Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

DNS-only problem with answering queries

Discussion in 'Bind/DNS/Nameserver' started by leohds, Feb 20, 2013.

  1. leohds

    leohds Registered

    Feb 20, 2013
    Likes Received:
    Trophy Points:
    cPanel Access Level:
    Root Administrator
    Hi all, I have a problem with cPanel DNS-only.
    I have a cPanel web server and other DNS-only server, the web server is enabled dns clustering (Synchronize changes), in dnsonly srevidor creates zone files in /var/named, but dig is not responding.

    dig @ dnsonlyip
    , (1 server found)
    ;; Global options: + cmd
    ;; Connection timed out, no servers Could be Reached

    tail-f / var / log / messages
    client # 32954: view external: query (cache) ' / A / IN' denied

    the named.conf is default.
    include "/etc/rndc.key";
    controls {
            inet allow { localhost; } keys { "rndc-key"; };
    options {
        /* make named use port 53 for the source of all queries, to allow
             * firewalls to block all ports except 53:
        // query-source    port 53;
        /* We no longer enable this by default as the dns posion exploit
            has forced many providers to open up their firewalls a bit */
        // Put files that named is allowed to write in the data/ directory:
        directory                "/var/named"; // the default
        pid-file                 "/var/run/named/";
        dump-file                "data/cache_dump.db";
        statistics-file          "data/named_stats.txt";
       /* memstatistics-file     "data/named_mem_stats.txt"; */
        allow-transfer {"none";};
            recursion no; 
    logging {
    /*      If you want to enable debugging, eg. using the 'rndc trace' command,
     *      named will try to write the '' file in the $directory (/var/named").
     *      By default, SELinux policy does not allow named to modify the /var/named" directory,
     *      so put the default debug log file in data/ :
        channel default_debug {
                file "data/";
                severity dynamic;
    // All BIND 9 zones are in a "view", which allow different zones to be served
    // to different types of client addresses, and for options to be set for groups
    // of zones.
    // By default, if named.conf contains no "view" clauses, all zones are in the
    // "default" view, which matches all clients.
    // If named.conf contains any "view" clause, then all zones MUST be in a view;
    // so it is recommended to start off using views to avoid having to restructure
    // your configuration files in the future.
    view "localhost_resolver" {
    /* This view sets up named to be a localhost resolver ( caching only nameserver ).
     * If all you want is a caching-only nameserver, then you need only define this view:
        match-clients         {; };
        match-destinations    { localhost; };
        recursion yes;
        zone "." IN {
            type hint;
            file "/var/named/";
        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * ONLY be served to localhost clients:
        include "/var/named/named.rfc1912.zones";
    view "internal" {
    /* This view will contain zones you want to serve only to "internal" clients
       that connect via your directly attached LAN interfaces - "localnets" .
        match-clients        { localnets; };
        match-destinations    { localnets; };
        recursion yes;
        zone "." IN {
            type hint;
            file "/var/named/";
        // include "/var/named/named.rfc1912.zones";
        // you should not serve your rfc1912 names to non-localhost clients.
        // These are your "authoritative" internal zones, and would probably
        // also be included in the "localhost_resolver" view above :
    view    "external" {
    /* This view will contain zones you want to serve only to "external" clients
     * that have addresses that are not on your directly attached LAN interface subnets:
             recursion no;
        // you'd probably want to deny recursion to external clients, so you don't
        // end up providing free DNS service to all takers
        // all views must contain the root hints zone:
        zone "." IN {
            type hint;
            file "/var/named/";
        // These are your "authoritative" external zones, and would probably
        // contain entries for just your web and mail servers:
        // BEGIN external zone entries


Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice