NCAE Mapping Hub
Overview Scoreboard Data Roles Exercised Checklists Lessons Skill Drills Practice Terminal Progress
DNS EXT FWD failure 2x weight measured

External DNS forward lookup cannot reach your DNS server

Can't contact DNS Server on IP
Events
5,752
Pts per check
2.8
Pts missed
15,977.8
Teams hit
13/13

Authority mappings

Which work roles, knowledge units, and EWU courses this error pattern touches. Hover for context, click to drill in.

DCWF roles: CE-442 Network Technician CS-462 Control Systems Security Specialist CS-521 Cyber Defense Infrastructure Support Specialist IT-441 Network Operations Specialist IT-451 System Administrator
Knowledge Units: CD-BNW Basic Networking CD-NDF Network Defense CD-NSA Network Security Administration CD-NTP Network Technology and Protocols CO-M4 Computer Networks
EWU courses: CSCD330 CSCD379 CSCD380 CSCD434 CSCD470

What the message means

The scoring engine tried to query your external DNS (e.g. A record for team<N>.ncaecybergames.org) via your router's public IP on UDP port 53 and got either no response or a refused connection. This almost always means the **MikroTik router is not forwarding port 53 to your internal BIND server**, not that BIND itself is broken. At the 2026-03-14 regional, only 1 of 13 teams kept this service above 50% uptime.

Why the service is down

Commands in order

  1. 1. 1. Confirm BIND itself works from inside the network
    dig @192.168.<N>.12 team<N>.ncaecybergames.org +short
    Expect
    IP address, e.g., 172.18.<N>.X (or the correct A record)
    Interpret and next
    If this works internally, the problem is ONLY the router port-forward. skip to step 4.
  2. 2. 2. If internal DNS fails, check BIND is running
    systemctl status bind9 || systemctl status named
    Expect
    active (running)
    Interpret and next
    inactive/failed = BIND is down. `systemctl start bind9` to recover.
  3. 3. 3. Verify BIND is listening on the internal interface on port 53
    ss -ulnp | grep :53
    Expect
    UDP 0.0.0.0:53 or 192.168.<N>.12:53 with pid (named)
    Interpret and next
    If nothing: named isn't binding. Check `listen-on { any; };` in `named.conf.options`.
  4. 4. 4. Check router dstnat for DNS
    /ip firewall nat print where dst-port=53
    Expect
    Two rules: UDP 53 -> 192.168.<N>.12:53 and TCP 53 -> 192.168.<N>.12:53
    Interpret and next
    If missing, add them (see step 5). If they point at wrong IP, fix the `to-addresses`.
  5. 5. 5. Add router dstnat rules (MikroTik)
    /ip firewall nat add chain=dstnat protocol=udp dst-port=53 action=dst-nat to-addresses=192.168.<N>.12 to-ports=53 /ip firewall nat add chain=dstnat protocol=tcp dst-port=53 action=dst-nat to-addresses=192.168.<N>.12 to-ports=53
    Expect
    No error output. `/ip firewall nat print` now shows both rules.
    Interpret and next
    Scoring engine will see success on the next 60-second tick.
  6. 6. 6. Test externally (from scoring-engine perspective)
    dig @<router-public-IP> team<N>.ncaecybergames.org +short
    Expect
    Same IP as step 1 returned
    Interpret and next
    Nothing returned = router still blocking. Check `/ip firewall filter` for a drop rule on 53.

Decision tree

Answer each question to route to the right fix.

Q: Does `dig @192.168.<N>.12 <name>` work INSIDE the network?
Yes: Problem is 100% router-side. Go to step 4.
No:
Q: Is BIND running?
Yes:
Q: Is it listening on 53 UDP?
Yes: BIND config bug. check zone files.
No: Fix listen-on in named.conf.options, reload.
No: systemctl start bind9 ; if fails, journalctl -u bind9 -n 50.

External references

Other patterns on this service