I want to use BIND as a public nameserver for the companies domains. I'm using a fresh installation of ubuntu server 20.04.1 and BIND 9.16.1. The issue is that BIND never answers authoritatively. I can see this using dig. To locate the issue I tried it with a single and minimal zone "example.com" but without any success. The zone file is db.example.com:

example.com.        86400    IN    SOA    ns1.example.com.    hostmaster.example.com. (
                                      1     ; Serial
                                      900   ; Refresh
                                      300   ; Retry
                                      86400 ; Expire
                                      600 )  ; Negative Cache TTL
example.com.        86400    IN    NS    ns1.example.com.
example.com.        86400    IN    MX    10 mail.example.com.
ns1.example.com.    86400    IN    A
mail.example.com.   86400    IN    A

Of course, the IP addresses above are not the real IP addresses, but the IP address for ns1.example.com is the public IP address of the system BIND is running on. named-checkzone is happy with it. In named.conf.local only the following lines are added:

zone "example.com" {
    type master;
    file "/var/lib/bind/db.example.com";


options {
    directory "/var/cache/bind";
    dnssec-validation auto;
    auth-nxdomain no;
    listen-on { any; };
    listen-on-v6 { any; };
    recursion no;

Using dig with ANY I can see all records in the zone file but BIND always answers AUTHORITY: 0. Also the A records do not appear in the answer section but in the additional section. Unfortunately I'm not allowed to post the original output of dig because it looks like spam. The zone is configured as master and the NS record points to the IP address of the server BIND is running on. Another thought was that BIND may try to query "example.com" from root and knows that it is not really the authoritative nameserver. So I also tried the same with the domain "example.invalid" that really should not exist anywhere. The result was the same as for "example.com". I never had this issue before. What else can I try to solve this issue?


BIND always answers AUTHORITY: 0.

That's normal and it doesn't mean the response wasn't authoritative. Quite the opposite, this section is meant to contain records which tell the client that the authority is somewhere else – for example, if you queried a nameserver hosting the parent com zone or even the root zone, you would get a "referral" response which contains NS records in this section.

As far as I know, an actual authoritative response should never contain any records in this section.

So in other words, you're looking at the wrong part of dig's output. To find out whether a response was authoritative or not, look at the "flags" section – the aa flag (Authoritative Answer) is the indicator.

Also the A records do not appear in the answer section but in the additional section

That's also normal. They will not appear in the answer section because your example.com domain does not have any A records.

However, it has some record types (NS and MX) which reference another domain name which has A records. Normally a second query would be necessary to resolve them to actual addresses, but the DNS server can optionally include those A/AAAA records in the Additional section.

So when you query dig example.com MX, the Answer section will have the MX records for example.com (i.e. exactly what you queried), and the Additional section will have the A/AAAA records for mail.example.com (which you didn't query for, but the server included them to speed things up).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.