> And since we don’t want these following the full recursion out to the
> internet, root hints are intentionally disabled (we’re hoping for at least
> some data hygiene by using these specific forwarders).
That's forward only.
> Setting it to ‘forward only’ resolved the issue.
See above.
> Do I have something misconfigured?
Yes, while I haven't tested it myself, I believe since the "forward first"
could still fallback to
full resolution, it tries priming the root servers that fails and you got your
SERVFAIL there.
The "forward only;" exactly describes what you want to do without doing weird
things like
making the root hints file empty.
If you run the named with debug logging (or just logging), it might show more.
Ondrej
--
Ondřej Surý (He/Him)
ond...@isc.org
My working hours and your working hours may be different. Please do not feel
obligated to reply outside your normal working hours.
> On 5. 9. 2025, at 20:30, Reynolds, David <dreyno...@epiqglobal.com> wrote:
>
> Greetings all,
> I stumbled across an oddity in BIND that may be due to my ignorance or some
> other environmental factor.
> We have a pair of caching resolvers in a datacenter that ended up with the
> following in the configuration:
>
> forwarders {
> // Cloudflare
> 1.1.1.1;
> 1.0.0.1;
> // Quad9
> 9.9.9.9;
> 149.112.112.112;
> //Cisco OpenDNS
> 208.67.222.222;
> 208.67.220.220;
> };
> forward first;
> dnssec-enable no;
> dnssec-validation no;
> empty-zones-enable no;
> };
> zone "." IN {
> type hint;
> file "/dev/null";
> };
>
>
> In this configuration, the forward always fails. Not only does it fail, we
> see no traffic leaving the server (tcpdump port 53)!
>
> And since we don’t want these following the full recursion out to the
> internet, root hints are intentionally disabled (we’re hoping for at least
> some data hygiene by using these specific forwarders).
> Setting it to ‘forward only’ resolved the issue.
> Do I have something misconfigured?
> More detail of named.conf (removed logging and internal zones):
> options {
> listen-on port 53 {
> any;
> };
> directory "/var/named";
> dump-file "/opt/named/cache_dump.db";
> statistics-file "/var/named/data/named_stats.txt";
> memstatistics-file "/var/named/data/named_mem_stats.txt";
> recursing-file "/var/named/data/named.recursing";
> secroots-file "/var/named/data/named.secroots";
> allow-query { any; };
> querylog yes;
> recursion yes;
> recursive-clients 50000;
> tcp-clients 50000;
> edns-udp-size 4096;
> max-udp-size 4096;
> bindkeys-file "/etc/named.root.key";
> managed-keys-directory "/var/named/dynamic";
> pid-file "/run/named/named.pid";
> session-keyfile "/run/named/session.key";
> forwarders {
> 1.1.1.1;
> 1.0.0.1;
> 9.9.9.9;
> 149.112.112.112;
> 208.67.222.222;
> 208.67.220.220;
> };
> forward first;
> dnssec-enable no;
> dnssec-validation no;
> empty-zones-enable no;
> };
> zone "." IN {
> type hint;
> file "/dev/null";
> };
> include "/etc/named.rfc1912.zones";
> include "/etc/named.root.key";
> OS details:
> # cat /etc/*release
> NAME="Red Hat Enterprise Linux"
> VERSION="8.10 (Ootpa)"
> ID="rhel"
> ID_LIKE="fedora"
> VERSION_ID="8.10"
> PLATFORM_ID="platform:el8"
> PRETTY_NAME="Red Hat Enterprise Linux 8.10 (Ootpa)"
> ANSI_COLOR="0;31"
> CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"
> HOME_URL=https://www.redhat.com/
> DOCUMENTATION_URL=https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8
> BUG_REPORT_URL=https://issues.redhat.com/
> REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
> REDHAT_BUGZILLA_PRODUCT_VERSION=8.10
> REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
> REDHAT_SUPPORT_PRODUCT_VERSION="8.10"
> Red Hat Enterprise Linux release 8.10 (Ootpa)
