I spent many hours to fix my problem but I did not get it done what I needed to fix this issue.I assume may be some problem with file permission.I changed I wanted to verify the zone transfer from master server using this command:

dig ns.insec -t axfr

Here is an error message from the master server

Mar 16 03:49:30 ip-172-31-22-11 named[5395]: client    
    (ns.insec): zone transfer 'ns.insec/AXFR/IN' denied

Here is the named.conf.options file:

acl "trusted" {

options {
    directory "/var/cache/bind";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

     forwarders {;

    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    dnssec-validation auto;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
    forward only;
    allow-query-cache { trusted; };
    allow-query { trusted; };
    allow-recursion { trusted; };
    recursion yes;
    allow-transfer {;; };
    //also-notify { trusted; };

Here is my named.conf.local file:

// Do any local configuration here

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "ns.insec" {
    type master;
    file "/etc/bind/zones/db.ns.insec";
    allow-transfer {; };
    also-notify {; };

// is the IP for slave 
// is the IP for the master
zone "22.31.172.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.172.31.22";
    allow-transfer {; };
    also-notify {; };


Here is a snapshot of the file permission from master server and is also same for slave server:

enter image description here

N:B I can dig ns.insec -t axfr from the slave and it works but not from master server

  • The zonal allow-transfer {; }; has overwritten the global allow-transfer declaration..use allow-transfer {;; }; in zone "ns.insec" definition too.. – heemayl Mar 16 '16 at 4:24
  • +1 for this quick answer.I am gonna upvote you deserve it @heemayl – bhordupur Mar 16 '16 at 4:31
  • Glad i could help.. – heemayl Mar 16 '16 at 4:50

The global declaration of any option (in options) can be overwritten by a local declaration (e.g. in zone, view) of the same option.

The same is happening in your case too.

You have a global option allow-transfer {;; }; which is overwritten by the declaration in the zone definition zone "ns.insec" as allow-transfer {; };. So you won't be able to transfer the zone to localhost.

To solve this, make the declaration in zone "ns.insec" as

allow-transfer {;; };

Or if you want to use the global one (which is not a good idea always), remove the allow-transfer directive from zone "ns.insec" definition.

  • I am implementing this in my home network so If I swap the role from master to slave[ this machine should work [ as primary server for ns.insecand slave server for not.insec] in one machine and in the other machine slave to master[primary server for not.insec and slave server for ns.insec]. Here comes the same problem zone transfer permission denied.But according to your advice I configured that but it works one way from machine 1 but but machine 2 can not transfer the zone file.Could someone advice me to fix this issue. – bhordupur Mar 16 '16 at 14:34
  • @bhordupur zone can be transferred from master to slave..did you change the declarations that which one is zone master and which one is slave? Also you can push update to master to implement DDNS, check allow_update directive.. – heemayl Mar 16 '16 at 14:38
  • Yes , I swap the configuration file and they are declared properly. But now i can dig ns.insec -t axfr ** and **dig not.insec -t axfr ** from the machine 1 and it is transfering the zone file but machine two can dig but can not transfer the zone file.Ok I add **allow-update now – bhordupur Mar 16 '16 at 14:40
  • @bhordupur Hard to say without looking the configurations..perhaps you should ask a new question with details.. – heemayl Mar 16 '16 at 14:41
  • Alright.I am gonna put a question in few minutes.I really appreciate your effort. – bhordupur Mar 16 '16 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.