I have set up a bind9 name server and created a dedicated (internal) subdomain, which can be updated by everybody for whatever purpose. The setup is very in simple and does work in general, but there is a delay of up to several minutes, before updates have effects i.e. the RRs can be retrieved from the server.

Why is that and how do I speed it up?

My setup

There is only one server, running a dnsmasq with the following config:


and a bind9 name server with the following config (I'm only putting what I consider relevant and get asked for):

options {
    directory "/var/cache/bind";

    dnssec-validation no;
    dnssec-enable no;
    auth-nxdomain no;    # conform to RFC1035

    listen-on port 5353 {; }

key "notsecretkey" {
        algorithm hmac-md5;
        secret "up_up_and_away/foobar==";

zone "my.fq.doma.in." {
        type master;
        file "/var/lib/bind/db.ZONE.mydomain";
        allow-update { key notsecretkey; };


I made a modification, where I added a NS RR and an A RR.

root@dnshome:/tmp# rndc freeze my.fq.doma.in
root@dnshome:/tmp# rndc thaw my.fq.doma.in
A zone reload and thaw was started.
Check the logs to see the result.
root@dnshome:/tmp# cat /var/lib/bind/db.ZONE.mydomain
$TTL 604800     ; 1 week
my.fq.doma.in          IN SOA  mydomainns.ourdoma.in. dnsmaster  .ourdoma.in. (
                            2015033109 ; serial
                            604800     ; refresh (1 week)
                            86400      ; retry (1 day)
                                2419200    ; expire (4 weeks)
                                604800     ; minimum (1 week)
                        NS      ns.my.fq.doma.in.
$ORIGIN my.fq.doma.in.
mail                    A
$TTL 600        ; 10 minutes
test                    A
abc                     NS      ns.abc      # <----- my changes
$ORIGIN abc.my.fq.doma.in.                  # <----- written to
ns                      A  # <----- the zonefile

As we can see, after freeze and thaw, the last three lines are my changes, written to the zonefile.


root@dnshome:/tmp# nslookup -port=5353 ns.abc.my.fq.doma.in

** server can't find ns.abc.my.fq.doma.in: NXDOMAIN

I read through the zonefile on my screen, searching for errors and also check for typos in my probe. I found nothing, so I tried again

root@dnshome:/tmp# nslookup -port=5353 ns.abc.my.fq.doma.in.

** server can't find ns.abc.my.fq.doma.in: NXDOMAIN

strage enough. I go ahead and try the other RR I added.

root@dnshome:/tmp# nslookup -port=5353 -type=NS abc.my.fq.doma.in.

Non-authoritative answer:
abc.my.fq.doma.in      nameserver = ns.abc.my.fq.doma.in.

Authoritative answers can be found from:
ns.abc.my.fq.doma.in   internet address =

but still

root@dnshome:/tmp# nslookup -port=5353 ns.abc.my.fq.doma.in.

** server can't find ns.abc.my.fq.doma.in: NXDOMAIN

so I tried another, older RR

root@dnshome:/tmp# nslookup -port=5353 ns.my.fq.doma.in.

Name:   ns.my.fq.doma.in

which worked, so I tried again

root@dnshome:/tmp# nslookup -port=5353 ns.abc.my.fq.doma.in.

Non-authoritative answer:
Name:   ns.abc.my.fq.doma.in

and voila, it works.

I am the only one working on this machine and I did nothing else than what I showed in this example. Obviously there is some kind of delay in my setup and I need to know why and how to get rid of it.

  • I don't know the answer but I'm pretty sure this is somehow related to the fact that the problematic record is a glue record. Notice how, at the end, when you finally get an answer, it's a non-authoritative one, because it's part of the abc.my.fq.doma.in. domain which you delegated. – Celada Jun 3 '15 at 14:46
  • So when you did as the message said and checked the logs, what did they say? edit your question and show us. – JdeBP Jun 3 '15 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.