<div dir="ltr">
<div dir="ltr"><div><font size="2"><span style="font-family:arial,sans-serif">Hello,<br>I have a Bind server running for a private Samba AD. </span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">The server is used exclusively for internal name resolution, </span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">an Adguard container is used for requests to the WAN.<br><br>To enable this, forwarding is disabled on the Bind DNS (primary DNS).<br>Unfortunately, I have noticed that the Bind DNS has been forwarding for some time now, </span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">even though this is disabled in the configuration.<br><br>BIND version: BIND 9.18.30-0ubuntu0.24.04.2-Ubuntu (Extended Support Version)<br><br><u>named.conf.options:</u></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">...<br>options {<br> directory “/var/cache/bind”;<br> notify no;<br> empty-zones-enable no;<br> auth-nxdomain yes;<br><br> forward only;<br> forwarders {<br># 1.1.1.1;<br># 1.0.0.1;<br># 9.9.9.9;<br># 149.112.112.112;<br># 2606:4700:4700::1111;<br># 2606:4700:4700::1001;<br># 2620:fe::fe;<br># 2620:fe::9;<br> };<br>...<br></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><br></span></font></div><div><u>named.conf.default-zones:</u></div><div><font size="2"><span style="font-family:arial,sans-serif">// prime the server with knowledge of the root servers<br>#zone "." {<br># type hint;<br># file "/usr/share/dns/root.hints";<br>#};<br><br>// be authoritative for the localhost forward and reverse zones, and for<br>// broadcast zones as per RFC 1912<br><br>zone "localhost" {<br> type master;<br> file "/etc/bind/db.local";<br>};<br><br>zone "127.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.127";<br>};<br><br>zone "0.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.0";<br>};<br><br>zone "255.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.255";<br>};</span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><br></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><u>Log:</u></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">Sep 02 19:03:15 routerpi systemd[1]: Starting named.service - BIND Domain Name Server...<br>Sep 02 19:03:16 routerpi named[153686]: starting BIND 9.18.30-0ubuntu0.24.04.2-Ubuntu (Extended Support Version) <id:><br>Sep
02 19:03:16 routerpi named[153686]: running on Linux aarch64
6.8.0-1036-raspi #40-Ubuntu SMP PREEMPT_DYNAMIC Mon Aug 18 09:50:42 UTC
2025<br>Sep 02 19:03:16 routerpi named[153686]: built with '--build=aarch64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/ma><br>Sep 02 19:03:16 routerpi named[153686]: running as: named -f -u bind -n 1<br>Sep 02 19:03:16 routerpi named[153686]: compiled by GCC 13.3.0<br>Sep 02 19:03:16 routerpi named[153686]: compiled with OpenSSL version: OpenSSL 3.0.13 30 Jan 2024<br>Sep 02 19:03:16 routerpi named[153686]: linked to OpenSSL version: OpenSSL 3.0.13 30 Jan 2024<br>Sep 02 19:03:16 routerpi named[153686]: compiled with libuv version: 1.48.0<br>Sep 02 19:03:16 routerpi named[153686]: linked to libuv version: 1.48.0<br>Sep 02 19:03:16 routerpi named[153686]: compiled with libxml2 version: 2.9.14<br>Sep 02 19:03:16 routerpi named[153686]: linked to libxml2 version: 20914<br>Sep 02 19:03:16 routerpi named[153686]: compiled with json-c version: 0.17<br>Sep 02 19:03:16 routerpi named[153686]: linked to json-c version: 0.17<br>Sep 02 19:03:16 routerpi named[153686]: compiled with zlib version: 1.3<br>Sep 02 19:03:16 routerpi named[153686]: linked to zlib version: 1.3<br>Sep 02 19:03:16 routerpi named[153686]: ----------------------------------------------------<br>Sep 02 19:03:16 routerpi named[153686]: BIND 9 is maintained by Internet Systems Consortium,<br>Sep 02 19:03:16 routerpi named[153686]: Inc. (ISC), a non-profit 501(c)(3) public-benefit<br>Sep 02 19:03:16 routerpi named[153686]: corporation. Support and training for BIND 9 are<br>Sep 02 19:03:16 routerpi named[153686]: available at <a href="https://www.isc.org/support" target="_blank">https://www.isc.org/support</a><br>Sep 02 19:03:16 routerpi named[153686]: ----------------------------------------------------<br>Sep 02 19:03:16 routerpi named[153686]: adjusted limit on open files from 524288 to 1048576<br>Sep 02 19:03:16 routerpi named[153686]: found 4 CPUs, using 1 worker thread<br>Sep 02 19:03:16 routerpi named[153686]: using 1 UDP listener per interface<br>Sep
