I ran into issues with Bind 9 on Ubuntu 16 very recently. I use an internal caching DNS server for a few reasons – try to protect myself from malware, log DNS requests on my network to have an idea of where all hosts are going – mainly searching for malware or bad websites, block some domains i.e. ad blocking and some others that I might not want to visit, even by accident, etc. Suddenly at some point, I could no longer resolve any addresses that were not in my zones. My forwarders were no longer working, etc. It turned out to be:
dnssec-validation auto;
This line is default in Ubuntu 16’s Bind 9. Why it worked before, I don’t know. I changed it to
dnssec-validation no;
Then everything magically started working again. Hope this saves someone else’s time. 🙂