I am trying to configure LAN DNS server using BIND9 on DEBIAN.

Context: network mask:, network IP: 10.1.xxx.xxx
I own a public domain example.com, managed by external NS and my aim is to manage all subdomains lan.example.com, e.g. address node1.lan.example.com is computer with IP

Current configuration

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";


options {
    directory "/var/cache/bind";
    forwarders {
    dnssec-validation auto;
    recursion yes;
    allow-query { 10/24;; };
    allow-recursion { 10/24;; };
    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    listen-on port 53 {;; } ;


zone "lan.example.com" {
    type master ;
    allow-query { 10/24;; };
    file "/etc/bind/zone.lan.example.com" ;
zone "0.1.10.in-addr-arpa" {
    type master ;
    notify no ;
    allow-query { 10/24;; };
    file "/etc/bind/zone.0.1.10.in-addr.arpa" ;
} ; 
zone "2.1.10.in-addr-arpa" {
    type master ;
    notify no ;
    allow-query { 10/24;; };
    file "/etc/bind/zone.2.1.10.in-addr.arpa" ;
} ; 


zone "." {
    type hint;
    file "/etc/bind/db.root";
zone "localhost" {
    type master;
    file "/etc/bind/db.local";

zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";

zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";

zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";


; zone.lan.example.com BIND9 configuration file.
$TTL 604800
@   IN  SOA ns.lan.example.com. root.localhost. (
    201212041   ; serial no. (increment by +1 after every edit!)
    604800      ; refresh
    86400       ; retry after failure
    2419200 ; expired
    604800); TTL negative cache
@   IN  NS  ns.lan.example.com.
@   IN  A
; A records - Local machines and addresses:
; Servers:
router  IN  A    ; Router
ns      IN  A    ; NS Server
server  IN  A    ; Server
media   IN  A    ; Media Server

; Workstations:
node1   IN  A    ; node1


client query (cache) 'a.root-servers.net/A/IN' denied
client query (cache) 'example.com/A/IN' denied
client MY_EXTERNAL_IP#37853: query 'server.lan.example.com/A/IN' denied
client MY_EXTERNAL_IP#56367: query (cache) 'superuser.com/A/IN' denied

When I try to dig server.lan.example.com on the nameserver ns.lan.example.com, everything works, if I try to do this from another machine, it fails.

How can I solve this?

Thanks in advance


You configured BIND to allow queries from 10/24. I'm not sure if BIND even accepts that as a valid netmask, but if it does, then it would expand to or, which does not match (Did you mix up /24 with

According to your note network mask:, network IP: 10.1.xxx.xxx, the correct network should be


The previous answer solved the problem for the initial submitter, but for another, more generalized, way of doing this you can use the built-in ACLs "localnets" and "localhost", e.g.:

allow-recursion { localnets; } ;

localhost is pretty self-explanatory (except that in addition to or ::1 it includes the configured address of every network interface BIND is using (so plus all addrresses assigned to the local host.)

localnets is based on your local interfaces configuration and derived from their addresses and netmasks.

If your server has an interface that is not in private address space but is internet routable then you probably don't want to use "localnets"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.