BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu.

options {
        listen-on port 53       { any; };
        directory               "/var/bind";
        allow-query             { any; };
        allow-query-cache       { any; };
        allow-transfer          { none; };
        recursion               no;
        dnssec-validation       auto;
        auth-nxdomain           no;

include "/etc/bind/zones.conf";
include "/etc/bind/reverse-zones.conf";
include "/etc/bind/named.conf.default-zones";

Example of zones.conf

zone "test.test" IN {
    type slave;
    file "zones/test.test.zone";
    masters {; };

Also, I saw a denied in my logs so added allow-query-cache { any; }; however this made no difference.

Log:client (test.test.SUB.DOMAIN.INTERN): query (cache) 'test.test.SUB.DOMAIN.INTERN/A/IN' denied

After running "nslookup test.test" ( DNS Timeout)

Now nothing shows in the syslog out of the ordinary. This is what BIND shows before it loads the zones (with no errors):

adjusted limit on open files from 4096 to 1048576
found 18 CPUs, using 18 worker threads
using 18 UDP listeners per interface
using up to 18432 sockets
loading configuration from '/etc/bind/named.conf'
reading built-in trusted keys from file '/etc/bind/bind.keys'
using default UDP/IPv4 port range: [1024, 65535]
using default UDP/IPv6 port range: [1024, 65535]
no IPv6 interfaces found
listening on IPv4 interface lo,
listening on IPv4 interface eth0,
generating session key for dynamic DNS
sizing zone task pool based on 162 zones
using built-in root key for view _default
set up managed keys zone for view _default, file 'managed-keys.bind'
command channel listening on
managed-keys-zone: loaded serial 2
zone 0.in-addr.arpa/IN: loaded serial 1

Var/Bind is in a non standard location but I have checked logs after editing the apparmor profile and see no issue.

I can successfully query bind from the same subnet.


# run resolvconf?

# startup options for the server
# OPTIONS="-u bind"
OPTIONS="-4 -u bind"

This change was to disable ipv6

I'm a RHEL guy - set up the server successfully on Centos7(1503) and found out the guys overseas with the slave want to run Ubuntu. So this cool be an OS config error on my part.

  • You've turned off recursion and haven't shown the zones; is bind authoritative for the test query?
    – thrig
    Sep 9, 2015 at 15:51
  • I have added the end of the file.
    – ZZ9
    Sep 9, 2015 at 15:56
  • I can successfully query bind from the same subnet
    – ZZ9
    Sep 9, 2015 at 15:56
  • Hmm, so are the DNS packets even getting to the server? tcpdump may help, or using dig for better diagnostics than nslookup.
    – thrig
    Sep 9, 2015 at 16:02
  • Yes, because before I set allow-query-cache they were showing up in the syslog
    – ZZ9
    Sep 9, 2015 at 16:07

1 Answer 1


This was an upstream loadbalancer issue - responses were being received by the wrong IP and being dropped by firewalls on the other end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.