Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What will I need to configure on my Bind to use the IANA Blackhole servers for authoritative answers? Right now, if I run a query on a "private" address, I get, i.e.:

[david@foobar]$ nslookup 10.171.238.96
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

** server can't find 96.238.171.10.in-addr.arpa: NXDOMAIN

The XXX.XXX.XXX.XXX are my DNS IP address.

When I use a different DNS server, I get:

[david@varimathras]$ nslookup 10.171.238.96
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

Non-authoritative answer:
96.238.171.10.in-addr.arpa      name = mentat.cc.ucf.edu.

Authoritative answers can be found from:
10.in-addr.arpa nameserver = BLACKHOLE-2.IANA.ORG.
10.in-addr.arpa nameserver = BLACKHOLE-1.IANA.ORG.
BLACKHOLE-1.IANA.ORG    internet address = 192.175.48.6
BLACKHOLE-2.IANA.ORG    internet address = 192.175.48.42

Both servers, "foobar" and "varimathras" are connected to the Internet and otherwise working properly.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If your server is able to access DNS via the Internet and is properly configured, it should automatically. The blackhole servers are registered in the DNS directory for the RFC1918 address revisions, which eliminates the DNS timeout as they should not resolve.

Being as that you are receiving a NXDOMAIN result, it leads me to believe things are operating as expected.

Edit

It looks like you have a PTR (reverse) zone for the subnet specified on your DNS. Remove the zone and it will go to the root.

share|improve this answer
    
Hmm, when I go to a different server, I get a different answer. I will amend my question to reflect this. –  user1797 Jul 15 '10 at 15:59
    
Updated for your edit. –  Warner Jul 15 '10 at 16:05
    
If I remove the forwarding --not PTR-- (I am actually forwarding queries for 10.171.238.XXX to another internal DNS not under my control), some applications that relay on gethostbyname (like NetBackup agents) will fail, since the reverse DNS lookup will not resolve. Any other ideas? Thanks! –  user1797 Jul 15 '10 at 18:47
    
If you don't want specific entries to resolve, you're going to have to remove them from the DNS that's responding to the queries. It's that simple. If it doesn't respond for the zone, the authoritative will be contacted. You have limited to no options if you cannot influence the contents of the DNS not under you direct control. –  Warner Jul 15 '10 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.