01:42.400 loading configuration: permission denied
Named tries to do a open call as readonly and fails with -1 EACCES
since the file doesn't have read permissions. This is documented in the open() manual pages:
EACCES
Search permission is denied on a component of the path prefix, or the file exists and the permissions specified by oflag are denied, or the file does not exist and write permission is denied for the parent directory of the file to be created, or O_TRUNC is specified and write permission is denied.
Summary: that apache or any other process works doesn't mean that bind/named will.
BTW, running bind as root is overkill and is not necessary.