problem with BIND in debian.... please help

[dnscubano]

Hello i have configured my dns server , i own a domain , and i have made all config ... i have tested my dns in web intodns.com and all seems to be good,
also when i enter command nslookup

http://www.google.com

for example, dns server resolve everything well....


my problems is when i try to use my dns server in windows clients, when i execute cmd,
and nslookup i receive Unkwown , and query refused......

please i need help...
i have configured dns server in a VPS running Debian 6 and bind......

 

[Noway2]

Welcome to TekTips.

Query refused means that you are connecting to the server, but it has been configured such that the client does not have permission to make that query. The bind configuration will have some directives for allow from and allow recursion. The first says which clients are allowed to make queries and the second says for which clients will I resolve beyond my domain.

Question / Experiment: connect to your DNS with nslookup. Query a host that the server is authoritative for such as itself. what response do you get? Next, query it for google.com. If you get a response to the first, but the second says refused, you have a recursion issue.

One "gotcha" to keep in mind is that there are a couple of ways to setup Bind, including in a CHROOT jail. This can impact exactly which configuration file is being used, e.g. /etc or /var/run/bind/etc. Be sure your using the correct file:

You should have a block similar to the folowing. Note the allow statements, where mynets is defined as my network ranges (IPs) that I will allow recursive queries from:

controls {
	inet 127.0.0.1 allow {127.0.0.1; } keys { "rndc-key"; };
	};

options {
	listen-on port 53 { 127.0.0.1;};
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { any; };
	recursion yes;
	allow-recursion { mynet; };
	dnssec-enable yes;
	dnssec-validation yes;
	dnssec-lookaside auto;
	version "REFUSED";
	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";
};

acl mynet { 192.168.0.0/24; };