DNS: how to get local server to superimpose results over authoritative server?

Question

I've got a domain for which the DNS I control, and is hosted on the internet. I also have a NAT'd internal network (192.168.0.0/24) which has internet access, and which I also control. On this internal network, I also have a DNS resolver. DNS software on both is PowerDNS.

What I want to be able to do is for the DNS resolver on the internal network to be able to add/change records of queries and results that come down from the authoritative server. For example, the authoritative server might have a single record for animal.example.com:

animal.example.com.    IN    AAAA    2001:140:283::1

However, I'd like it so that when internal clients do a dns lookup for animal.example.com, they might get back the following:

animal.example.com.    IN    AAAA    2001:140:283::1
animal.example.com.    IN    A       192.168.0.2

Obviously, I could set up the internal DNS server to pretend to be authoritative for example.com, but that would require a fair bit of effort to keep the main DNS server and the internal DNS server in sync for the records which are the same between both. If the internal DNS server could somehow be made a slave of the main DNS server, but also have the provision to add its own results in, that would be ideal.

Is this possible?

Answer 1

Actually if i had to do it i would use a Lua Script with the recursor that mangles with the data on postresolve.

Hoever i really do recommend something different: Simply use a seperate authoritative Zone like internel.example.com where you AXFR example.com from the authoritative Servers and simply append your local RFC1918 data.

This way you can still debug the authoritative Zone like it is on the internet from your LAN and use the internal data.

About PowerDNS Recursor Lua Scripting: http://doc.powerdns.com/recursor-scripting.html

Answer 2

What I think you want is a split-horizon DNS setup, however PowerDNS doesn't directly support such (unlike Bind or DJBDNS). The official response about it from the author is here: http://mailman.powerdns.com/pipermail/pdns-users/2006-September/003779.html

I've never found split-horizon DNS to be particularly confusing, myself, especially if files are laid out clearly in the file system, e.g. ./master-interal/domain.com ./master-external/domain.com

The only option they're suggesting is to have two different instances of PowerDNS running on a server listening on different ports. I guess you would then leverage iptables to redirect traffic to port 53 to whichever instance is relevant.

Answer 3

Use PipeBackend in PowerDNS. I created several systems on the Python.

PipeBackend:

The PipeBackend is primarily meant for allowing rapid development of new backends without tight integration with PowerDNS. It allows end-users to write PDNS backends in any language.

Answer 4

I strongly recommend that you don't go down this path as it is extremely confusing, complex, and difficult to manage. Instead, you should set up a separate internal domain like inside.example.com. Then, if your outside dns server is also on your inside network, you should set it up to be authoritative for both domains. However if your external dns server isn't on your internal network, you should set up your inside dns server to be authoritative for inside.example.com. Then your inside dns server should forward all other requests to the outside dns server.

I realize the downside of this is you have to change the domain on all your inside machines, but doing that up-front work now will save you a lot of confusion later on.