Issues with Stub Zone

[Ben Lavender]

Hi,

I've been trying to configure a stub zone using both BIND 9.8x and 9.9x 
for some split-brain internal DNS.

The problem I have is that any client that requests the NS or SOA 
records for this zone gets SERVFAIL. The BIND server populates the 
/var/named/slaves/benlavender.co.uk.DB file with the SOA and NS records 
straight away and can query them over UDP 53 to the masters if need be.

I've had a look through the logs that are used in this config but the 
only issues I see are in /lame-servers.log shows some IPv6 failures and 
that the client is getting a SERVFAIL back in the /default.log:

05-May-2019 22:58:32.846 client 192.168.1.4#51612 (benlavender.co.uk): 
query failed (SERVFAIL) for benlavender.co.uk/IN/NS at query.c:7038

The config I'm using in /etc/named.conf is:

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about 
the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
         listen-on port 53 { 127.0.0.1; 172.16.4.31;};
         listen-on-v6 port 53 { ::1; };
         directory       "/var/named";
         dump-file       "/var/named/data/cache_dump.db";
         statistics-file "/var/named/data/named_stats.txt";
         memstatistics-file "/var/named/data/named_mem_stats.txt";
         recursing-file  "/var/named/data/named.recursing";
         secroots-file   "/var/named/data/named.secroots";
         allow-query     { localhost; 172.16.4.2; 172.16.4.3; 
192.168.1.4;};

         /*
          - If you are building an AUTHORITATIVE DNS server, do NOT 
enable recursion.
          - If you are building a RECURSIVE (caching) DNS server, you 
need to enable
            recursion.
          - If your recursive DNS server has a public IP address, you 
MUST enable access
            control to limit queries to your legitimate users. Failing 
to do so will
            cause your server to become part of large scale DNS 
amplification
            attacks. Implementing BCP38 within your network would greatly
            reduce such attack surface
         */
         recursion yes;

         dnssec-enable yes;
         dnssec-validation yes;

         /* Path to ISC DLV key */
         bindkeys-file "/etc/named.iscdlv.key";

         managed-keys-directory "/var/named/dynamic";

         pid-file "/run/named/named.pid";
         session-keyfile "/run/named/session.key";
};

logging {
     channel default_file {
         file "/var/named/default.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel general_file {
         file "/var/named/general.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel database_file {
         file "/var/named/database.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel security_file {
         file "/var/named/security.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel config_file {
         file "/var/named/config.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel resolver_file {
         file "/var/named/resolver.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel xfer-in_file {
         file "/var/named/xfer-in.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel xfer-out_file {
         file "/var/named/xfer-out.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel notify_file {
         file "/var/named/notify.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel client_file {
         file "/var/named/client.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel unmatched_file {
         file "/var/named/unmatched.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel queries_file {
         file "/var/named/queries.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel network_file {
         file "/var/named/network.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel update_file {
         file "/var/named/update.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel dispatch_file {
         file "/var/named/dispatch.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel dnssec_file {
         file "/var/named/dnssec.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };
     channel lame-servers_file {
         file "/var/named/lame-servers.log" versions 3 size 5m;
         severity debug;
         print-time yes;
     };

     category default { default_file; };
     category general { general_file; };
     category database { database_file; };
     category security { security_file; };
     category config { config_file; };
     category resolver { resolver_file; };
     category xfer-in { xfer-in_file; };
     category xfer-out { xfer-out_file; };
     category notify { notify_file; };
     category client { client_file; };
     category unmatched { unmatched_file; };
     category queries { queries_file; };
     category network { network_file; };
     category update { update_file; };
     category dispatch { dispatch_file; };
     category dnssec { dnssec_file; };
     category lame-servers { lame-servers_file; };
};

zone "." IN {
         type hint;
         file "named.ca";
};

zone benlavender.co.uk IN {
         type stub;
         masters {172.16.4.2; 172.16.4.3;};
         file "slaves/benlavender.co.uk.SEC";
         multi-master yes;
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";