Configure BIND 9 as a private recursive resolver by defining a trusted-client ACL, enabling recursion, and explicitly controlling cache access. Leave out forwarders when BIND should query the DNS hierarchy itself; add upstream IP addresses when you need forwarding. Choose forward first for fallback to direct recursion or forward only when every eligible query must go through the upstream resolvers. In every design, limit recursion and cache access to networks you control so the server cannot become an open resolver.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a caching and forwarding BIND server does
BIND 9 can answer authoritative queries for zones it hosts and can also act as a recursive resolver for names outside those zones. Keep those roles conceptually separate: authoritative service answers from configured zone data, while recursive service follows delegations through the DNS hierarchy and stores responses for later use.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Caching and recursion are one operating role
A caching resolver performs recursion when it does not already have a usable answer. It stores positive and negative responses according to each record’s time to live (TTL), then serves later requests from that cache until the relevant TTL expires. The Internet Systems Consortium (ISC) BIND Administrator Reference Manual describes recursion and caching as “intimately connected”; the terms recursive server and caching server are commonly used synonymously.
Cache hits avoid repeating upstream work. They do not make an answer permanent: when a TTL reaches zero, BIND must obtain fresh data. A cached answer can also disappear when the service is restarted or its cache is otherwise cleared.
Forwarding changes where uncached work goes
With forwarding enabled, BIND sends an eligible query to configured upstream resolvers instead of immediately walking the DNS hierarchy itself. Forwarding applies only when BIND is not authoritative for the name and does not already have an answer in cache. Authoritative answers and cache hits are handled locally.
BIND still caches responses obtained through forwarders, so a forwarding resolver can serve both public names and names learned from the upstream service without asking that service on every request.
Decide which resolver design fits your network
| Choice | Upstream dependency | Failure behavior | Typical use |
|---|---|---|---|
| Direct caching and recursion | Root and authoritative DNS hierarchy | Can continue when a configured forwarder is unavailable, subject to network reachability | Independent resolver for a trusted LAN |
forward first |
Preferred listed forwarders, then direct recursion | Falls back to recursion when forwarders fail | Central policy with resilience |
forward only |
Listed forwarders are mandatory | Returns failure when forwarders cannot answer | Restricted networks or centralized filtering |
| Selective forward zone | Configured upstreams for named domain(s) only | Failure is limited to that domain policy | Split DNS and internal namespaces |
Use direct recursion when the server is permitted to contact the public DNS hierarchy and you want independence from a central resolver. Use forwarding when an organization requires filtering, logging, a private upstream namespace, or a single egress path. If policy forbids bypassing the upstream service, use forward only; if availability matters more than strict centralization, use forward first.
Prepare BIND 9 before changing configuration
Identify the release and operating-system layout
Record the BIND 9 release and operating system first. Package defaults, the location of named.conf, the cache directory, the service name, and the account that runs named differ between distributions. The examples below show configuration patterns, not a universal file layout.
Plan network reachability
- Choose the LAN or management networks that should receive recursive service.
- Make sure the host can reach the DNS servers it is expected to use: authoritative infrastructure for direct recursion or the selected forwarders for a forwarding design.
- Align host-firewall rules with the same trust boundary. An ACL is not a replacement for a firewall.
- Review the addresses on which
namedlistens. A client permitted to recurse can use any address where the daemon accepts DNS requests, so do not expose a recursive listener on an untrusted interface.
Define a trusted-client ACL
Put the networks that should receive recursive and cached answers in an ACL. Replace these illustrative private ranges with the actual LAN or management ranges for your site:
acl "trusted_clients" {
127.0.0.1;
10.0.0.0/8;
192.168.0.0/16;
};Do not copy this broad example unchanged to an Internet-facing server. A narrow ACL is safer: include only the subnets and loopback addresses that need the service. BIND documents the interaction of allow-recursion, allow-query-cache, and allow-query. The first two govern recursive and cache access; allow-query controls general query permission. The ARM defines their precedence, so set all three deliberately rather than relying on package defaults.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsNever use allow-recursion { any; }; on a public-facing resolver. An open resolver can be abused for reflection and amplification traffic, and it gives strangers access to your recursive service.
Configure BIND for direct caching and recursion
This role pattern performs recursion itself and has no forwarders:
options {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
// No forwarders: resolve through the DNS hierarchy.
};What each statement controls
directoryidentifies the working directory used by the packaged service. Keep the path supplied by your distribution if it differs from the example.recursion yes;enables recursive processing for clients that pass the access controls.allow-querylimits who may send queries to this server.allow-recursionlimits who may ask BIND to follow delegations on their behalf.allow-query-cachelimits who may receive answers from the recursive cache.
Leaving out forwarders makes this the direct-recursion pattern. BIND obtains referrals and authoritative answers through the normal DNS hierarchy, then caches the results for trusted clients.
Configure BIND as a forwarding resolver
Add the upstream resolver addresses and a forwarding policy inside the options statement:
Rank #3
options {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
forwarders {
192.0.2.53;
192.0.2.54;
};
forward first;
};forwarders is an IP-address list. Replace the documentation addresses above with resolvers appropriate to your network. Do not assume that the first address is always tried first: BIND learns response performance and chooses the forwarder it expects to answer most quickly. The order written in named.conf is therefore not a fixed query sequence.
How forward first behaves
With forward first, BIND sends eligible uncached, non-authoritative queries to the listed forwarders. If those servers do not answer successfully, BIND falls back to normal recursion. This preserves an independent path to the DNS hierarchy, but it also means a query can bypass a central policy when the forwarders are unavailable.