02 19:03:16 routerpi named[153686]: DNSSEC algorithms: RSASHA1
NSEC3RSASHA1 RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519
ED448<br>Sep 02 19:03:16 routerpi named[153686]: DS algorithms: SHA-1 SHA-256 SHA-384<br>Sep 02 19:03:16 routerpi named[153686]: HMAC algorithms: HMAC-MD5 HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 HMAC-SHA384 HMAC-SHA512<br>Sep 02 19:03:16 routerpi named[153686]: TKEY mode 2 support (Diffie-Hellman): yes<br>Sep 02 19:03:16 routerpi named[153686]: TKEY mode 3 support (GSS-API): yes<br>Sep 02 19:03:16 routerpi named[153686]: the initial working directory is '/'<br>Sep 02 19:03:16 routerpi named[153686]: loading configuration from '/etc/bind/named.conf'<br>Sep 02 19:03:16 routerpi named[153686]: the working directory is now '/var/cache/bind'<br>Sep 02 19:03:16 routerpi named[153686]: reading built-in trust anchors from file '/etc/bind/bind.keys'<br>Sep 02 19:03:16 routerpi named[153686]: looking for GeoIP2 databases in '/usr/share/GeoIP'<br>Sep 02 19:03:16 routerpi named[153686]: using default UDP/IPv4 port range: [32768, 60999]<br>Sep 02 19:03:16 routerpi named[153686]: using default UDP/IPv6 port range: [32768, 60999]<br>Sep 02 19:03:16 routerpi named[153686]: listening on IPv4 interface lo, 127.0.0.1#53</span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">...</span></font></div><div><font size="2"><span style="font-family:arial,sans-serif">Sep 02 19:03:16 routerpi named[153686]: generating session key for dynamic DNS<br>Sep 02 19:03:16 routerpi named[153686]: sizing zone task pool based on 4 zones<br>Sep 02 19:03:16 routerpi named[153686]: Loading 'AD DNS Zone' using driver dlopen<br>Sep 02 19:03:16 routerpi named[153686]: samba_dlz: started for DN ...<br>Sep 02 19:03:16 routerpi named[153686]: samba_dlz: starting configure<br>...<br>Sep 02 19:03:16 routerpi named[153686]: none:99: 'max-cache-size 90%' - setting to 3405MB (out of 3784MB)<br>Sep 02 19:03:16 routerpi named[153686]: /etc/bind/named.conf.options:34: no forwarders seen; disabling forwarding<br>Sep 02 19:03:16 routerpi named[153686]: set up managed keys zone for view _default, file 'managed-keys.bind'<br>Sep 02 19:03:16 routerpi named[153686]: /etc/bind/named.conf.options:34: no forwarders seen; disabling forwarding<br>Sep 02 19:03:16 routerpi named[153686]: configuring command channel from '/etc/bind/rndc.key'<br>Sep 02 19:03:16 routerpi named[153686]: command channel listening on 127.0.0.1#953<br>Sep 02 19:03:16 routerpi named[153686]: configuring command channel from '/etc/bind/rndc.key'<br>Sep 02 19:03:16 routerpi named[153686]: command channel listening on ::1#953<br>Sep 02 19:03:16 routerpi systemd[1]: Started named.service - BIND Domain Name Server.<br></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><br></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><u>netstat -tulpen | grep named:</u><br>...<br>tcp 0 0 <a href="http://127.0.0.1:53" target="_blank">127.0.0.1:53</a> 0.0.0.0:* LISTEN 114 526776 153686/named<br>tcp 0 0 <a href="http://127.0.0.1:953" target="_blank">127.0.0.1:953</a> 0.0.0.0:* LISTEN 114 526829 153686/named<br>...<br>tcp6 0 0 ::1:953 :::* LISTEN 114 526830 153686/named<br>tcp6 0 0 ::1:53 :::* LISTEN 114 526804 153686/named<br>...<br>udp 0 0 <a href="http://127.0.0.1:53" target="_blank">127.0.0.1:53</a> 0.0.0.0:* 114 526775 153686/named<br>udp6 0 0 ::1:53 :::* 114 526803 153686/named<br>...<br></span></font></div><div><u><font size="2"><span style="font-family:arial,sans-serif"><br></span></font></u></div><div><font size="2"><span style="font-family:arial,sans-serif"><u>nslookup <a href="http://google.com" target="_blank">google.com</a>:</u><br>Server: 127.0.0.1<br>Address: 127.0.0.1#53<br><br>Non-authoritative answer:<br>Name: <a href="http://google.com" target="_blank">google.com</a><br>Address: 142.251.36.174<br>Name: <a href="http://google.com" target="_blank">google.com</a><br>Address: 2a00:1450:4016:808::200e</span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><br></span></font></div><div><font size="2"><span style="font-family:arial,sans-serif"><u>resolve.conf:</u></span></font></div><div># operation for /etc/resolv.conf.<br><br>nameserver 127.0.0.1<br>nameserver 10.13.1.4<br>nameserver 1.1.1.1<br>nameserver ::1<br>nameserver fdda:9280:731e:1:0:4::1<br>nameserver 2606:4700:4700::1111</div></div>
<br></div>