Recently I ran into a problem where one DNS server setup using Bind9 was not responding to external queries.

systemctl status bind9 –no-pager –full  shows “Denied“

Common issues (listed below) that can cause the problem were not there.

1. Bind9 was running properly
2. The server was listening on both IPv4 and IPv6
3. Port 53 was open
4. The DNS server or port 53 could be connected using Telnet

The issue was with “recursive query” permissions. To allow external queries needed to add the following option

options {
   ...
   ...
     allow-recursion { any; };
   ...
   ...
}

The options are commonly stored in /etc/bind/named.conf.options for Bind9 servers.