up vote 1 down vote favorite
share [g+] share [fb]

What will I need to configure on my Bind to use the IANA Blackhole servers for authoritative answers? Right now, if I run a query on a "private" address, I get, i.e.:

[david@foobar]$ nslookup 10.171.238.96
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

** server can't find 96.238.171.10.in-addr.arpa: NXDOMAIN

The XXX.XXX.XXX.XXX are my DNS IP address.

When I use a different DNS server, I get:

[david@varimathras]$ nslookup 10.171.238.96
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

Non-authoritative answer:
96.238.171.10.in-addr.arpa      name = mentat.cc.ucf.edu.

Authoritative answers can be found from:
10.in-addr.arpa nameserver = BLACKHOLE-2.IANA.ORG.
10.in-addr.arpa nameserver = BLACKHOLE-1.IANA.ORG.
BLACKHOLE-1.IANA.ORG    internet address = 192.175.48.6
BLACKHOLE-2.IANA.ORG    internet address = 192.175.48.42

Both servers, "foobar" and "varimathras" are connected to the Internet and otherwise working properly.

link|improve this question
86% accept rate
feedback

1 Answer

up vote 2 down vote accepted

If your server is able to access DNS via the Internet and is properly configured, it should automatically. The blackhole servers are registered in the DNS directory for the RFC1918 address revisions, which eliminates the DNS timeout as they should not resolve.

Being as that you are receiving a NXDOMAIN result, it leads me to believe things are operating as expected.

Edit

It looks like you have a PTR (reverse) zone for the subnet specified on your DNS. Remove the zone and it will go to the root.

link|improve this answer
Hmm, when I go to a different server, I get a different answer. I will amend my question to reflect this. – David Collantes Jul 15 '10 at 15:59
Updated for your edit. – Warner Jul 15 '10 at 16:05
If I remove the forwarding --not PTR-- (I am actually forwarding queries for 10.171.238.XXX to another internal DNS not under my control), some applications that relay on gethostbyname (like NetBackup agents) will fail, since the reverse DNS lookup will not resolve. Any other ideas? Thanks! – David Collantes Jul 15 '10 at 18:47
If you don't want specific entries to resolve, you're going to have to remove them from the DNS that's responding to the queries. It's that simple. If it doesn't respond for the zone, the authoritative will be contacted. You have limited to no options if you cannot influence the contents of the DNS not under you direct control. – Warner Jul 15 '10 at 18:59
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.