> Red Hat Enterprise Linux release 8.10 (Ootpa)
> BIND details:
> BIND 9.11.36-RedHat-9.11.36-16.el8_10.4 (Extended Support Version)
> <id:68dbd5b>
> running on Linux x86_64 4.18.0-553.56.1.el8_10.x86_64 #1 SMP Mon Jun 2
> 12:33:13 EDT 2025
> built by make with '--build=x86_64-redhat-linux-gnu'
> '--host=x86_64-redhat-linux-gnu' '--program-prefix='
> '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr'
> '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc'
> '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64'
> '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib'
> '--mandir=/usr/share/man' '--infodir=/usr/share/info'
> '--with-python=/usr/libexec/platform-python' '--with-libtool'
> '--localstatedir=/var' '--enable-threads' '--enable-ipv6'
> '--enable-filter-aaaa' '--with-pic' '--disable-static'
> '--includedir=/usr/include/bind9' '--with-tuning=large' '--with-libidn2'
> '--enable-openssl-hash' '--with-geoip2' '--enable-native-pkcs11'
> '--with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so' '--with-dlopen=yes'
> '--with-dlz-ldap=yes' '--with-dlz-postgres=yes' '--with-dlz-mysql=yes'
> '--with-dlz-filesystem=yes' '--with-dlz-bdb=yes' '--with-gssapi=yes'
> '--disable-isc-spnego' '--with-lmdb=no' '--with-libjson' '--enable-dnstap'
> '--with-cmocka' '--enable-fixed-rrset'
> '--with-docbook-xsl=/usr/share/sgml/docbook/xsl-stylesheets'
> '--enable-full-report' 'build_alias=x86_64-redhat-linux-gnu'
> 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS= -O2 -g -pipe -Wall
> -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS
> -fexceptions -fstack-protector-strong -grecord-gcc-switches
> -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
> -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic
> -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection'
> 'LDFLAGS=-Wl,-z,relro -Wl,-z,now
> -specs=/usr/lib/rpm/redhat/redhat-hardened-ld' 'CPPFLAGS= -DDIG_SIGCHASE'
> 'PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'
> compiled by GCC 8.5.0 20210514 (Red Hat 8.5.0-23)
> compiled with OpenSSL version: OpenSSL 1.1.1k FIPS 25 Mar 2021
> linked to OpenSSL version: OpenSSL 1.1.1k FIPS 25 Mar 2021
> compiled with libxml2 version: 2.9.7
> linked to libxml2 version: 20907
> compiled with libjson-c version: 0.13.1
> linked to libjson-c version: 0.13.1
> compiled with zlib version: 1.2.11
> linked to zlib version: 1.2.11
> linked to maxminddb version: 1.2.0
> compiled with protobuf-c version: 1.3.0
> linked to protobuf-c version: 1.3.0
> threads support is enabled
>
> default paths:
> named configuration: /etc/named.conf
> rndc configuration: /etc/rndc.conf
> DNSSEC root key: /etc/bind.keys
> nsupdate session key: /var/run/named/session.key
> named PID file: /var/run/named/named.pid
> named lock file: /var/run/named/named.lock
> geoip-directory: /usr/share/GeoIP
> David Reynolds
> Epiq | Linux Support
> Portland, OR 97227
> Mobile: 503 457-2262
> Email: dreyno...@epiqglobal.com
> People. Partnership. Performance.
> www.epiqglobal.com
>
> This communication (including any attachment(s)) is intended solely for the
> recipient(s) named above and may contain information that is confidential,
> privileged or legally protected. Any unauthorized use or dissemination of
> this communication is strictly prohibited. If you have received this
> communication in error, please immediately notify the sender by return e-mail
> message and delete all copies of the original communication to include any
> copy that may reside in your sent box. Thank you for your cooperation. --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
> this list.
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
