I'm trying to set up an authoritative DNS server with bind9 (9.8.1-P1) on Ubuntu 12.04.2 LTS (upgraded from Ubuntu 11.04) and I am encountering some problems.

External problem

When trying to check my DNS configuration with the following tools solvedns.com/biotechnics.ro and dnscheck.pingdom.com/?domain=biotechnics.ro they fail with output messages like "Name server ns1.biotechnics.ro (89.36.94.53) does not answer queries" or "Your name server ns1.biotechnics.ro is NOT responding to NS record queries!"

Also, external online dig tools such as this give back the following output:

; <<>> DiG 9.8.4-P1 <<>> @ns1.biotechnics.ro -t NS biotechnics.ro

; (1 server found)

;; global options: +cmd

;; connection timed out; no servers could be reached

Primary TLD from Parent

The parent is set up the following way:

; <<>> DiG 9.8.4-P1 <<>> @primary.rotld.ro -t NS biotechnics.ro

; (2 servers found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7740

;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2

;; WARNING: recursion requested but not available



;; QUESTION SECTION:

;biotechnics.ro.            IN  NS



;; AUTHORITY SECTION:

biotechnics.ro.     10800   IN  NS  ns2.biotechnics.ro.

biotechnics.ro.     10800   IN  NS  ns1.biotechnics.ro.



;; ADDITIONAL SECTION:

ns1.biotechnics.ro. 10800   IN  A   89.36.94.53

ns2.biotechnics.ro. 10800   IN  A   141.85.169.100



;; Query time: 279 msec

;; SERVER: 192.162.16.18#53(192.162.16.18)

;; WHEN: Tue Feb 12 05:40:50 2013

;; MSG SIZE  rcvd: 100

Configuration on ns1

rsavu@host:/etc/bind$ head -40 named.conf

// ----------------------- Options -----------------------

options {

    // all relative paths use this directory as a base

    directory "/var/cache/bind";

    // version statement changed for security (to avoid hacking known weaknesses)

    version "not currently available";

    // This prevents bind from serving other than authoritative requests:

    recursion no;

    // disables all zone transfer requests for performance as well as security reasons

    allow-transfer{none;};

    dnssec-enable no; // zone not signed

    minimal-responses yes; // optional - improved performance

    additional-from-auth no; // optional - improved performance

    additional-from-cache no; // optional - minimal performance change

};



// ----------------------- Logging -----------------------

// log to /var/log/named/zytrax-named all events from info UP in severity (no debug)

// uses 3 files in rotation swaps files when size reaches 250K

// failure messages up to this point are in (syslog) /var/log/messages

logging{

    channel custom_log{

        file "/var/log/bind9_info.log" versions 3 size 250k;

        severity debug;

    };

    category default{

        custom_log;

    };

};



// ----------------------- Zones -----------------------

zone "biotechnics.ro" in{

    type master;

    file "/etc/bind/db.biotechnics.ro";

    allow-transfer { 141.85.169.100; };

    also-notify {141.85.169.100; };

    allow-query { any; };

};

Zone file

$ORIGIN .

$TTL 36000      ; 10 hours

biotechnics.ro          IN SOA  ns1.biotechnics.ro. admin.biotechnics.ro. (

                                2013021201 ; serial

                                28800      ; refresh (8 hours)

                                7200       ; retry (2 hours)

                                604800     ; expire (1 week)

                                86400      ; minimum (1 day)

                                )

                        NS      ns1.biotechnics.ro.

                        NS      ns2.biotechnics.ro.

                        A       81.181.152.23

 $ORIGIN biotechnics.ro.

ftp                     A       81.181.152.23

ns1.biotechnics.ro.                     A       89.36.94.53

ns2.biotechnics.ro.                     A       141.85.169.100

www                     A       81.181.152.23

What I checked

• There is no problem with the firewall (i disabled it for the moment)


• Dig from inside the hosts work


• Dig from slave works


• Putting recursion yes; doesn't solve the problem


• Netstat shows that port 53 is in use on UDP and TCP by named


• named-checkconf and named-checkzone issue no warning.

What can be the problem? Any ideas? I don't understand what's happening and why isn't my host replying to queries.

[Later edit] The slave is on Debian 4.0 and works very well (as you can see in the dns solvers above.

Try adding the option

listen-on { 127.0.0.0/8; exter.nalip.addr.ess; };