0

I was wondering if in any DNS server's implementation (BIND/djbdns/anyother) is it possible to suppress NXDOMAIN response all together ?

The requirement is as follows A Campus ( e.g University) get Wimax Internet Services from an ISP. ISP provides them with the caching DNS hosted at their end.

Now if the (for some strange reason) the connectivity between Campus DNS and ISP DNS doesnt exist and can't be organised.....

With the above Premise..we hit an issue Lets say a winxp resolver gets DNS assigned via DHCP such that ISP DNS is primary ... Then when it tries to resolve its Internal A RR, it would get a NXDOMAIN rcode from ISP caching resolver since the A record doesnt exist.

In that event, if we were to silently drop NXDOMAIN responses from ISP resolver, the winxp resolver would time out and then query the INTRANET DNS and get a valid response.

So can this be done using any (free) DNS softwares ?

2
  • 1
    Is that even a good idea? You'd be forcing your users to suffer through the first DNS's timeout (which if I'm not mistaken in windows is 1 second) before making the working request...
    – Khai
    Aug 18, 2010 at 17:32
  • Timing out the DNS response intentionally is an awful, awful idea. I would -1 if I could but I don't have rep on SF. Aug 28, 2012 at 16:18

2 Answers 2

1

Why would you like something that ? To reduce the traffic load on dns server ? It's totally unsafe to do something like that. Until timeout, someone could interfere and say ... "Hello .. i have the internal dns you want ... it's this one" ... and suddenly the attacker has your password / anything.

In any case, i don't know if it exists or not, but propably you could easily make a wrapper. (use LDPRELOAD to create a custom library)

1

I have to agree with the previous comments that suppressing this would be a pretty horrible idea...would it not be better to push your DNS settings via whatever DHCP is feeding your systems, and, if necessary, configure your intranet DNS server to use the ISP's DNS as a forwarder.

You must log in to answer this question.