{"id":1539,"date":"2017-06-05T13:46:57","date_gmt":"2017-06-05T08:16:57","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=1539"},"modified":"2026-08-25T22:46:18","modified_gmt":"2026-08-25T17:16:18","slug":"dns-not-working-vestacp","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/dns-not-working-vestacp\/","title":{"rendered":"DNS Not Working on VestaCP"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After installing Vesta Control Panel (VestaCP), DNS records may appear correctly in the control panel but changes may not be reflected when querying the domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One possible cause is an <strong>AppArmor permission restriction<\/strong> preventing the BIND DNS server from accessing the DNS zone files. In this situation, DNS changes made through VestaCP may not be loaded correctly by BIND.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to identify and resolve this type of DNS permission issue by allowing BIND to access the required zone files.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before proceeding, make sure you have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A server running VestaCP.<\/li>\n\n\n\n<li>BIND9 installed and configured as the DNS service.<\/li>\n\n\n\n<li>Root or sudo access to the server.<\/li>\n\n\n\n<li>Access to the server&#8217;s system logs.<\/li>\n\n\n\n<li>AppArmor enabled on the server.<\/li>\n\n\n\n<li>The location of the BIND DNS zone files.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">You can check the BIND configuration to identify the zone-file locations:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo vi \/etc\/bind\/named.conf<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the relevant <code>zone<\/code> configuration and the associated zone-file path.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Check the System Logs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, check the system log for BIND or AppArmor-related errors:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo grep -iE 'named|apparmor|denied' \/var\/log\/syslog<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If AppArmor is blocking BIND from accessing the zone files, you may see messages containing <code>DENIED<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Check the AppArmor Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The AppArmor local configuration for BIND is normally located at:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/apparmor.d\/local\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the file:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo vi \/etc\/apparmor.d\/local\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add an AppArmor rule that permits BIND to access the required zone-file directory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, if the VestaCP DNS zone files are stored under <code>\/home<\/code>, the following rule can be used:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/home\/** rwm,<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> Do not add a broad path unless it is actually required by your BIND configuration. Prefer granting access to the specific DNS zone directory whenever possible.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Reload the AppArmor Profile<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After updating the configuration, reload the BIND AppArmor profile:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo apparmor_parser -r \/etc\/apparmor.d\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify that AppArmor has loaded the profile successfully.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check the profile status:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo aa-status<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Restart BIND<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Restart the BIND9 service:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl restart bind9<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On older systems, the following command may also be used:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo service bind9 restart<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the service status:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl status bind9<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Verify DNS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After restarting BIND, verify that the DNS server is loading the zone correctly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can query the local DNS server using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">dig @127.0.0.1 example.com<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Replace <code>example.com<\/code> with your actual domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check whether BIND loaded the zone successfully:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo journalctl -u bind9<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the DNS server is authoritative for the domain, verify the updated record from an external DNS resolver as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When DNS changes made through VestaCP are not reflected, the problem may be related to BIND being unable to access the DNS zone files because of AppArmor restrictions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Checking <code>\/var\/log\/syslog<\/code>, identifying <code>DENIED<\/code> messages, allowing BIND to access the required zone-file directory, reloading the AppArmor profile, and restarting BIND can resolve this type of issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Always verify the actual zone-file location before modifying AppArmor rules and grant access only to the directories that BIND needs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Why are DNS changes in VestaCP not reflecting?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One possible reason is that BIND cannot access or load the DNS zone files. AppArmor restrictions, incorrect permissions, invalid zone files, or BIND configuration errors can all cause DNS changes to fail.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. How can I check whether AppArmor is blocking BIND?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check the system logs:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo grep -iE 'named|apparmor|denied' \/var\/log\/syslog<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for <code>DENIED<\/code> messages related to <code>named<\/code> or BIND.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Where is the AppArmor configuration for BIND?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The local customization file is normally:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/apparmor.d\/local\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The main profile is usually:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/apparmor.d\/usr.sbin.named<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-install-vestacp-on-linux-server\/\">How to install VestaCP on Linux server<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction After installing Vesta Control Panel (VestaCP), DNS records may appear correctly in the control panel but changes may not [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[261,344],"class_list":["post-1539","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","tag-linux","tag-vestacp","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-oP","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1539","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=1539"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1539\/revisions"}],"predecessor-version":[{"id":11060,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1539\/revisions\/11060"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=1539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=1539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=1539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}