My ISP allows me to run a DNS server, as long as it won't respond to non-authorative queries. This means no response whatsoever. I had it configured such as to refuse non-authorative, like this;

> tweakers.net
Server:     my.server.net
Address:    my.ip#53

** server can't find tweakers.net: REFUSED

But apparently that's not good enough anymore. It needs to simple not send a response at all. Is that even possible?

This is my current options file;

options {
    directory "/var/cache/bind";

    recursion yes;

    allow-recursion { internal; };

    allow-transfer { *secondary dns ip*; };

    dnssec-enable yes;
    dnssec-validation yes;

    auth-nxdomain no;    # conform to RFC1035

    filter-aaaa-on-v4 yes;


My internal ACL

acl internal {;;;

Maybe I am not googling the right things, but I can't find such an option.

  • so to clarify, your DNS server is publically accessible and is authoritative on a domain you own, and you don't carry any zones you don't own or are non-registered with the public DNS infrastructure, right? – Frank Thomas Jul 2 '20 at 11:17
  • Correct. It only servers a handfull of domains, that are public. The DNS doesn't carry any other information. – Eloque Jul 2 '20 at 11:24

You need to disable Recursion.

This will stop it from responding to queries for non-authoritative zones.

But it will still respond with a SERVFAIL.

  • It needs to blackbox it. Servfail is still a response and not allowed by my ISP. I know, not the most logical idea. – Eloque Jul 3 '20 at 8:33

Found a iptables solution here. Similar question posted on Serverfault. https://serverfault.com/questions/438515/bind-blackhole-for-invalid-recursive-queries

There isn't a way to do this with Bind. However you can use iptables firewall rules to block responses to all recursive queries.


Like with you, I dislike when my server involved in DDOS, even it responds with small 30-byte packets. Also, for some reasons I unable to use iptables to block spoofed requests. Server vulnerability was fixed 3 months ago, but botnet still send spoofed requests to server.

So, as result, you can use this simple patch to not send REFUSED response (requests will be dropped):

--- bind9-9.9.5.dfsg/bin/named/query.c.orig        Thu Aug  6 21:56:57 2020
+++ bind9-9.9.5.dfsg/bin/named/query.c     Thu Aug  6 22:08:15 2020
@@ -1038,7 +1038,7 @@
                        ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
                                      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
-                                     "%s denied", msg);
+                                     "%s dropped", msg);
                 * We've now evaluated the view's query ACL, and
@@ -5809,8 +5809,9 @@
                        } else
                                inc_stats(client, dns_nsstatscounter_authrej);
                        if (!PARTIALANSWER(client))
-                               QUERY_ERROR(DNS_R_REFUSED);
-               } else
+               //              QUERY_ERROR(DNS_R_REFUSED);
+                               QUERY_ERROR(DNS_R_DROP);
+               } else
                goto cleanup;
# diff -u query.c.orig query.c

... as result, you get nice logs which like this one:

Aug  6 21:39:29 topor named[2652]: client (.): query (cache) './ANY/IN' dropped
Aug  6 21:40:00 topor last message repeated 485 times

And there will be no 'REFUSED' reply if query came from unauthorized network / for unsupported domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.