Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering if in any DNS server's implementation (BIND/djbdns/anyother) is it possible to suppress NXDOMAIN response all together ?

The requirement is as follows A Campus ( e.g University) get Wimax Internet Services from an ISP. ISP provides them with the caching DNS hosted at their end.

Now if the (for some strange reason) the connectivity between Campus DNS and ISP DNS doesnt exist and can't be organised.....

With the above Premise..we hit an issue Lets say a winxp resolver gets DNS assigned via DHCP such that ISP DNS is primary ... Then when it tries to resolve its Internal A RR, it would get a NXDOMAIN rcode from ISP caching resolver since the A record doesnt exist.

In that event, if we were to silently drop NXDOMAIN responses from ISP resolver, the winxp resolver would time out and then query the INTRANET DNS and get a valid response.

So can this be done using any (free) DNS softwares ?

share|improve this question
1  
Is that even a good idea? You'd be forcing your users to suffer through the first DNS's timeout (which if I'm not mistaken in windows is 1 second) before making the working request... –  Khai Aug 18 '10 at 17:32
    
Timing out the DNS response intentionally is an awful, awful idea. I would -1 if I could but I don't have rep on SF. –  mehaase Aug 28 '12 at 16:18
add comment

2 Answers

I have to agree with the previous comments that suppressing this would be a pretty horrible idea...would it not be better to push your DNS settings via whatever DHCP is feeding your systems, and, if necessary, configure your intranet DNS server to use the ISP's DNS as a forwarder.

share|improve this answer
add comment

Why would you like something that ? To reduce the traffic load on dns server ? It's totally unsafe to do something like that. Until timeout, someone could interfere and say ... "Hello .. i have the internal dns you want ... it's this one" ... and suddenly the attacker has your password / anything.

In any case, i don't know if it exists or not, but propably you could easily make a wrapper. (use LDPRELOAD to create a custom library)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.