1 Frequently Asked Questions about BIND 9
3 -------------------------------------------------------------------------------
5 Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads?
7 A: Linux threads do not fully implement the Posix threads (pthreads) standard. In
8 particular, setuid() operates only on the current thread, not the full process.
9 Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on
10 all other supported platforms. setuid() cannot be called before creating
11 threads, since the server does not start listening on reserved ports until
12 after threads have started.
14 In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve
15 capabilities across a setuid() call is present. This allows BIND 9 to call
16 setuid() early, while retaining the ability to bind reserved ports. This is a
19 On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of
20 a security risk than a root process that has not dropped privileges.
22 If Linux threads ever work correctly, this restriction will go away.
24 Configuring BIND9 with the --disable-threads option (the default) causes a
25 non-threaded version to be built, which will allow -u to be used.
27 Q: Why do I get the following errors:
29 general: errno2result.c:109: unexpected error:
30 general: unable to convert errno to isc_result: 14: Bad address
31 client: UDP client handler shutting down due to fatal receive error: unexpected error
33 A: This is the result of a Linux kernel bug.
35 See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
37 Q: Why does named log the warning message "no TTL specified - using SOA MINTTL
40 A: Your zone file is illegal according to RFC1035. It must either have a line
45 at the beginning, or the first record in it must have a TTL field, like the
46 "84600" in this example:
48 example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )
50 Q: Why do I see 5 (or more) copies of named on Linux?
52 A: Linux threads each show up as a process under ps. The approximate number of
53 threads running is n+4, where n is the number of CPUs. Note that the amount of
54 memory used is not cumulative; if each process is using 10M of memory, only a
57 Newer versions of Linux's ps command hide the individual threads and require -L
60 Q: Why does BIND 9 log "permission denied" errors accessing its configuration
61 files or zones on my Linux system even though it is running as root?
63 A: On Linux, BIND 9 drops most of its root privileges on startup. This including
64 the privilege to open files owned by other users. Therefore, if the server is
65 running as root, the configuration files and zone files should also be owned by
68 Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar:
71 A: This is often caused by TXT records with missing close quotes. Check that all
72 TXT records containing quoted strings have both open and close quotes.
74 Q: How do I produce a usable core file from a multithreaded named on Linux?
76 A: If the Linux kernel is 2.4.7 or newer, multithreaded core dumps are usable
77 (that is, the correct thread is dumped). Otherwise, if using a 2.2 kernel,
78 apply the kernel patch found in contrib/linux/coredump-patch and rebuild the
79 kernel. This patch will cause multithreaded programs to dump the correct
82 Q: How do I restrict people from looking up the server version?
84 A: Put a "version" option containing something other than the real version in the
85 "options" section of named.conf. Note doing this will not prevent attacks and
86 may impede people trying to diagnose problems with your server. Also it is
87 possible to "fingerprint" nameservers to determine their version.
89 Q: How do I restrict only remote users from looking up the server version?
91 A: The following view statement will intercept lookups as the internal view that
92 holds the version information will be matched last. The caveats of the previous
93 answer still apply, of course.
96 match-clients { <those to be refused>; };
97 allow-query { none; };
100 file "/dev/null"; // or any empty file
104 Q: What do "no source of entropy found" or "could not open entropy source foo"
107 A: The server requires a source of entropy to perform certain operations, mostly
108 DNSSEC related. These messages indicate that you have no source of entropy. On
109 systems with /dev/random or an equivalent, it is used by default. A source of
110 entropy can also be defined using the random-device option in named.conf.
112 Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why?
114 A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed
115 under /usr. Check that the correct named is running.
117 Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm
118 sure I have the keys set up correctly, but the server is rejecting the TSIG.
121 A: This may be a clock skew problem. Check that the the clocks on the client and
122 server are properly synchronised (e.g., using ntp).
124 Q: I'm trying to compile BIND 9, and "make" is failing due to files not being
127 A: Using a parallel or distributed "make" to build BIND 9 is not supported, and
128 doesn't work. If you are using one of these, use normal make or gmake instead.
130 Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error
131 messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's
134 A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND
135 8.2.4. It can be safely ignored - the notify has been acted on by the slave
136 despite the error message.
138 Q: I keep getting log messages like the following. Why?
140 Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update
141 failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
143 A: DNS updates allow the update request to test to see if certain conditions are
144 met prior to proceeding with the update. The message above is saying that
145 conditions were not met and the update is not proceeding. See doc/rfc/
146 rfc2136.txt for more details on prerequisites.
