Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a domain for which the DNS I control, and is hosted on the internet. I also have a NAT'd internal network ( which has internet access, and which I also control. On this internal network, I also have a DNS resolver. DNS software on both is PowerDNS.

What I want to be able to do is for the DNS resolver on the internal network to be able to add/change records of queries and results that come down from the authoritative server. For example, the authoritative server might have a single record for    IN    AAAA    2001:140:283::1

However, I'd like it so that when internal clients do a dns lookup for, they might get back the following:    IN    AAAA    2001:140:283::1    IN    A

Obviously, I could set up the internal DNS server to pretend to be authoritative for, but that would require a fair bit of effort to keep the main DNS server and the internal DNS server in sync for the records which are the same between both. If the internal DNS server could somehow be made a slave of the main DNS server, but also have the provision to add its own results in, that would be ideal.

Is this possible?

share|improve this question
Are you going to transparently proxy WEB-requests at ? Also, IMHO, intercepting and spoofing of DNS results aint good idea. – poige Feb 5 '11 at 20:06
Please note that if/when you implement DNSSEC on the domain, this will become impossible. (Well, unless you run a full authoritative DNS server internally using the same keys as the external server. I'm also assuming you control and aren't trying to mess with someone else's domain on your network.) – David Feb 5 '11 at 21:49
I appreciate that spoofing DNS results falls into the realm of "bad", and that DNSSEC will make this impossible. We can assume I control I'm just trying to create a different DNS experience for internal clients, but one that includes the results that everyone else sees for that domain. – growse Feb 6 '11 at 9:58
up vote 1 down vote accepted

Actually if i had to do it i would use a Lua Script with the recursor that mangles with the data on postresolve.

Hoever i really do recommend something different: Simply use a seperate authoritative Zone like where you AXFR from the authoritative Servers and simply append your local RFC1918 data.

This way you can still debug the authoritative Zone like it is on the internet from your LAN and use the internal data.

About PowerDNS Recursor Lua Scripting:

share|improve this answer
ah yes, to be clear: Neither PowerDNS Server nor Recursor do support so called split horizon DNS by default but as Phil said it can be accomplished for the Auth Server by using the Pipe Backend and with Lua on the Recursor one can do just about everything anyways. – ZaphodB Feb 6 '11 at 9:18

What I think you want is a split-horizon DNS setup, however PowerDNS doesn't directly support such (unlike Bind or DJBDNS). The official response about it from the author is here:

I've never found split-horizon DNS to be particularly confusing, myself, especially if files are laid out clearly in the file system, e.g. ./master-interal/ ./master-external/

The only option they're suggesting is to have two different instances of PowerDNS running on a server listening on different ports. I guess you would then leverage iptables to redirect traffic to port 53 to whichever instance is relevant.

share|improve this answer
+1 for Twirrim's excellent explanation. I stil don't like the idea of split horizon personally, but many people have pointed out that it's quite common. – Phil Hollenback Feb 6 '11 at 4:52
I will read up further on split-horizon. It's annoying that PowerDNS doesn't support it, but I guess we can't have everything. Thanks for the pointer. – growse Feb 6 '11 at 9:59

I strongly recommend that you don't go down this path as it is extremely confusing, complex, and difficult to manage. Instead, you should set up a separate internal domain like Then, if your outside dns server is also on your inside network, you should set it up to be authoritative for both domains. However if your external dns server isn't on your internal network, you should set up your inside dns server to be authoritative for Then your inside dns server should forward all other requests to the outside dns server.

I realize the downside of this is you have to change the domain on all your inside machines, but doing that up-front work now will save you a lot of confusion later on.

share|improve this answer

Split DNS via PowerDNS Recursor

After fumbling around for some time on my Fedora 20, I seem to have made it work. I haven't found a full how-to anywhere, so a short writeup for a minimal setup:


We want to resolve to access a web service on it, both from the Internet and the LAN.

From the Internet

Machine a on the Internet resolves to the IP address IPisp. Behing IPisp is a router with NAT, which port-forwards port 80 to LAN IP IPx, thus making a web service available on the Internet.

This is naturally done by registering IP address IPisp at the authoritative nameserver for domain, which, in the case of a service like DynDns, is done using ddclient running on the router or somewhere in the LAN, and thus of no further interest here.

From the LAN

Machine b on the LAN resolves to the IP address IPx, so that the web service becomes available on the LAN directly. Additionally, assuming all the machines on the LAN are named along the lines of bar.localdomain, the name webserver.localdomain should also resolve to IPx. We also want to have reverse lookup for good measure, resolving IPx to webserver.dyndns.orginside the LAN (on the Internet, IPx resolves of course to nothing and IPisp resolves to some arbitrary string generated by the ISP.)

We assume pdns-recursor is running on a separate machine with IP IPdns, but we could also have it running on the webserver (on the same IP address as IPx or on an alias), or have only a single machine on the LAN.

Machine "b" may be configured statically or dynamically via DHCP; see dhclient and dnsmasq and possibly avahi. NetworkManager also enters here because it may rewrite /etc/resolv.conf; for now, assume static configuration.

Also, assume:

IPx =
IPdns =
IPbar =


/etc/resolv.conf on any machine:

domain localdomain

Configuration for pdns-recursor:

/etc/pdns-recursor/recursor.conf basically reduces to:

allow-from=,, ::1/128, fe80::/10[].zone, localdomain=/etc/pdns-recursor/[localdomain].zone,[].zone

The above references very much cut-down zone files (their actual names are unimportant):

In /etc/pdns-recursor/[].zone (note the lack of a dot at the end of the record name - it is a relative name not an absolute one: 1.1 means This works with or without the "IN".

1.1   IN   PTR
2.1   IN   PTR     dns.localdomain.
3.1   IN   PTR     b.localdomain.

In /etc/pdns-recursor/[].zone (note the dot at the end of the record name - it is an absolute name not a relative one)  IN  A

In /etc/pdns-recursor/[localdomain].zone

webserver    IN  A
dns          IN  A
b            IN  A

After a restart of pdns-recursor, on can test using dig by running these commands:


# Test unknwon domain resolution and webserver resolution    
dig @$PDNS | grep -A1 ";; ANSWER SECTION:"                  
dig @$PDNS | grep -A1 ";; ANSWER SECTION:"

# Test responses for localdomain
dig @$PDNS unknown.localdomain | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS webserver.localdomain | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS b.localdomain | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS dns.localdomain A | grep -A1 ";; ANSWER SECTION:"

# Test responses for localdomain if the domain is omitted
dig +search @$PDNS webserver | grep -A1 ";; ANSWER SECTION:"

# Test reverse resolution
dig @$PDNS -x | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS -x | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS -x | grep -A1 ";; ANSWER SECTION:"
dig @$PDNS -x | grep -A1 ";; ANSWER SECTION:"
share|improve this answer

Use PipeBackend in PowerDNS. I created several systems on the Python.


The PipeBackend is primarily meant for allowing rapid development of new backends without tight integration with PowerDNS. It allows end-users to write PDNS backends in any language.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.