I'm trying to make a BIND9 DNS server work on a Debian server for an assignment at school. The problem is that, when I try to test my DNS server with dig -t soa my.domain.com @ns.my.domain.com, I just get dig: couldn't get address for 'ns.my.domain.com': failure. The teacher has automatic checks running, which only tell me that "SOA records don't match". I'm entirely in the dark.

Here is an overview of IP addresses and names (made up for the sake of privacy):

My server: my.domain.com
Name server 1: ns1.school.com
Name server 2: ns2.school.com
Test server:

These IP addresses were given to me by the teacher. The test server runs an automatic check every 2 hours to check whether the module is working.

When I run systemctl status bind9, I get the following message repeated a few times:

client (my.domain.com): zone transfer 'my.domain.com/AXFR/IN' denied

I have no clue what could be wrong. Could anyone steer me in the right direction?



options {
        directory "/var/cache/bind";
        recursion no;
        allow-transfer { none; };

        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };


zone my.domain.com {
        type master;
        file "/etc/bind/zones/db.my.domain.com";
        allow-transfer {;; };


@       IN      SOA     ns.my.domain.com. admin@my.domain.com. (
                     2018082501         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

; Name servers
my.domain.com.   IN      NS      ns.my.domain.com.
my.domain.com.   IN      NS      ns1.school.com.
my.domain.com.   IN      NS      ns2.school.com.

; A records for name servers
ns      IN      A
ns1     IN      A
ns2     IN      A
www     IN      A
test    IN      A
  • Stop doing useless obfuscation; or at least read RFC2606 and RFC5737 to do it properly. – Patrick Mevzek Aug 31 '18 at 2:40

From the configuration you show us, there are several points to mention that need to be fixed:

  • The domain name file should be zones/db.mydomain,com and not zones/db.mydomaon.com;
  • As for the error you present us, it is saying a domain transfer is being denied to the test machine; as such you to allow it, adding it to the servers being allowed DNS transfers as in:

    allow-transfer {;;; };

You will need to restart BIND after this change.

It is plausible to believe the test server is running a script/test on the actual file that was supposed to be transfered, and thus the error.

  • if ns1 and ns2 are already registered in the school.com domain, I fail to see the need to register them again in the mydomain.com domain (and actually have seen many professionals doing the same mistake);

  • As for the machine test, it is not entirely clear if it bellongs to school.com or mydomain.com.

As for your dig command failing, I would directly the IP address as in:

If inside your server:

dig -t soa my.domain.com @

or actually better:

dig -t soa my.domain.com @

As a last comment, 1 week for a negative cache TTL is too high. I would use 30 minutes or 1 hour.

  • Thank you! So if I understand correctly: the zone file needs to have a comma instead of a point before the TLD? I'm going to make the changes and I'll get back to you with how things are going. And the machine test is in the school.com domain. – Wouter C Aug 25 '18 at 11:31
  • 1
    Oops, nevermind that about damaon.com, that was just a typo! I implemented the changes and it seems to be working :) at least I get a response when I do the dig command. I will come back in 30 minutes when the automatic check has run! – Wouter C Aug 25 '18 at 11:39
  • I still get the "SOA records don't match" message. Don't know what it means but I'm going to try to figure it out and get back to you... one thing I did see is that when I run the dig command, there is a warning "Recursion requested but not available". Could that cause problems? – Wouter C Aug 25 '18 at 13:03
  • @WouterC I did notice you do not have recursion, but I suspect it was not asked. Recursion is to solve Internet addresses. As for the SOA, post in the question the result of the dig SOA query. Might your teacher expect PTRs too? I suspect at the end of the day, you might have to ask your teacher what that error means. – Rui F Ribeiro Aug 26 '18 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.