<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">You still have the "forward only;" and "forwarders" statements. Would commenting those out make a difference?<div><br id="lineBreakAtBeginningOfMessage"><div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br>Best regards <br>Sten Carlsen</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">Don't be impressed with unintelligible stuff said condescendingly .<br> -- Radia Perlman.</div>
</div>
<div><br><blockquote type="cite"><div>On 2 Sep 2025, at 20.12, Ondřej Surý <ondrej@isc.org> wrote:</div><br class="Apple-interchange-newline"><div><div>https://bind9.readthedocs.io/en/v9.20.12/reference.html#namedconf-statement-forwarders<br><br><blockquote type="cite">The default is the empty list (no forwarding).<br></blockquote><br>^^^ you've effectively disabled forwarding.<br><br>You haven't described precisely what are you trying to achieve, but you probably want to disable recursion?<br><br>https://bind9.readthedocs.io/en/v9.20.12/reference.html#namedconf-statement-recursion<br><br>However, please note this:<br><br><blockquote type="cite">Caching may still occur as an effect of the server’s internal operation, such as NOTIFY address lookups.<br></blockquote><br>The server might need to resolve some names internally, so perhaps a solution would be to actually configure the forwarders to point to your AdGuard container?<br><br>Cheers,<br>Ondrej<br>--<br>Ondřej Surý (He/Him)<br>ondrej@isc.org<br><br>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.<br><br><blockquote type="cite">On 2. 9. 2025, at 19:43, Sascha Marcel Hacker via bind-users <bind-users@lists.isc.org> wrote:<br><br>Hello,<br>I have a Bind server running for a private Samba AD. <br>The server is used exclusively for internal name resolution, <br>an Adguard container is used for requests to the WAN.<br><br>To enable this, forwarding is disabled on the Bind DNS (primary DNS).<br>Unfortunately, I have noticed that the Bind DNS has been forwarding for some time now, <br>even though this is disabled in the configuration.<br><br>BIND version: BIND 9.18.30-0ubuntu0.24.04.2-Ubuntu (Extended Support Version)<br><br>named.conf.options:<br>...<br>options {<br> directory “/var/cache/bind”;<br> notify no;<br> empty-zones-enable no;<br> auth-nxdomain yes;<br><br> forward only;<br> forwarders {<br># 1.1.1.1;<br># 1.0.0.1;<br># 9.9.9.9;<br># 149.112.112.112;<br># 2606:4700:4700::1111;<br># 2606:4700:4700::1001;<br># 2620:fe::fe;<br># 2620:fe::9;<br> };<br>...<br><br>named.conf.default-zones:<br>// prime the server with knowledge of the root servers<br>#zone "." {<br># type hint;<br># file "/usr/share/dns/root.hints";<br>#};<br><br>// be authoritative for the localhost forward and reverse zones, and for<br>// broadcast zones as per RFC 1912<br><br>zone "localhost" {<br> type master;<br> file "/etc/bind/db.local";<br>};<br><br>zone "127.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.127";<br>};<br><br>zone "0.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.0";<br>};<br><br>zone "255.in-addr.arpa" {<br> type master;<br> file "/etc/bind/db.255";<br>};<br><br>Log:<br>Sep 02 19:03:15 routerpi systemd[1]: Starting named.service - BIND Domain Name Server...<br>Sep 02 19:03:16 routerpi named[153686]: starting BIND 9.18.30-0ubuntu0.24.04.2-Ubuntu (Extended Support Version) <id:><br>Sep 02 19:03:16 routerpi named[153686]: running on Linux aarch64 6.8.0-1036-raspi #40-Ubuntu SMP PREEMPT_DYNAMIC Mon Aug 18 09:50:42 UTC 2025<br>Sep 02 19:03:16 routerpi named[153686]: built with '--build=aarch64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/ma><br>Sep 02 19:03:16 routerpi named[153686]: running as: named -f -u bind -n 1<br>Sep 02 19:03:16 routerpi named[153686]: compiled by GCC 13.3.0<br>Sep 02 19:03:16 routerpi named[153686]: compiled with OpenSSL version: OpenSSL 3.0.13 30 Jan 2024<br>Sep 02 19:03:16 routerpi named[153686]: linked to OpenSSL version: OpenSSL 3.0.13 30 Jan 2024<br>Sep 02 19:03:16 routerpi named[153686]: compiled with libuv version: 1.48.0<br>Sep 02 19:03:16 routerpi named[153686]: linked to libuv version: 1.48.0<br>Sep 02 19:03:16 routerpi named[153686]: compiled with libxml2 version: 2.9.14<br>Sep 02 19:03:16 routerpi named[153686]: linked to libxml2 version: 20914<br>Sep 02 19:03:16 routerpi named[153686]: compiled with json-c version: 0.17<br>Sep 02 19:03:16 routerpi named[153686]: linked to json-c version: 0.17<br>Sep 02 19:03:16 routerpi named[153686]: compiled with zlib version: 1.3<br>Sep 02 19:03:16 routerpi named[153686]: linked to zlib version: 1.3<br>Sep 02 19:03:16 routerpi named[153686]: ----------------------------------------------------<br>Sep 