When you have setup a production box, running with a DNS server ( named service, in this matter ), you get tones of queries. If you have disabled recursion, lesser the number of DNS workload.
While going through your /var/log/messages, have you found lots of query ( cache ) denied messages ? Something like this ?
Date host named[28251]: client IP#xxxxx: view external: query (cache) 'domain.com/A/IN' denied
Check whether the domains to which these queries are directed are present in the server or not.
If you find that these domains once existed in the server and not now, we can conclude that domains are still pointed to the DNS servers even though the sites went out of business or went offline.
If you find that these domains once existed in the server and not now, we can conclude that domains are still pointed to the DNS servers even though the sites went out of business or went offline.
In other words, they no longer have a DNS or HTTP entry, but the domains still exists and have their DNS records pointed here.
Resolution to this issue is
Add the following lines to
/etc/named.conf ( named config file )( Add under the section ‘options’
additional-from-auth no;additional-from-cache no;Once these settings are given, BIND will not follow out-of-zone records even if it is in the cache.