Use BIND 9 as a caching resolver when it should follow the DNS hierarchy itself, or configure forwarders when another resolver must handle upstream lookups. In both designs, enable recursion only for a narrowly defined client ACL. A safe deployment therefore has three parts: a role-specific options block, explicit recursion and cache permissions, and validation from both an allowed and a denied client.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide shows direct recursion, global forwarding with forward first or forward only, and selective forwarding for one domain. File locations and service names differ between operating systems and BIND packages, so treat the paths as examples and check the documentation for the BIND release you installed.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What a caching and forwarding resolver actually does
A caching resolver performs recursive lookups and stores the answers it receives. Each resource record remains usable until its authoritative time to live (TTL) expires; a later client query can then be answered from cache without repeating the entire lookup. The BIND 9 Administrator Reference Manual describes recursion and caching as closely connected processes, which is why the terms recursive server and caching server are often used interchangeably.
Forwarding is a decision made only for a query that is neither answered authoritatively by the local server nor already present in its cache. BIND sends that eligible query to configured upstream resolvers instead of starting at the root servers. The cache still matters: a forwarding resolver caches replies, so repeated requests can be answered locally while the cached TTL is valid.
These roles are separate from authoritative DNS service. One BIND instance can host authoritative zones and provide recursion, but the access policy for recursive service must not be treated as permission to alter or expose authoritative data.
Choose the resolution model before editing named.conf
| Choice | Upstream dependency | Failure behavior | Typical use |
|---|---|---|---|
| Direct caching and recursion | The root and authoritative DNS hierarchy | Can continue when a particular forwarder is unavailable, subject to network reachability | An independent resolver for a trusted LAN |
forward first |
Configured forwarders are preferred | Falls back to direct recursion when forwarders fail | Central policy with a resilience path |
forward only |
Configured forwarders are mandatory | Returns failure when the forwarders cannot answer | Restricted networks or centralized filtering |
| Selective forward zone | Forwarders apply only to named domains | Failure is limited to the forwarded namespace | Split DNS and internal namespaces |
When a forwarders list is configured, forward first is the documented default in the BIND configuration reference; verify that behavior against the release supplied by your operating system. Use forward only when bypassing the upstream policy would be unacceptable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prepare the host and define the trust boundary
Identify the BIND release and package layout
Distribution packages place named.conf, included zone files, the working directory, and the service unit in different locations. Record the installed BIND 9 version, the operating system, the address clients will query, and the address on which named listens. Do not copy a directory such as /var/cache/bind blindly if your package uses another path; the account running named must be able to read and write the configured working directory.
List permitted clients and upstreams
Write down the management, server, or LAN networks that should receive recursive service. Keep this list as small as the deployment allows. Also identify the IP addresses of approved upstream resolvers if you will forward. The forwarders statement takes IP addresses; it is not a list of hostnames to be resolved at startup.
Make network controls agree
Host-firewall rules should allow DNS traffic only from the same trusted networks, and should permit the resolver to reach its intended upstream servers. An ACL in BIND is not a substitute for a firewall. Never publish recursive service to the public Internet or use allow-recursion { any; }; on an Internet-facing server.
Define a trusted client ACL
Place an ACL near the top of the configuration and replace the illustrative private ranges with the actual networks that need recursion:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchacl "trusted_clients" {
127.0.0.1;
10.0.0.0/8;
192.168.0.0/16;
};The example includes broad private ranges only to show syntax. A production ACL should normally contain the narrower subnets used by your clients. Include IPv6 networks explicitly when IPv6 clients are expected; otherwise they may follow a different access path than IPv4 clients.
How BIND evaluates recursive access
BIND evaluates allow-recursion, allow-query-cache, and allow-query according to its documented precedence. Configure all three explicitly when the server is intended to be a private resolver:
allow-querycontrols which clients may send queries to the server.allow-recursioncontrols which clients may ask BIND to perform recursive work.allow-query-cachecontrols which clients may use cached answers.
A client permitted to recurse can use any address on which named is listening, so listening on a public interface while relying only on a loosely written ACL can expose the resolver. Test the effective policy from an address outside the ACL rather than assuming that an internal interface makes the service private.
Configure BIND as a direct caching resolver
For a resolver that walks the DNS hierarchy itself, omit forwarders and set recursion and cache access to the trusted ACL:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteoptions {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
// No forwarders: resolve through the DNS hierarchy.
};The directory value is a role pattern, not a universal package path. Keep any authoritative zone declarations required by your installation; the options above describe the recursive and caching behavior, not the complete configuration file.
What happens to a query in this mode
- BIND checks whether the request is allowed by the query and recursion policies.
- It answers from an authoritative local zone when one matches.
- If no authoritative answer applies, it checks the cache. A still-valid cached record is returned without a new upstream lookup.
- For a cache miss, BIND performs recursion through the DNS hierarchy, stores eligible responses according to their TTLs, and returns the result to the client.
This arrangement removes dependence on a particular forwarding provider, but it requires the host to reach the DNS hierarchy and to operate correctly when firewalls or upstream network policies restrict DNS traffic.
Rank #3
Configure a resolver that forwards globally
Add an IP list of upstream resolvers and choose a failure policy:
options {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
forwarders {
192.0.2.53;
192.0.2.54;
};
forward first;
};Use upstream addresses appropriate to your site; the documentation addresses above are reserved examples. BIND forwards only non-authoritative, non-cached queries. Responses received through forwarding are cached along with responses obtained through direct recursion.
forward first: prefer forwarding, retain a fallback
With forward first, BIND tries the listed forwarders first. If they do not answer, it can continue with normal recursive resolution. This is useful when a site wants central filtering, logging, or policy in normal operation but still needs a path around a forwarder outage.
forward only: enforce the upstream path
Change the final line to forward only; when every eligible query must use the listed servers:
forward only;If those forwarders cannot answer, BIND does not bypass them by contacting the DNS hierarchy. The client receives a failure instead. That behavior is often preferable in restricted networks where policy, split-horizon answers, or centralized inspection must not be circumvented, but it makes upstream availability a hard dependency.
