# BIND: Both recursion No & allow recursion active



## anna_t (Dec 18, 2009)

Hi,
i am new to setting up bind. i have just set up bind9.6.1-P2 in FreeBSD 8.0 stable. 
Some of the configs in named.conf are:

```
options {
    directory "/etc/namedb";
    notify no;
    allow-recursion { internals; };
    allow-query { internals; };
    allow-transfer { xfer ;};
view "external" in {
    match-clients { any; };
    recursion no;
    additional-from-auth no;
    additional-from-cache no;. the same goes for external-chaos.
```
Named has warnings "both allow recursion and recursion no active for external and external chaos."
Which of my configuration in named.conf caused those?
TIA.


----------



## J65nko (Dec 18, 2009)

The recommended secure practice for running nameservers is to use two copies of BIND.

One box with BIND configured as a recursive resolver whose services are only available for your users.

Another separate box configured as an authoritative name server, publicly accessible.

BIND 9 has two utilities to check configuration files named-checkconf(8) and named-checkzone(8). What does named-checkconf(8) say about your named configuration file?


----------



## J65nko (Dec 18, 2009)

See http://ftp.isc.org/isc/pubs/tn/isc-tn-2002-2.html why separation is recommended.


----------



## anna_t (Dec 19, 2009)

*Both recursion no and allow recursion active: bind warning*



			
				J65nko said:
			
		

> The recommended secure practice for running nameservers is to use two copies of BIND.
> 
> One box with BIND configured as a recursive resolver whose services are only available for your users.
> 
> ...



Ty for the url,http://ftp.isc.org/isc/pubs/tn/isc-tn-2002-2.html if that's the most probable cause, i'll look into it again.


----------

