Hello,

Wonder if any DNS/BIND experts out there can help us with this one :-) In short we're trying to get BIND to mimin dnsmasq's behaviour on what to do with host lookups it cannot find internally, so that it instead of failing, checks with another (external) server if maybe that has a record of it.

We have a setup with two internal DNS servers at our primary location which handles the 192.168.1.x network.
Our public DNS servers are located in a colocation facility together with web and mail, and obviously run public addresses.
Then we have a couple of satellite locations that connect with DSL on public ISP address pools and use nsupdate to tell the public, colocated DNS servers about their IP address.

Both the internal and external address space has the exact same zone. This is where the problem lies.

Here's the problem. The external servers are the only ones knowing about the satellite locations updated with nsupdate (dynamic). Thus we cannot reach them internally (ie trying to ping dubai-gw.example.org gives "host unknown since the internal (private) bind-server has no recollection of dubai-gw, which has been updated with nsupdate on the external DNS server. Since they share namespace, and the internal server has to be primary for the internal hosts at head office, we cannot use a forwarder (a zone can only be either primary or forward, not both it appears).

So how do we make the internal hosts able to resolve the dynamically updated records on the external servers, without having to make the internal DNS say internal.example.org and thus split the namespace?

I wish there was a record I could use in the domain saying dubai-gw, instead of A or CNAME, I could say : Check with the DNS server at IP 10.11.12.13 ...

Any insight greatly appreciated - this one has kept me up all night thinking...

-y1

If I understand your post correctly, you would add a delegation record (NS) to the zone file that needs to resolve the dynamically updated record at the colo DNS server.

Example:

You are a star! Thank you!

(it didn't work with the numeric address, but worked like a charm with when I added)

:wq

Ooops! Sorry about the record type mis-match in my example.

Glad that solution worked though.

hehe - no worries. Thanks again for quick and to-the-point reply. It's funny how simple and obvious a solution can be once it's been pointed out. I've read the DNS & BIND book from O'Reilly twice, and while I knew all the different parts of the equation, I just never saw the connection to put it together that simply and elegantly.

Now we have the perfect DNS solution - tested, verified and rock solid. Thanks again.