I am configuring local forwarding-only DNS(bind9) server. Have following configuration:

options {
    directory "/var/cache/bind";

    recursion yes; /* So that server could answer queries about domains its is not authoritative for. */
    allow-query { homeclients; };

    forwarders {;;
    forward only;

    dnssec-enable yes;
    dnssec-validation yes;

    auth-nxdomain no;    # conform to RFC1035
    listen-on port 53 {;;
    listen-on-v6 { any; };

But when I do:

dig @ ubuntu.com +trace

I get:

; (1 server found)
;; global options: +cmd
.           3600000 IN  NS  J.ROOT-SERVERS.NET.
.           3600000 IN  NS  K.ROOT-SERVERS.NET.
;; Received 811 bytes from in 0 ms

ubuntu.com.     3600    IN  A
;; Received 55 bytes from in 1 ms

dig gets its information from local bind instance that should, according to my configuration, forward all queries to Google's DNS servers. But it also asks root servers...

Why forwarding-only DNS server asks 'root' servers? Thanks.


I think you missunderstand the way that dig's trace mode actually works. Looking at dig's man page you get the following information:

  Toggle tracing of the delegation path from the root name servers
  for the name being looked up. Tracing is disabled by default. When
  tracing is enabled, dig makes iterative queries to resolve the name
  being looked up. It will follow referrals from the root servers,
  showing the answer from each server that was used to resolve the

  If @server is also specified, it affects only the initial query for
  the root zone name servers.

Especially the last part makes it clear, that dig +trace @server will ask server about the root name servers, and will then take over and iterate the next level's nameservers itself.

However, I understand your wondering - I had to look it up myself ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.