02 19:03:16 routerpi named[153686]: BIND 9 is maintained by Internet Systems Consortium,<br>Sep 02 19:03:16 routerpi named[153686]: Inc. (ISC), a non-profit 501(c)(3) public-benefit<br>Sep 02 19:03:16 routerpi named[153686]: corporation. Support and training for BIND 9 are<br>Sep 02 19:03:16 routerpi named[153686]: available at https://www.isc.org/support<br>Sep 02 19:03:16 routerpi named[153686]: ----------------------------------------------------<br>Sep 02 19:03:16 routerpi named[153686]: adjusted limit on open files from 524288 to 1048576<br>Sep 02 19:03:16 routerpi named[153686]: found 4 CPUs, using 1 worker thread<br>Sep 02 19:03:16 routerpi named[153686]: using 1 UDP listener per interface<br>Sep 02 19:03:16 routerpi named[153686]: DNSSEC algorithms: RSASHA1 NSEC3RSASHA1 RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448<br>Sep 02 19:03:16 routerpi named[153686]: DS algorithms: SHA-1 SHA-256 SHA-384<br>Sep 02 19:03:16 routerpi named[153686]: HMAC algorithms: HMAC-MD5 HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 HMAC-SHA384 HMAC-SHA512<br>Sep 02 19:03:16 routerpi named[153686]: TKEY mode 2 support (Diffie-Hellman): yes<br>Sep 02 19:03:16 routerpi named[153686]: TKEY mode 3 support (GSS-API): yes<br>Sep 02 19:03:16 routerpi named[153686]: the initial working directory is '/'<br>Sep 02 19:03:16 routerpi named[153686]: loading configuration from '/etc/bind/named.conf'<br>Sep 02 19:03:16 routerpi named[153686]: the working directory is now '/var/cache/bind'<br>Sep 02 19:03:16 routerpi named[153686]: reading built-in trust anchors from file '/etc/bind/bind.keys'<br>Sep 02 19:03:16 routerpi named[153686]: looking for GeoIP2 databases in '/usr/share/GeoIP'<br>Sep 02 19:03:16 routerpi named[153686]: using default UDP/IPv4 port range: [32768, 60999]<br>Sep 02 19:03:16 routerpi named[153686]: using default UDP/IPv6 port range: [32768, 60999]<br>Sep 02 19:03:16 routerpi named[153686]: listening on IPv4 interface lo, 127.0.0.1#53<br>...<br>Sep 02 19:03:16 routerpi named[153686]: generating session key for dynamic DNS<br>Sep 02 19:03:16 routerpi named[153686]: sizing zone task pool based on 4 zones<br>Sep 02 19:03:16 routerpi named[153686]: Loading 'AD DNS Zone' using driver dlopen<br>Sep 02 19:03:16 routerpi named[153686]: samba_dlz: started for DN ...<br>Sep 02 19:03:16 routerpi named[153686]: samba_dlz: starting configure<br>...<br>Sep 02 19:03:16 routerpi named[153686]: none:99: 'max-cache-size 90%' - setting to 3405MB (out of 3784MB)<br>Sep 02 19:03:16 routerpi named[153686]: /etc/bind/named.conf.options:34: no forwarders seen; disabling forwarding<br>Sep 02 19:03:16 routerpi named[153686]: set up managed keys zone for view _default, file 'managed-keys.bind'<br>Sep 02 19:03:16 routerpi named[153686]: /etc/bind/named.conf.options:34: no forwarders seen; disabling forwarding<br>Sep 02 19:03:16 routerpi named[153686]: configuring command channel from '/etc/bind/rndc.key'<br>Sep 02 19:03:16 routerpi named[153686]: command channel listening on 127.0.0.1#953<br>Sep 02 19:03:16 routerpi named[153686]: configuring command channel from '/etc/bind/rndc.key'<br>Sep 02 19:03:16 routerpi named[153686]: command channel listening on ::1#953<br>Sep 02 19:03:16 routerpi systemd[1]: Started named.service - BIND Domain Name Server.<br><br>netstat -tulpen | grep named:<br>...<br>tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 114 526776 153686/named<br>tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 114 526829 153686/named<br>...<br>tcp6 0 0 ::1:953 :::* LISTEN 114 526830 153686/named<br>tcp6 0 0 ::1:53 :::* LISTEN 114 526804 153686/named<br>...<br>udp 0 0 127.0.0.1:53 0.0.0.0:* 114 526775 153686/named<br>udp6 0 0 ::1:53 :::* 114 526803 153686/named<br>...<br><br>nslookup google.com:<br>Server: 127.0.0.1<br>Address: 127.0.0.1#53<br><br>Non-authoritative answer:<br>Name: google.com<br>Address: 142.251.36.174<br>Name: google.com<br>Address: 2a00:1450:4016:808::200e<br><br>resolve.conf:<br># operation for /etc/resolv.conf.<br><br>nameserver 127.0.0.1<br>nameserver 10.13.1.4<br>nameserver 1.1.1.1<br>nameserver ::1<br>nameserver fdda:9280:731e:1:0:4::1<br>nameserver 2606:4700:4700::1111<br><br>-- <br>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.<br><br><br>bind-users mailing list<br>bind-users@lists.isc.org<br>https://lists.isc.org/mailman/listinfo/bind-users<br></blockquote><br>-- <br>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list<br><br>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.<br><br><br>bind-users mailing list<br>bind-users@lists.isc.org<br>https://lists.isc.org/mailman/listinfo/bind-users<br></div></div></blockquote></div><br></div></body></html>