148 Q: I keep getting log messages like the following. Why?
150 Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
152 A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update
153 protocol. Windows 2000 machines have a habit of sending dynamic update requests
154 to DNS servers without being specifically configured to do so. If the update
155 requests are coming from a Windows 2000 machine, see http://
156 support.microsoft.com/support/kb/articles/q246/8/04.asp for information about
157 how to turn them off.
159 Q: I see a log message like the following. Why?
161 couldn't open pid file '/var/run/named.pid': Permission denied
163 A: You are most likely running named as a non-root user, and that user does not
164 have permission to write in /var/run. The common ways of fixing this are to
165 create a /var/run/named directory owned by the named user and set pid-file to "
166 /var/run/named/named.pid", or set pid-file to "named.pid", which will put the
167 file in the directory specified by the directory option (which, in this case,
168 must be writable by the named user).
170 Q: When I do a "dig . ns", many of the A records for the root servers are missing.
173 A: This is normal and harmless. It is a somewhat confusing side effect of the way
174 BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid
175 promoting glue into answers.
177 When BIND 9 first starts up and primes its cache, it receives the root server
178 addresses as additional data in an authoritative response from a root server,
179 and these records are eligible for inclusion as additional data in responses.
180 Subsequently it receives a subset of the root server addresses as additional
181 data in a non-authoritative (referral) response from a root server. This causes
182 the addresses to now be considered non-authoritative (glue) data, which is not
183 eligible for inclusion in responses.
185 The server does have a complete set of root server addresses cached at all
186 times, it just may not include all of them as additional data, depending on
187 whether they were last received as answers or as glue. You can always look up
188 the addresses with explicit queries like "dig a.root-servers.net A".
190 Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why?
192 A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages
193 larger than 16K are not handled properly. This can be worked around by setting
194 the option "transfer-format one-answer;". Also check whether your zone contains
195 domain names with embedded spaces or other special characters, like "John\
196 032Doe\213s\032Computer", since such names have been known to cause Windows
197 2000 slaves to incorrectly reject the zone.
199 Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
201 A: A zone can be updated either by editing zone files and reloading the server or
202 by dynamic update, but not both. If you have enabled dynamic update for a zone
203 using the "allow-update" option, you are not supposed to edit the zone file by
204 hand, and the server will not attempt to reload it.
206 Q: I can query the nameserver from the nameserver but not from other machines.
209 A: This is usually the result of the firewall configuration stopping the queries
210 and / or the replies.
212 Q: How can I make a server a slave for both an internal and an external view at
213 the same time? When I tried, both views on the slave were transferred from the
214 same view on the master.
216 A: You will need to give the master and slave multiple IP addresses and use those
217 to make sure you reach the correct view on the other machine.
219 Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
221 match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; };
222 notify-source 10.0.1.1;
223 transfer-source 10.0.1.1;
224 query-source address 10.0.1.1;
226 match-clients { any; };
227 recursion no; // don't offer recursion to the world
228 notify-source 10.0.1.2;
229 transfer-source 10.0.1.2;
230 query-source address 10.0.1.2;
232 Slave: 10.0.1.3 (internal), 10.0.1.4 (external, IP alias)
234 match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; };
235 notify-source 10.0.1.3;
236 transfer-source 10.0.1.3;
237 query-source address 10.0.1.3;
239 match-clients { any; };
240 recursion no; // don't offer recursion to the world
241 notify-source 10.0.1.4;
242 transfer-source 10.0.1.4;
243 query-source address 10.0.1.4;
245 You put the external address on the alias so that all the other dns clients on
246 these boxes see the internal view by default.
248 A: BIND 9.3 and later: Use TSIG to select the appropriate view.
256 match-clients { !key external; 10.0.1/24; };
260 match-clients { key external; any; };
261 server 10.0.1.2 { keys external; };
272 match-clients { !key external; 10.0.1/24; };
276 match-clients { key external; any; };
277 server 10.0.1.1 { keys external; };
282 Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
284 A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
285 certain interrupts as a source of random events. You can make this permanent by
286 setting rand_irqs in /etc/rc.conf.
291 See also http://people.freebsd.org/~dougb/randomness.html
293 Q: Why is named listening on UDP port other than 53?
295 A: Named uses a system selected port to make queries of other nameservers. This
296 behaviour can be overridden by using query-source to lock down the port and/or
297 address. See also notify-source and transfer-source.
