Take the 2-minute tour ×

I'm setting up a simple DNS server (BIND/Named), which is running locally on a OSX Laptop.

Its purpose is to resolve all requests for "*.laptop.example.com" to "" - which is the manually assigned IP address (not DHCP) of a virtual network interface.

I'm using a virtual network interface (provided by Parallels) to ensure the IP address always remains the same (eth0 will change its IP address when connected to different networks), and to also ensure it is always available (eth0 is disabled/unavailable when a network cable isn't plugged in).

I have been using the following setup:

options {


  forwarders {;
  forward only;


However this requires the configuration to be updated each time the laptop changes network (as most networks have a different DNS address to use).

I would like to drop this requirement so that if BIND/Named does not recognise the domain name (i.e. it isn't a sub domain of "laptop.example.com"), then it returns an error so the laptop can try the second DNS address it has on record (one that it has picked up from DHCP).

One possibility is to use:

options {


  forwarders {
  forward only;

  recursion no;


Which does stop it from spending 3+ seconds to query the ROOT servers... however the client interprets that response as "the domain does not exist", rather than an error which can be fixed by trying the next server.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Thanks Alnitak, duffbeer703, John Gardeniers, all very good feedback.

The solution I have used for my problem is to use launchd to detect the changes in /etc/resolv.conf, and then update the forwarders list.

By creating the file:


With the contents:

<plist version="1.0">

And loading this with:

launchctl load /Library/LaunchDaemons/myname.update.plist
launchctl start myname.update

A script at:


Can run something like:


echo "forwarders {" > $DST

cat /etc/resolv.conf | \
    grep -v -E "(|localhost)" | \
    awk '{ sub("^nameserver ", "\t"); sub("$", ";"); print }' >> $DST

echo "};" >> $DST

And then in the named config, it can use it with:

options {
    directory "[PATH]/conf/";
    listen-on {; [IP_ADDRESS_HOST]; };
    include "/var/named/forwarders.conf";
    forward only;

If you want to see or use the full implementation, go to my BIND setup page and use the download form... it creates a ZIP package with a single install script, so hopefully it is quite simple to setup and use.

share|improve this answer
Nice solution. If you're interested in using Bonjour for this, check out the RegisterResource directive for mod_bonjour... I think it fits the scenario that you're looking for. You'll need a patch for it to work with Leopard: habilis.net/mod-bonjour-fix . The difference from your approach is that you would need to register a name for each client. –  duffbeer703 Jul 14 '09 at 1:35

Why not just add an entry to the hosts file and save all that bother?

share|improve this answer
Its because I need the wildcard feature... the hosts file is fine for a few entries, but when you have several hundred records, it gets a bit much. And secondly, one of the users of this setup isn't exactly someone who knows how to edit the hosts file (even after explaining it several times)... so being able to hide this part of the configuration would be a huge help. –  Craig Francis Jul 13 '09 at 0:08
What OS are the clients? You could use puppet (or something like it) to edit the hosts file for you automatically. –  freiheit Jul 13 '09 at 0:13
It's OSX, but I may also be using this setup on a Linux box... both of which need root permissions to edit the hosts file (basically I'm aiming for a completely transparent process, so the user doesn't have to think about this step). –  Craig Francis Jul 13 '09 at 8:56

You might want to go into some more detail about what you are trying to do -- this doesn't make much sense. My advice is to not tweak with DNS fundamentals -- you're breaking something that just works.

Primary and secondary DNS servers are in your network configuration for availability. If a DNS server cannot provide an answer, the client doesn't go to the secondary server -- the folks who invented DNS implemented the concept of "recursion" to solve that problem.

If you're using Macs, you might find that using Bonjour/mDNS is a more productive path.

share|improve this answer
I don't know if its possible, but if the primary DNS server (my localhost one) could give an error, then hopefully the client will try the automatically discovered secondary DNS server. As to Bonjour/mDNS, I can't seem to get it to do the wildcard bit, it looks like the default mDNS setup need to be told each address upfront... so it seems that it won't be that much different to editing the hosts file. Thanks anyway though. –  Craig Francis Jul 13 '09 at 9:06
Why is the purpose of the wildcard? You don't have a DNS problem. If you'd go into some more detail about what you're trying to solve, you'd get better answers. –  duffbeer703 Jul 13 '09 at 12:45
Sorry duffbeer703, I was trying to keep it brief... the purpose is that as a web developer, many websites may be checked out to the laptop (for development purposes), each site has a unique domain name in the format of "company.project.laptop.example.com"... Apache has some rewrite rules setup so it can map that to the correct document root, and BIND can do the wildcard bit, the issue is the forwarders (which I think I have just fixed - will write up in a bit). –  Craig Francis Jul 13 '09 at 15:12

Try using unbound instead.

Although it's primarily a recursive server, I believe it has the ability to provide both the wildcard override you need, as well as forwarding everything else to the current upstream DNS servers as learnt automatically from /etc/resolv.conf.

share|improve this answer
Thanks for that... while I prefer to not install another app (thinking more along the lines that the Apple supplied binary is updated automatically), it give me an idea. I could create the forwarders list from the resolv.conf file... now got to look into detecting when that file changes, and for a process (running as root) to update the named config with a bit of grep/sed magic. –  Craig Francis Jul 13 '09 at 9:11
Apple may well update BIND automatically, but they don't do it very often. The current (10.5.8) build is BIND 9.4.3-P1, whereas the official version is 9.6.1. There's stacks of modern stuff missing in 9.4.x too. –  Alnitak Jul 13 '09 at 13:22
Good point, but from a security point of view, it's better to have Apple pushing updates than a binary which is completely ignored. Anyway, thanks for your comment about detecting changes in /etc/resolv.conf, that's how I got launchd to update the forwarders list. –  Craig Francis Jul 13 '09 at 15:27
well, that depends on how good a sysadmin you are :) I'd contend that a properly maintained local binary will be more secure than an infrequently updated vendor binary. Unbound is in Macports and has already been updated to this morning's 1.3.2 release. –  Alnitak Jul 13 '09 at 15:36
True, but in this case the setup will be deployed on computers which are outside of my control (and with users who have no idea what a terminal is, or how to handle a failed automated update). –  Craig Francis Jul 13 '09 at 20:20

Your Answer