Forwarder order is not a fixed round-robin
The order in which addresses appear in forwarders does not guarantee query order. BIND learns response performance from previous queries and selects the server it expects to answer most quickly. Reordering the lines is therefore not a reliable load-balancing mechanism; evaluate the upstreams and monitor the behavior of your own workload instead.
Recommended Free Tools
Rank #4
Forward only one namespace with a forward zone
A zone block of type forward applies forwarding to a selected domain while the global options continue to govern other names. This is the usual pattern for an internal namespace or split-DNS design:
zone "corp.example" {
type forward;
forward only;
forwarders { 10.20.0.53; 10.20.0.54; };
};Queries below corp.example use those internal servers and the specified failure policy. Public names follow the global resolver policy. You can use forward first in the zone when a direct-recursion fallback is acceptable for that namespace, but consider whether leaking an internal name to the public hierarchy would violate your design.
Understand the complete query path
Thinking in terms of the decision order makes configuration errors easier to diagnose:
- Client authorization: BIND evaluates the query, cache, and recursion access controls.
- Authoritative match: A local authoritative zone answers its names; forwarding is not used for those authoritative queries.
- Cache lookup: A valid cached record is returned. Forwarding is not used when the answer is already cached.
- Forward-zone match: A matching
zone "..." { type forward; }policy sends the miss to its own forwarders. - Global forwarding: If global forwarders exist, BIND applies
forward firstorforward only. - Direct recursion: If no forwarding policy applies, or if
forward firstpermits fallback after an unsuccessful attempt, BIND resolves through the DNS hierarchy. - Cache insertion: BIND stores eligible results for their TTL, so subsequent requests can avoid upstream work.
This order explains why changing forwarders may appear to have no effect during testing: an authoritative answer or an unexpired cache entry is intentionally handled before forwarding.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Validate, reload, and test safely
1. Check syntax before touching the running service
Run the configuration checker supplied by your package, commonly:
sudo named-checkconf /etc/bind/named.confUse the actual path on your system. Fix syntax, include-file, ACL, or permission errors before reloading.
Best Value
2. Reload through the operating system
Use the service manager for your distribution, then inspect BIND’s logs for parse, permission, or startup errors. A typical systemd installation uses:
sudo systemctl reload bind9Some packages use a different unit name or require a restart when a reload action is unavailable. A successful command does not prove that clients can recurse; continue with queries from both sides of the ACL.
3. Query from an allowed client
Use dig against the resolver’s address:
dig @192.0.2.10 www.example.net ACheck the response status, the answer section, and the SERVER line. Repeat the same query. The second request should be eligible for a cache hit while the returned TTL has not expired, although timing and cache state depend on the record and the resolver’s history.
4. Exercise forwarding and recursion policy
Query a delegated or external name that is not already cached. With global forwarding, verify that the resolver follows the selected forward first or forward only behavior. For a selective forward zone, query both a name inside the forwarded namespace and a public name outside it.
5. Prove that the server is not an open resolver
Repeat the query from a host outside trusted_clients. The expected result is a refusal or another policy-denied response, not a recursive answer. Test every reachable interface and address family that the host exposes, and make sure firewall rules produce the same boundary as the BIND ACL.
Troubleshoot by symptom
The client receives REFUSED
- Confirm the source address actually belongs to
trusted_clients; NAT, VPN, and container networks often change the address BIND sees. - Check that
allow-query,allow-recursion, andallow-query-cacheare not overridden in an included file or a more specific zone policy. - Verify that the client is querying an address on which
namedlistens and that the host firewall permits the request.
The client receives SERVFAIL with forward only
- Confirm that each forwarder IP is reachable on the required transport and port.
- Query the forwarder directly with
digto distinguish an upstream failure from a local configuration problem. - Inspect BIND logs for timeout, response-validation, or permission errors.
- If bypassing the forwarders is allowed by policy, change to
forward first; otherwise repair or replace the upstream path rather than expecting direct recursion.
Queries appear not to use the forwarders
- Check whether the name is authoritative locally or already cached; forwarding is deliberately skipped in both cases.
- Check for a more specific forward zone that sends the name to a different upstream.
- Confirm that the running process was actually reloaded and that the edited file is the one included by the service.
Reload fails after an edit
- Run
named-checkconfand read the exact line and included-file error. - Check braces, semicolons, ACL names, and the spelling of
forward first,forward only, andforwarders. - Verify that the
namedaccount can read configuration files and access the configured working directory.
Operate the resolver without losing the security boundary
Keep recursive service restricted even if the same BIND process serves authoritative zones. Review ACL membership when networks, VPNs, or container ranges change. Retest from an excluded network after firewall or interface changes, because adding a listening address can create a new path to the resolver.
Measure cache-hit behavior, upstream latency, and failure rates in your own environment rather than applying a generic performance percentage. Caching reduces repeated upstream work, while forwarding centralizes policy; the practical result depends on TTLs, query mix, network reachability, and the reliability of the selected forwarders.
Document whether each deployment uses direct recursion, forward first, forward only, or a selective forward zone. Record the BIND release and operating system alongside the configuration so that future package upgrades can be checked for changed defaults, file paths, or service behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