The BIND configuration reference documents forward first as the default forwarding mode when forwarders are configured. Confirm the behavior for the specific BIND release packaged by your operating system before relying on an implicit default; explicitly writing the mode makes the intended policy visible.
How forward only behaves
Change the final line to forward only; when every eligible query must use the listed upstream servers:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match forward only;In this mode, BIND does not bypass the forwarders by recursing directly. If they are unreachable or cannot answer, clients receive a failure rather than an answer obtained elsewhere. That is useful for restricted networks, centralized filtering, or environments where DNS egress must be auditable, but it makes the upstream service a hard dependency.
Rank #4
Forward only one namespace with a forward zone
You can apply forwarding to a particular domain instead of all eligible names. A zone block of type forward accepts both forward and forwarders:
zone "corp.example" {
type forward;
forward only;
forwarders { 10.20.0.53; 10.20.0.54; };
};This pattern is useful for split DNS. Requests for corp.example go to the internal resolvers, while names outside that namespace follow the global policy in options. Use forward first in the zone when a direct-recursion fallback is acceptable for that namespace; use forward only when leaking the name to other DNS servers would violate policy.
Keep the global ACL controls in place. A forward zone determines where an allowed query is resolved; it does not make the server safe for arbitrary Internet clients.
Validate the configuration without opening the resolver
- Check syntax before reloading. Run the
named-checkconfutility against the configuration file used by your package. A typical installation might usesudo named-checkconf /etc/bind/named.conf; substitute the real path on your system. Correct syntax errors before touching the running service. - Reload through the service manager. Use the service name supplied by your distribution, commonly
bind9ornamed. A representative command issudo systemctl reload bind9. If your platform does not support a reload action, follow its documented restart procedure and account for the cache being discarded. - Read the BIND logs. Look for parse failures, permission errors on the working directory, inability to bind a listening address, and upstream reachability errors. A successful reload command alone does not prove that queries will work.
- Query from an allowed client. Use
dig, for exampledig @192.0.2.10 example.com. Check the responsestatus, the answer section, and theSERVERline to verify that the intended BIND instance replied. - Repeat a name. Query the same name again from the trusted client. The second request should be eligible for the local cache until the record’s TTL expires; use the result and BIND logs to confirm that the resolver is serving cached data rather than repeatedly forwarding or recursing.
- Exercise the selected policy. Query an external name that is not already cached. In a forwarding design, inspect logs or upstream telemetry to confirm that the request reached a forwarder. In a direct-recursion design, verify that BIND can reach the DNS hierarchy.
- Test an unauthorized source. From a host outside
trusted_clients, send a query to every address where BIND listens. Recursive service should be refused, and cache access should not be available. This test is essential: it verifies that the server is not an open resolver.
Use a real client address for the authorization test. Testing only from localhost can conceal an ACL that accidentally permits an entire production subnet or a public interface.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
Clients receive REFUSED even though BIND is running
- Confirm the client source address is inside
trusted_clients. - Check that
allow-query,allow-recursion, andallow-query-cacheall permit the intended network. - Verify that the client is querying an address on which
namedis listening and that the firewall permits DNS traffic.
Forwarding appears not to occur
- Make sure the name is neither authoritative locally nor already cached; forwarding is used only for non-authoritative, uncached queries.
- Check that the
forwardersaddresses are reachable and listening for DNS. - Review logs for a syntax error that prevented the reload, and confirm that the active service loaded the file you edited.
- Remember that BIND selects forwarders from learned response performance, so packet captures may show a different listed server than you expected.
forward only causes outages while forward first works
This is expected when the upstream resolvers are unavailable. forward only has no direct-recursion fallback; restore upstream reachability or deliberately change the policy to forward first if bypassing the central service is acceptable.
Best Value
Direct recursion fails for every external name
- Verify that the host can reach the DNS hierarchy and that outbound DNS traffic is permitted by network policy.
- Check logs for inability to contact upstream authoritative infrastructure.
- Ensure you did not configure a forward-only policy unintentionally in
optionsor a more specific forward zone.
Reload fails after changing the cache directory
Check that the directory exists and is writable by the account running named. Package-managed paths often carry distribution-specific ownership and permissions; preserve those conventions rather than creating a directory owned only by root.
Operate the resolver safely
Keep policy explicit
Write the ACL statements and forwarding mode even when package defaults appear to match your intent. Explicit configuration makes audits and future migrations safer, especially because default access controls can differ between installations.
Recommended Free Tools
Separate authoritative and recursive exposure
The same BIND instance can host authoritative zones and provide recursion, but those roles have different security requirements. Authoritative service may need to answer a broader audience, while recursion and cache access should remain limited to trusted clients. Do not widen recursive ACLs merely because an authoritative zone is public.
Measure your own workload
The BIND references do not establish a universal performance percentage for caching or forwarding. Cache hits generally reduce repeated upstream work, and forwarding can centralize policy, but the effect depends on query mix, TTLs, network distance, and upstream health. Monitor cache behavior, response failures, and client latency in your environment instead of applying an invented benchmark.
Quick Recap
Configuration checklist
- Identify the BIND 9 release, operating system, configuration path, service name, and cache directory.
- Define a narrow ACL for the LAN or management networks that need recursion.
- Set
allow-query,allow-recursion, andallow-query-cacheintentionally. - Choose direct recursion,
forward first, orforward onlybased on the required failure behavior. - Use a forward zone for an internal namespace that needs different upstream servers.
- Confirm that firewall rules and listening interfaces match the ACL.
- Run
named-checkconf, reload through the platform service manager, and inspect logs. - Test allowed queries, cache reuse, the selected forwarding path, and refusal from an unauthorized network.
- Re-test after BIND or operating-system upgrades because package defaults and file locations can change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
