iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Configure BIND as a private recursive resolver by enabling recursion, restricting queries to trusted networks, and choosing whether it should resolve names directly or send eligible misses to upstream forwarders. Use forward first; when direct recursion is an acceptable fallback, forward only; when upstream resolvers are mandatory, and a type forward zone when only one namespace needs different handling. Validate the configuration before reloading and test from both permitted and untrusted clients so the server does not become an open resolver.
What a caching and forwarding resolver does
A caching resolver performs recursion on behalf of clients and stores responses for the records’ time-to-live (TTL). When a client asks again before that TTL expires, BIND can answer from its cache instead of repeating the upstream lookup. The BIND Administrator Reference Manual describes recursion and caching as so closely connected that “the terms recursive server and caching server are often used synonymously.”
Recommended Free Tools
Forwarding changes where BIND sends a lookup that it cannot answer locally. Forwarding applies only when the server is not authoritative for the name and does not already have an answer in cache. Authoritative answers and cache hits therefore do not need a forwarder.
The same BIND instance can host authoritative zones and provide recursive service, but those roles need separate policy decisions. The examples below are resolver-role patterns; exact configuration-file locations, service names, and cache directories vary by distribution and BIND release. Confirm the package documentation for the operating system you are running.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Choose the resolver design first
| Choice | Upstream dependency | Failure behavior | Typical use |
|---|---|---|---|
| Direct caching and recursion | BIND follows the root and authoritative DNS hierarchy | Can continue when a particular forwarder is unavailable, subject to network reachability | Independent resolver for a trusted LAN |
forward first; |
Configured forwarders are preferred | Falls back to normal recursion if the forwarders do not answer | Central policy with a resilience fallback |
forward only; |
Configured forwarders are mandatory | Returns failure when the forwarders cannot answer | Restricted networks or centralized filtering |
| Selective forward zone | Only the named namespace uses its specified upstreams | Failure is limited to that domain’s forwarding policy | Split DNS and internal namespaces |
forward first; is the documented default when forwarders are configured in the applicable BIND configuration. Set it explicitly so the intended behavior is obvious and remains easy to audit. With forward only;, BIND will not bypass the listed servers by attempting direct recursion.
Forwarder order in named.conf is not a fixed priority sequence. BIND learns response performance from previous queries and selects the server it expects to answer most quickly. Listing one address first does not guarantee that it will receive every query first.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDefine a trusted-client ACL before enabling recursion
Recursive service should be available only to networks you control, such as a loopback address, a management subnet, or an internal LAN. Replace the illustrative private ranges below with the actual source networks in your environment; do not copy them blindly.
acl "trusted_clients" {
127.0.0.1;
10.0.0.0/8;
192.168.0.0/16;
};Keep this list as narrow as practical and enforce the same boundary in the host or network firewall. A firewall rule is not a substitute for BIND’s ACLs, and an ACL is not a substitute for restricting reachability. Never configure unrestricted Internet recursion with allow-recursion { any; };.
BIND evaluates allow-recursion, allow-query-cache, and allow-query together. The effective policy depends on which statements are present and their documented precedence. Configure all three explicitly for a resolver so that both ordinary queries and cache access are limited to the same trusted set. A client permitted to recurse can use any address on which named is listening, so listening on an internal interface does not by itself replace an ACL.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Configure BIND for direct caching and recursion
This pattern has no forwarders statement. BIND resolves eligible cache misses through the DNS hierarchy and retains responses according to their TTLs.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →options {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
// No forwarders: resolve through the DNS hierarchy.
};Adapt the role pattern to your operating system
- Directory: The example cache directory is common on some Linux packages, but paths differ between distributions and other operating systems. Use the directory created by your package and ensure the BIND service account can read and write it.
- Interfaces and transport: The example does not set
listen-onorlisten-on-v6. If the host has public interfaces, bind DNS service only where clients need it and apply firewall rules for UDP and TCP DNS traffic. - Authoritative data: Keep any authoritative
zonedeclarations required by your environment. Recursion and authoritative service can coexist, but exposing one does not automatically secure the other.
Use direct recursion when the server is allowed to contact root and authoritative servers and you do not need a central resolver to enforce filtering, logging, or an internal policy boundary.
Configure BIND with global forwarders
Add an IP address list in the options block when another resolver should handle eligible cache misses.
options {
directory "/var/cache/bind";
recursion yes;
allow-query { trusted_clients; };
allow-recursion { trusted_clients; };
allow-query-cache { trusted_clients; };
forwarders {
192.0.2.53;
192.0.2.54;
};
forward first;
};The addresses above are documentation examples. Substitute upstream resolver IP addresses that are reachable and authorized for your site. The forwarders statement takes IP addresses, not host names; using addresses avoids a dependency on DNS to discover the forwarder itself.
When to use forward first;
BIND sends an eligible query to a learned-best forwarder first. If the forwarders do not answer, BIND falls back to normal recursion. This is useful when a site wants upstream policy or centralized visibility during normal operation but still needs a path to the DNS hierarchy when the central service is unavailable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
When to use forward only;
Change the final line to:
forward only;Use this mode when policy requires every eligible lookup to pass through the listed resolvers, for example in a restricted network where direct DNS egress is prohibited. If those forwarders cannot answer, BIND reports a lookup failure instead of trying root and authoritative servers. That makes upstream outages visible, but it also means the resolver cannot recover through an independent path.
Regardless of the mode, BIND caches responses obtained from its configured forwarders. Subsequent clients can receive an unexpired cached answer without another upstream transaction.
Forward only one namespace
A zone block of type forward applies forwarding to a selected domain rather than to every eligible name. This is useful for split-DNS arrangements in which an internal namespace is answered by private DNS servers while public names follow the global policy.
zone "corp.example" {
type forward;
forward only;
forwarders { 10.20.0.53; 10.20.0.54; };
};Here, requests under corp.example are sent only to the two specified internal resolvers. Other names continue to follow the policy in options. Use forward first; in the zone instead if that namespace may fall back to normal recursion when its internal forwarders fail. Check for overlapping authoritative zones and forwarding zones: an authoritative declaration for the same namespace takes precedence for data served locally, so place the policy where it matches the DNS design.
Validate, reload, and test the resolver
Do not reload an unvalidated file. The command names below are standard operational recommendations, but the service manager and file paths differ by operating system.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Check syntax. Run the distribution’s
named-checkconfagainst the active configuration, for example:named-checkconf /etc/bind/named.confA successful check normally produces no output. Correct every syntax, include-file, ACL, or permission error before proceeding.
- Reload through the service manager. Use the platform’s documented BIND reload action rather than stopping the daemon unnecessarily. Then inspect BIND’s logs for parse failures, inaccessible zone files, denied operations, or inability to reach the configured forwarders.
- Query from an allowed client. Use
digagainst the resolver’s address:dig @192.0.2.10 example.netCheck the response
status, the answer section, and theSERVERline. The address shown there should be the BIND listener you intended to test. - Repeat a query. Run the same query again and compare response flags and timing. A repeated answer may be served from cache until the record’s TTL expires; timing alone is not a benchmark or proof of a particular cache state.
- Exercise the chosen upstream policy. Query an external name that is not authoritative locally. For
forward only;, verify that the result depends on the configured forwarders. Forforward first;, test the documented fallback path only in a controlled maintenance window, because deliberately interrupting upstream DNS affects clients. - Test an untrusted source. From a host outside
trusted_clients, query the resolver and confirm that recursion or cache access is refused. Test each reachable listener address, not just one interface. This is the check that demonstrates the server is not an open resolver.
Keep logs and packet captures focused on troubleshooting rather than leaving verbose query logging enabled indefinitely. Measure cache behavior with your own workload; the available BIND references do not establish a universal performance percentage.
Secure the service against open-resolver abuse
Restrict every recursive path
- Use an ACL containing only the loopback, management, and LAN ranges that need recursion.
- Set
allow-recursionandallow-query-cacheto that ACL, and setallow-queryconsistently so a client cannot reach a less-restricted path. - Review IPv6 listeners and ACL entries separately. A server protected on IPv4 can still be exposed on an unfiltered IPv6 address.
- Limit
listen-onandlisten-on-v6to required interfaces, and mirror the policy in host and network firewalls.
Separate authoritative and recursive exposure
If the host serves public authoritative zones, it may need to answer Internet clients authoritatively while refusing their recursive requests. Design those policies deliberately; allowing authoritative queries does not require allowing cache access. Conversely, an internal recursive listener should not be reachable from the public interface.
Review forwarder trust
Forwarding sends clients’ eligible names to the configured upstream service, so choose resolvers appropriate to your privacy, filtering, and availability requirements. With forward only;, an outage or policy error at those addresses directly becomes a client-visible DNS failure. With forward first;, direct recursion can bypass an upstream policy during a failure, which may be undesirable in a controlled network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot common configuration failures
Clients receive REFUSED
First compare the source address with trusted_clients, including the address selected by IPv6. Then review the effective interaction of allow-query, allow-recursion, and allow-query-cache. A syntactically valid ACL can still exclude a client because its traffic arrives from a different subnet, NAT address, or interface than expected.
Forwarded names fail but local names work
Check that each forwarder IP is reachable over both DNS transports where required, and inspect logs for timeouts or refused requests. Confirm that the selected mode is intentional: forward only; has no direct-recursion fallback. In forward first; mode, a failure may instead indicate that fallback recursion is blocked by a firewall or upstream network policy.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Changes appear not to take effect
Run named-checkconf on the file actually included by the running service, reload through the correct service manager, and inspect logs immediately afterward. Query the intended listener with an explicit @server address; otherwise a client may be asking a different resolver. Cached answers can remain valid until their TTL expires, so changing an upstream record does not necessarily change an already cached response immediately.
One forwarder appears to receive most traffic
This is expected. BIND uses learned response times to select the forwarder it predicts will answer fastest; the order in the configuration is not a round-robin guarantee. Investigate only if the selected server is failing, policy-inappropriate, or unreachable.
Operational checklist
- Record the BIND release and operating system before applying package-specific paths or service commands.
- Define a narrow ACL for every client network that needs recursion.
- Set
recursion yes;only on a resolver intended to serve recursive clients. - Configure
allow-query,allow-recursion, andallow-query-cacheconsistently. - Choose direct recursion,
forward first;, orforward only;based on the required failure behavior. - Use a
type forwardzone for a namespace-specific policy instead of changing global behavior unnecessarily. - Keep forwarder addresses current and reachable, and remember that BIND learns which one responds fastest.
- Run
named-checkconf, reload safely, inspect logs, and test withdig. - Verify refusal from a source outside the trusted ACL on every exposed listener, including IPv6.
Which configuration should you deploy?
Choose direct caching when the resolver may contact the DNS hierarchy and independence from a central service matters. Choose forward first; when upstream resolvers provide preferred policy but a controlled fallback is acceptable. Choose forward only; when all eligible DNS must remain inside an upstream policy boundary, accepting that upstream failure becomes resolution failure. Add a selective forward zone when only an internal or delegated namespace needs a different set of resolvers. In every design, the security boundary is the trusted-client ACL and network exposure, not the forwarding mode.
Frequently Asked Questions
Does BIND query forwarders in the order listed?
No. BIND learns response performance from previous queries and selects the forwarder it expects to answer fastest; configuration order is not a guaranteed sequence.
What happens when a forwarder is down?
With forward first;, BIND can fall back to normal recursion. With forward only;, it does not bypass the configured forwarders and returns a lookup failure when they cannot answer.
Can the same BIND server be authoritative and recursive?
Yes, but authoritative data and recursive access require separate policy decisions. Allowing authoritative queries does not require allowing Internet clients to use the cache.
How can I verify that my resolver is not open to the Internet?
Query it from a host outside the trusted ACL and confirm recursion or cache access is refused. Repeat the test for every reachable listener address, including IPv6.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
