I created a bind9 based DNS server to work only in forwarding mode:

This is my named.conf.options file:

#acl goodclients {
#        localhost;
#        localnets;

options {

        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        recursion yes;

        #allow-query { goodclients; };

        forwarders {
        forward only;

        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

I configured the client and everything works fine but I got errors like this:

May 15 08:54:49 digitalocean named[3294]: client x.x.x.x#8137 (unix.stackexchange.com): query (cache) 'unix.stackexchange.com/A/IN' denied

Where x.x.x.x is my public IP address.

Note that the DNS server is public and I am using its public IP in the client config.

Should I ignore the error message ?

When I dig google.com using the public IP of the DNS server (y.y.y.y):

dig @y.y.y.y google.com

; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @y.y.y.y google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 28091
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

; EDNS: version: 0, flags:; udp: 4096
;google.com.            IN  A

;; Query time: 15 msec
;; SERVER: y.y.y.y#53(y.y.y.y)
;; WHEN: Sun May 15 14:57:56 CEST 2016
;; MSG SIZE  rcvd: 39

This is confusing.


It is not working because you have commented out the allow-query and goodclients directives. You should uncomment them and populate goodclients with the IPs/networks BIND is supposed to answer queries.

acl goodclients {

options {
    allow-query { goodclients; };


From http://www.zytrax.com/books/dns/ch7/queries.html#allow-query

allow-query defines an match list of IP address(es) which are allowed to issue queries to the server.

Also please do note that from BIND 9.4.1-P1 the default behaviour of allow-query changed from allowed to forbidden.



Found it. The solution is to add:

allow-query {

EDIT: The solution of Rui F Ribeiro works, but I need to create a public server. If you would like to avoid the security issues, please see the comments.

  • 2
    I advise you to not open BIND queries to all. openresolverproject.org May 15 '16 at 14:10
  • What if I would like to set it as a public DNS server ? Is there a security threat in this ?
    – 4m1nh4j1
    May 15 '16 at 14:44
  • yes, there are. have you read the previous link? May 15 '16 at 14:50
  • Yes there are useful information thanks. Since I am using Bind9, I was looking how to install the TCP-ANY Patch, haven't found it. Do you how can I install it ?
    – 4m1nh4j1
    May 15 '16 at 15:42
  • I advise using rate-limit instead. Please open another question about it. May 15 '16 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.