Running An Authoritative-Only BIND Nameserver

Nameservers (BIND) fulfill two functions: serving authoritative data for 
delegated zones, and relaying queries and responses for non-authoritative 
zones. In the interest of security, operators generally should not use a 
single nameserver for both functions. This note explains why, and how, 
you should configure BIND to implement these functions separately.