Forward zone does not work when allow recursive is restrictive

Sebastian Neumann sebastian-n-95 at
Tue Feb 9 21:44:56 UTC 2021

Hey there,

I am having an issue forwarding DNS queries and was hoping, that one of you might be able to help me:

I have the following setup:

DNS-Server reachable from the internet, is authoritative for zone
DNS-Server reachable only locally, should be authoritative for zone
What I try to achieve:

When a DNS query from the outside world reaches the first DNS server for a record belonging to the zone, I want it to make a recursive request to the second DNS server and then forward the records.

I explicitly don't want to do zone transfers or make the second DNS server reachable from the internet.

my configuration looks like this: (I only copied the [what I think] important parts to here, as all the Config would be a few hundret lines (because of split view and many zones)

On the first DNS-Server

options {
allow-recursion {

zone "" {
forward only;
forwarders {
<private IP of second DNS server>;
type forward;

zone "" {
file "/etc/bind/zones/";
type master;
My issue:

When I am in a local network, that is whitelisted in the allow-recursion block, then it works as expected. When I try the DNS lookup from the internet, then i get a NOERROR with an empty response back.

During debugging, I adjusted the allow-recursion list and added any to it. Then it was working. But I don't want my DNS server to allow any kind of recursion. I actually only want "outside" lookups for this one specific zones to be recursive.

How can I set something like allow-recursion for just one zone?

Thanks a lot already

More information about the bind-users mailing list