299 Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other
300 data" when transferring a zone. What does this mean?
302 A: These indicate a malformed master zone. You can identify the exact records
303 involved by transferring the zone using dig then running named-checkzone on it.
305 dig axfr example.com @master-server > tmp
306 named-checkzone example.com tmp
308 A CNAME record cannot exist with the same name as another record except for the
309 DNSSEC records which prove its existance (NSEC).
311 RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data
312 should be present; this ensures that the data for a canonical name and its
313 aliases cannot be different. This rule also insures that a cached CNAME can be
314 used without checking with an authoritative server for other RR types."
316 Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is
317 the last line of named.conf.
319 A: Some text editors (notepad and wordpad) fail to put a line title indication
320 (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a
321 blank line to the end of the file. Named expects to see EOF immediately after
322 EOL and treats text files where this is not met as truncated.
324 Q: I get warning messages like "zone example.com/IN: refresh: failure trying
325 master 1.2.3.4#53: timed out".
327 A: Check that you can make UDP queries from the slave to the master
329 dig +norec example.com soa @1.2.3.4
331 You could be generating queries faster than the slave can cope with. Lower the
334 serial-query-rate 5; // default 20
336 Q: How do I share a dynamic zone between multiple views?
338 A: You choose one view to be master and the second a slave and transfer the zone
353 match-clients { !external; 10.0.1/24; };
355 /* Deliver notify messages to external view. */
360 file "internal/example.db";
361 allow-update { key mykey; };
362 notify-also { 10.0.1.1; };
367 match-clients { external; any; };
370 file "external/example.db";
371 masters { 10.0.1.1; };
372 transfer-source { 10.0.1.1; };
373 // allow-update-forwarding { any; };
374 // allow-notify { ... };
378 Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master
379 file primaries/wireless.ietf56.ietf.org: no owner".
381 A: This error is produced when a line in the master file contains leading white
382 space (tab/space) but the is no current record owner name to inherit the name
383 from. Usually this is the result of putting white space before a comment.
384 Forgeting the "@" for the SOA record or indenting the master file.
386 Q: Why are my logs in GMT (UTC).
388 A: You are running chrooted (-t) and have not supplied local timzone information
391 FreeBSD: /etc/localtime
392 Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
393 OSF: /etc/zoneinfo/localtime
395 See also tzset(3) and zic(8).
397 Q: I get the error message "named: capset failed: Operation not permitted" when
400 A: The capability module, part of "Linux Security Modules/LSM", has not been
401 loaded into the kernel. See insmod(8).
403 Q: I get "rndc: connect failed: connection refused" when I try to run rndc.
405 A: This is usually a configuration error.
407 First ensure that named is running and no errors are being reported at startup
408 (/var/log/messages or equivalent). Running "named -g <usual arguments>" from a
409 title can help at this point.
411 Secondly ensure that named is configured to use rndc either by "rndc-confgen
412 -a", rndc-confgen or manually. The Administrators Reference manual has details
415 Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/
416 rndc.conf for the default server. Update /etc/rndc.conf if necessary so that
417 the default server listed in /etc/rndc.conf matches the addresses used in
418 named.conf. "localhost" has two address (127.0.0.1 and ::1).
420 If you use "rndc-confgen -a" and named is running with -t or -u ensure that /
421 etc/rndc.conf has the correct ownership and that a copy is in the chroot area.
422 You can do this by re-running "rndc-confgen -a" with appropriate -t and -u
425 Q: I don't get RRSIG's returned when I use "dig +dnssec".
427 A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
429 Q: I get "Error 1067" when starting named under Windows.
431 A: This is the service manager saying that named exited. You need to examine the
432 Application log in the EventViewer to find out why.
434 Common causes are that you failed to create "named.conf" (usually "C:\windows\
435 dns\etc\named.conf") or failed to specify the directory in named.conf.
438 Directory "C:\windows\dns\etc";
441 Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while
442 receiving responses: permission denied" error messages.
444 A: These indicate a filesystem permission error preventing named creating /
445 renaming the temporary file. These will usually also have other associated
448 "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
450 Named needs write permission on the directory containing the file. Named writes
451 the new cache file to a temporary file then renames it to the name specified in
452 named.conf to ensure that the contents are always complete. This is to prevent
453 named loading a partial zone in the event of power failure or similar
454 interrupting the write of the master file.
