BIND Refusing to Resolve for External Hosts

Matthew Seaman m.seaman at
Sun Jul 4 05:28:41 UTC 2010

Hash: SHA1

On 03/07/2010 22:29:46, Chris Maness wrote:
> Ahhh, I see I need to add:
> allow-query { any; };
> to my authoritative zones.
> Thanks it all works now.


> p.s.  So was this a change in the default behavior of BIND over the
> years?  Because I don't think my named.conf has been changed, and this
> used to work for any hosts.

The built-in access control rules have evolved over time, certainly.
However, this hasn't changed since BIND 9.6 was released, and possibly
longer than that.  RELENG_8 and above have contained BIND 9.6.x from the
point where the branch was created, but RELENG_7 contains BIND 9.4.x --
so if you've done an upgrade from 7.x to 8.x recently it might explain
your experiences.

The pre-canned configuration that comes with FreeBSD is suitable for use
as a localhost-only recursive resolver: if you want to serve a whole
network of machines or add authoritative data then you will need to
modify it or craft your own named.conf, an important part of which is
setting up ACLs to control what you will serve to who.  This is a very
useful reference:



- -- 
Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP:     Ramsgate
JID: matthew at               Kent, CT11 9PW
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla -


More information about the freebsd-questions mailing list