Bounding Unicorns

How To Fix "your-dns-needs-immediate-attention.tld" When DNS Caching A Private TLD

My network structure is as follows:

  • My home network uses netmask and a local TLD of here.
  • The gateway has the IP and runs a DNS server for the local network. The DNS server performs three functions: it resolves local host names, blocks ads and provides caching for Internet host names.
  • My laptop runs its own DNS server locally to perform two of the above three functions: ad blocking and caching for Internet host names.
  • Laptop DNS server is configured to forward to the network-designated DNS server on the home network, otherwise not to forward.

I recently installed BIND 10 on the laptop and since then, the host names on my local network have all been resolving to (

The cause of this behavior turned out to be name collision warning feature mandated by ICANN recently and implemented in BIND 10. The gist of the situation is that many machines send queries meant for local DNS resolution to public DNS servers on the Internet. Historically, these local queries failed to resolve and subsequent queries were sent that accomplished the desired effect. ICANN has now mandated that public DNS resolvers respond to these queries now with the special response, reverse resolved to your-dns-needs-immediate-attention. The affected queries are those for TLDs that are not currently registered with ICANN, i.e., those for made-up TLDs like I am running.

ICANN provides more details in the full explanation here.

The mental leap involved was realizing that BIND instance on my laptop fancied itself an Internet name server - when it received a request for host name with an unofficial TLD, instead of forwarding said request to its upstream DNS server when I am on my home network, the laptop BIND server returned

Armed with this knowledge, a workaround is quite straightforward: there is a new zone type forward added to BIND, and on my laptop I set up a forward zone for my private network directed to the network's DNS server:

zone "here" {
  type forward;
  forwarders {; };

The downside to this workaround is that it hardcodes the origin DNS server. Not a big deal really as I script other parts of BIND configuration on the laptop, and can quite easily script this part as well.

Happy BINDing!