456 Note file names are relative to the directory specified in options and any
457 chroot directory ([<chroot dir>/][<options dir>]).
459 If named is invoked as "named -t /chroot/DNS" with the following named.conf
460 then "/chroot/DNS/var/named/sl" needs to be writable by the user named is
464 directory "/var/named";
469 file "sl/example.net";
470 masters { 192.168.4.12; };
473 Q: How do I intergrate BIND 9 and Solaris SMF
475 A: Sun has a blog entry describing how to do this.
477 http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
479 Q: Can a NS record refer to a CNAME.
481 A: No. The rules for glue (copies of the *address* records in the parent zones)
482 and additional section processing do not allow it to work.
484 You would have to add both the CNAME and address records (A/AAAA) as glue to
485 the parent zone and have CNAMEs be followed when doing additional section
486 processing to make it work. No namesever implementation supports either of
489 Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" mean?
491 A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
492 using then you have failed to follow RFC 1918 usage rules and are leaking
493 queries to the Internet. You should establish your own zones for these
494 addresses to prevent you quering the Internet's name servers for these
495 addresses. Please see http://as112.net/ for details of the problems you are
496 causing and the counter measures that have had to be deployed.
498 If you are not using these private addresses then a client has queried for
499 them. You can just ignore the messages, get the offending client to stop
500 sending you these messages as they are most probably leaking them or setup your
501 own zones empty zones to serve answers to these queries.
503 zone "10.IN-ADDR.ARPA" {
508 zone "16.172.IN-ADDR.ARPA" {
515 zone "31.172.IN-ADDR.ARPA" {
520 zone "168.192.IN-ADDR.ARPA" {
526 @ 10800 IN SOA <name-of-server>. <contact-email>. (
527 1 3600 1200 604800 10800 )
528 @ 10800 IN NS <name-of-server>.
532 Future versions of named are likely to do this automatically.
534 Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
536 Why can't named update slave zone database files?
538 Why can't named create DDNS journal files or update the master zones from
541 Why can't named create custom log files?
543 A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
545 Red Hat have adopted the National Security Agency's SELinux security policy (
546 see http://www.nsa.gov/selinux ) and recommendations for BIND security , which
547 are more secure than running named in a chroot and make use of the bind-chroot
548 environment unecessary .
550 By default, named is not allowed by the SELinux policy to write, create or
551 delete any files EXCEPT in these directories:
553 $ROOTDIR/var/named/slaves
554 $ROOTDIR/var/named/data
558 where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed.
560 The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var
561 /named directory, the default location for master zone database files.
563 SELinux policy overrules file access permissions - so even if all the files
564 under /var/named have ownership named:named and mode rw-rw-r--, named will
565 still not be able to write or create files except in the directories above,
566 with SELinux in Enforcing mode.
568 So, to allow named to update slave or DDNS zone files, it is best to locate
569 them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as:
571 zone "slave.zone." IN {
573 file "slaves/slave.zone.db";
576 zone "ddns.zone." IN {
579 file "slaves/ddns.zone.db";
583 To allow named to create its cache dump and statistics files, for example, you
584 could use named.conf options statements such as:
588 dump-file "/var/named/data/cache_dump.db";
589 statistics-file "/var/named/data/named_stats.txt";
594 You can also tell SELinux to allow named to update any zone database files, by
595 setting the SELinux tunable boolean parameter 'named_write_master_zones=1',
596 using the system-config-securitylevel GUI, using the 'setsebool' command, or in
597 /etc/selinux/targeted/booleans.
599 You can disable SELinux protection for named entirely by setting the
600 'named_disable_trans=1' SELinux tunable boolean parameter.
602 The SELinux named policy defines these SELinux contexts for named:
604 named_zone_t : for zone database files - $ROOTDIR/var/named/*
605 named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
606 named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
609 If you want to retain use of the SELinux policy for named, and put named files
610 in different locations, you can do so by changing the context of the custom
613 To create a custom configuration file location, eg. '/root/named.conf', to use
614 with the 'named -c' option, do:
616 # chcon system_u:object_r:named_conf_t /root/named.conf
619 To create a custom modifiable named data location, eg. '/var/log/named' for a
622 # chcon system_u:object_r:named_cache_t /var/log/named
625 To create a custom zone file location, eg. /root/zones/, do:
627 # chcon system_u:object_r:named_zone_t /root/zones/{.,*}
630 See these man-pages for more information : selinux(8), named_selinux(8), chcon