DNS Forwarding

[Mike Duffy_1]

Good morning,

I have a DNS root server (internal network) running bind 8.3.3 (also tried on 9.2.2). I have been asked to set up a forwarder to allow domain.net. to be forwarded to a private network though firewalls.
I have read all the info and it appeared to be as easy as adding this to the named.conf file;

zone "domain.net" {
type forward;
forwarders { xx.xx.xx.xx ; };
forward only;
};


I did this and it did not work. I have tried to forward everything but supplied a empty list of forwarders in the included named.conf file for our internal top level domain. This did not work. To test it I supplied another dev server as a dns server and all the requests were forwarded but still not the domain.net names.

Has anyone ever done this and is there something I am missing?

Thanks in advance.

[Robert-Jan Goossens]

Hi Mike,

Check this post from yesterday.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=752565

Hope this helps,
Robert-Jan

[Mike Duffy_1]

Thanks for the info but it is not what I am after. I need to continue to use my root doamin server to service requests but anything for domain.net should be passed out to a specific dns server on a private network.

[Geoff Wild · Accepted solution]

Put the forward in the Option area like so:

I do this for a particular zone:

options {
directory "/etc/namedb";
forwarders {
X.X.X.1; X.X.X.2; Y.Y.Y.Y; // first 2 are internet servers last 1 is for session.specialdomain.com
};
forward only; // while in transition
};



Then the zone section like so:

// special zone for specialdomain.com

zone "specialdomain.com" in {
type master;
file "named.specialdomain.com";
allow-transfer {
192.168/16;
127.0.0.1;
};
};


The actual zone file:

$ORIGIN .
$TTL 14400 ; 4 hours
rservices.com IN SOA sentinel.specialdomain.com. dnsguy.mydomain.ca. (
18 10800 1800 3600000 259200)
IN NS sentinel.specialdomain.com.
sentinel.specialdomain.com. IN A 192.168.162.157
session.specialdomain.com. IN NS ss1.specialdomain.com.
ss1.specialdomain.com. IN A Y.Y.Y.200


So what does that do? instead of me checking the "real" domain for specialdomain.com for the A record of ss1.specialdomain.com, we set it to Y.Y.Y.200 - which really isn't advertised. Then for all other requests, check the forwarder Y.Y.Y.Y name server.


Rgds...Geoff

[Mike Duffy_1]

Geoff,

Thanks for the detailed response. We tried it and had problems. We have gone back to the third party who are offering the DNS service and they gave us misleading info! We have discovered a much simpler fix and will test it tonight.

I will post the resolution if it works just in case someone else has the same problem.