7

I have the following setup:

  • DNS-Server reachable from the internet, is authoritative for zone foo.com
  • DNS-Server reachable only locally, should be authoritative for zone test.lab.foo.com

What I try to achieve:

When a DNS query from the outside world reaches the first DNS server for a record belonging to the zone test.lab.foo.com, I want it to make a recursive request to the second DNS server and then forward the records.

I explicitly don't want to do zone transfers or make the second DNS server reachable from the internet.

my configuration looks like this: (I only copied the [what I think] important parts to here)

On the first DNS-Server

options { allow-recursion { localnets; localhost; internal; my-datacenter; mc-office; }; }; zone "test.lab.foo.com" { forward only; forwarders { <private IP of second DNS server>; }; type forward; }; zone "foo.com" { file "/etc/bind/zones/foo.com.zone"; type master; };

My issue:

When I am in a local network, that is whitelisted in the allow-recursion block, then it works as expected. When I try the DNS lookup from the internet, then i get a NOERROR with an empty response back.

During debugging, I adjusted the allow-recursion list and added any to it. Then it was working. But I don't want my DNS server to allow any kind of recursion. I actually only want "outside" lookups for this one specific zones to be recursive.

How can I set allow-recursion for just one zone?

Improve this question

1 Answer 1

Reset to default
1

This can be solved using the following configuration, using c1.k8s.ooo as an example domain that is hosted on 2a0a:e5c0:2:f::a:

options { ... allow-recursion { ::/0; 0.0.0.0/0; }; }; zone "c1.k8s.ooo" { type forward; forward only; forwarders { 2a0a:e5c0:2:f::a; }; }; zone "." { type hint; file "/dev/null"; };

What this does is the following:

  • It first turns bind into an Open Resolver (which is a bad thing)
  • We define the zone with the destination
  • Using the zone "." we delete the built in root hints support thus making bind unable to resolve anything, but the required domain.

Note that using something like

zone "." { type forward; forward only; forwarders { }; };

does not stop recursion from outside, because bind has the root zone built in.

Improve this answer
3
  • Welcome to the site, Nico. Please do not "bump" posts on this site. Especially by creating an answer post that is not an answer. Upvote the original question, or create your own question with the specific details of your scenario (and what you tried/failed/researched/etc), or post a comment if it's small enough to fit in a comment. Please do one or all of the above, and delete this "answer". Thank you. Commented Jul 26, 2021 at 5:30
  • 1
    Thanks for the bump comment, however the solution above is an answer to the original question. For more details, see ungleich.ch/u/blog/… Commented Jul 27, 2021 at 6:15
  • Please read and understand the site's community guidelines. As it is, I am trying to give you guidance on how to use the site, rather than simply requesting deletion of your post. I gave you specific alternatives to try, so that your post does not get deleted from the site. Commented Jul 27, 2021 at 6:29

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.