My ISP allows me to run a DNS server, as long as it won't respond to non-authorative queries. This means no response whatsoever. I had it configured such as to refuse non-authorative, like this;

> tweakers.net
Server:     my.server.net
Address:    my.ip#53

** server can't find tweakers.net: REFUSED

But apparently that's not good enough anymore. It needs to simple not send a response at all. Is that even possible?

This is my current options file;

options {
    directory "/var/cache/bind";

    recursion yes;

    allow-recursion { internal; };

    allow-transfer { *secondary dns ip*; };

    dnssec-enable yes;
    dnssec-validation yes;

    auth-nxdomain no;    # conform to RFC1035

    filter-aaaa-on-v4 yes;


My internal ACL

acl internal {;;;

Maybe I am not googling the right things, but I can't find such an option.

  • so to clarify, your DNS server is publically accessible and is authoritative on a domain you own, and you don't carry any zones you don't own or are non-registered with the public DNS infrastructure, right? Jul 2, 2020 at 11:17
  • Correct. It only servers a handfull of domains, that are public. The DNS doesn't carry any other information.
    – Eloque
    Jul 2, 2020 at 11:24

3 Answers 3


You need to disable Recursion.

This will stop it from responding to queries for non-authoritative zones.

But it will still respond with a SERVFAIL.

  • It needs to blackbox it. Servfail is still a response and not allowed by my ISP. I know, not the most logical idea.
    – Eloque
    Jul 3, 2020 at 8:33

Found a iptables solution here. Similar question posted on Serverfault. https://serverfault.com/questions/438515/bind-blackhole-for-invalid-recursive-queries

There isn't a way to do this with Bind. However you can use iptables firewall rules to block responses to all recursive queries.


Like with you, I dislike when my server involved in DDOS, even it responds with small 30-byte packets. Also, for some reasons I unable to use iptables to block spoofed requests. Server vulnerability was fixed 3 months ago, but botnet still send spoofed requests to server.

So, as result, you can use this simple patch to not send REFUSED response (requests will be dropped):

--- bind9-9.9.5.dfsg/bin/named/query.c.orig        Thu Aug  6 21:56:57 2020
+++ bind9-9.9.5.dfsg/bin/named/query.c     Thu Aug  6 22:08:15 2020
@@ -1038,7 +1038,7 @@
                        ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
                                      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-                                     "%s denied", msg);
+                                     "%s dropped", msg);
                 * We've now evaluated the view's query ACL, and
@@ -5809,8 +5809,9 @@
                        } else
                                inc_stats(client, dns_nsstatscounter_authrej);
                        if (!PARTIALANSWER(client))
-                               QUERY_ERROR(DNS_R_REFUSED);
-               } else
+               //              QUERY_ERROR(DNS_R_REFUSED);
+                               QUERY_ERROR(DNS_R_DROP);
+               } else
                goto cleanup;
# diff -u query.c.orig query.c

... as result, you get nice logs which like this one:

Aug  6 21:39:29 topor named[2652]: client (.): query (cache) './ANY/IN' dropped
Aug  6 21:40:00 topor last message repeated 485 times

And there will be no 'REFUSED' reply if query came from unauthorized network / for unsupported domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .