On Thu, Aug 20, 2026 at 10:45:17PM -0700, Crist Clark wrote:
! Best practice is not to cache the root, but mirror it (RFC 8806). Mirroring
! and writing it to a local file would have prevented this. Something like,
!
! zone "." {
! type mirror;
! file "/var/cache/bind/root.mirror";
! };
This didn't work for me.
(My log-book says, the problem is that a mirror zone needs an explicit
trust anchor.)
What does seem to work here is slaving the root zones (and I am doing
this for a lot longer than these RFCs got the similar idea):
view "rootslave" {
match-clients { fcff::1; }; // extra loopback - I love IPv6
allow-query-cache { none; };
allow-recursion { none; };
recursion no;
dnssec-validation no;
zone "." {
type slave;
file "/usr/local/etc/namedb/slave/root.slave";
masters {
2620:0:2d0:202::132; // lax.xfr.dns.icann.org
192.0.32.132; // lax.xfr.dns.icann.org
<etc.etc.>
}
notify no;
};
zone "arpa" {
<as before>
zone "in-addr.arpa" {
<as before>
zone "ip6.arpa" {
<as before>
}
view "guest" {
match-clients { none; };
max-cache-size 5%;
zone "." {
type static-stub;
server-addresses { fcff::1; } ;
};
zone "arpa" {
<etc.etc.>
<local stuff>
}
view "intra" {
match-clients { 127.0.0.0/8; ::1, 192.168.0.0/22; <etc.etc.>};
max-cache-size 15%;
zone "." {
in-view "guest";
};
zone "arpa" {
in-view "guest";
};
<etc.etc.>
<local stuff>
}
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
