Most likely, it has to do with recursion settings, yes, but indirectly. When recursion is not honored for a client, the next thing that named does is check whether the answer, or anything relevant to the answer, is in cache. But access to the cache, these days, defaults to being as restrictive as allow-recursion, so that permissions check fails too, and the end result is a "query (cached) denied" message in the logs.
The defaults are rather convoluted, but, according to the ARM: allow-recursion. Specifies which hosts are allowed to make recursive queries through this server. If allow-recursion is not set then allow-query-cache is used if set, otherwise allow-query is used if set, otherwise the default (localnets; localhost;) is used. allow-query-cache. Specifies which hosts are allowed to get answers from the cache. If allow-query-cache is not set then allow-recursion is used if set, otherwise allow-query is used if set unless recursion no; is set in which case none; is used, otherwise the default (localnets; localhost;) is used. - Kevin -----Original Message----- From: bind-users [mailto:bind-users-boun...@lists.isc.org] On Behalf Of Andreas Meyer Sent: Thursday, August 04, 2016 1:04 PM To: bind-users@lists.isc.org Subject: a question about denied queries Hello! When I see this in the log, does this mean it is because the server does not allow recursion? Aug 4 18:52:19 bitmachine1 named[26142]: client 127.0.0.1#52733 (c303.cloudmark.com): query (cache) 'c303.cloudmark.com/A/IN' denied Aug 4 18:56:08 bitmachine1 named[26142]: client 127.0.0.1#32773 (113.36.207.103.in-addr.arpa): query (cache) '113.36.207.103.in-addr.arpa/PTR/IN' denied Aug 4 18:57:29 bitmachine1 named[26142]: client 127.0.0.1#41550 (229.109.212.81.in-addr.arpa): query (cache) '229.109.212.81.in-addr.arpa/PTR/IN' denied Aug 4 18:57:29 bitmachine1 named[26142]: client 127.0.0.1#45968 (81.212.109.229.static.turktelekom.com.tr): query (cache) '81.212.109.229.static.turktelekom.com.tr/A/IN' denied Aug 4 18:57:30 bitmachine1 named[26142]: client 127.0.0.1#46290 (229.109.212.81.in-addr.arpa): query (cache) '229.109.212.81.in-addr.arpa/PTR/IN' denied Aug 4 18:57:30 bitmachine1 named[26142]: client 127.0.0.1#34166 (81.212.109.229.static.turktelekom.com.tr): query (cache) '81.212.109.229.static.turktelekom.com.tr/A/IN' denied Sorry, but it is a long time gone I have dealt with named. Andreas _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users