把bind升级到9.4.1-P1后出现问题

cdcchen

我把dns升级到了9.4.1-P1之后，配置文件都一样，查询本DNS自己解析的域名可以正常查询，但查询其它域名的时候通过不了，有如下的提示，请各位给看一下：

08-Aug-2007 11:30:10.080 client 123.232.6.254#3599: query (cache) 'sina.com.cn/A/IN' denied
08-Aug-2007 11:30:33.562 client 123.232.6.254#3603: query (cache) 'sina.com.cn/A/IN' denied
08-Aug-2007 11:30:33.565 client 123.232.6.254#3604: query (cache) 'sina.com.cn/A/IN' denied
08-Aug-2007 11:43:51.681 client 123.232.6.254#3689: query (cache) 'sina.com.cn/A/IN' denied
08-Aug-2007 11:43:51.688 client 123.232.6.254#3690: query (cache) 'sina.com.cn/A/IN' denied


谢谢

阿骁

新版本的BIND对 allow-query 有着不同的处理，新增加了一个 allow-query-cache 的选项。

allow-query Specifies which hosts are allowed to ask ordinary DNS questions. allow-query may also
be specified in the zone statement, in which case it overrides the options allow-query statement.
If not specified, the default is to allow queries from all hosts.

allow-query-cache Specifies which hosts are allowed to get answers from the cache. The default is the
builtin acls localnets and localhost.
The way to set query access to the cache is now via allow-query-cache. This differs from earlier
versions which used allow-query.

BIND 9.4 的手册上还特别注释了

allow-query-cache is now used to specify access to the cache.