Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a BIND server on my dedicated box which I want to host a nameserver for my domain on.

When I use dig @ locally on the server I get the following response...

; <<>> DiG 9.8.1-P1 <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43773
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;                        IN      A

;; ANSWER SECTION:         3600    IN      A

;; AUTHORITY SECTION:         3600    IN      NS         3600    IN      NS

;; ADDITIONAL SECTION:     3600    IN      A     3600    IN      A

;; Query time: 0 msec
;; WHEN: Sat Oct 27 15:40:45 2012
;; MSG SIZE  rcvd: 116

Which is good, and is the output I want. But when simply using dig I get...

; <<>> DiG 9.8.1-P1 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16970
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;                        IN      A

;; Query time: 308 msec
;; WHEN: Sat Oct 27 17:09:12 2012
;; MSG SIZE  rcvd: 32

And if I use dig @ on another linux machine I get...

; <<>> DiG 9.7.3 <<>> @
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Am I doing something wrong here? Port 53 is definitely open.


options {
        directory "/var/cache/bind";

        forwarders {

        listen-on {


zone "" {
        type master;
        file "/etc/bind/";


; BIND db file for


@       IN      SOA (
3600 )

        MX      10

@       IN      A
*       IN      A
ns1     IN      A
ns2     IN      A
www     IN      A
mail    IN      A

netstat -tupanl | grep ":53 "

tcp        0      0*               LISTEN      8250/named
tcp        0      0  *               LISTEN      8250/named
udp        0      0*                           8250/named
udp        0      0  *                           8250/named
share|improve this question
Perhaps you have another nameserver or something else already listening on UDP port 53? It works if I query your nameserver via TCP but not via UDP. Check the logs for errors when the nameserver starts up. It is probably not succeeding to bind to its configured address. Also, you probably shouldn't have forwarders in your config but rather recursion no; instead if this is intended to be an authoritative nameserver. – Celada Oct 27 '12 at 14:21
I added netstat of port 53 to the bottom of the question. Everything looks fine there? I'll take a look at the logs and see if anything is wrong there, or else.. could port 53 be blocked for UDP? – FrenchyNZ Oct 27 '12 at 23:04
up vote 2 down vote accepted

After doing a good amount of testing I found that the firewall was still blocking the UDP port. I got the data center to do some more checks and they did a refresh of the firewall rules, which unblocked the port.

Things to note...

nmap -sU [IP] -p 53 was returning open/filtered. After making sure it wasn't anything wrong with my server I concluded there was a problem with the data center firewall.

share|improve this answer
That sounds like the problem I am having! My ISP had problems today with some DoS and once resolved I could not access my name server with UDP. I could use TCP and that worked just fine though proving that our name server is indeed working... – Alexis Wilke Jul 7 '14 at 5:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.