Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Windows office network with a local Actice Directory/DNS domain server. The server is set up with OpenDNS's servers as forwarders (see screenshot). However, when I look at my OpenDNS query statistics, I notice that the 3rd most popular query is *.in-addr-arpa, and the 12th is *.local which is from our local domain.

Should I, or how can I prevent these local queries from going beyond my local network?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

To prevent internal queries from being forwarded to the outside DNS server, your internal DNS server needs to be authoritative for the internal zones, not just the subdomains of them that you're using.

However, you seem to have a misconception here; in-addr.arpa is not internal to your network; it is used for all IPv4 reverse name lookups for every address on the internet. Do not make your internal server think it's authoritative for all of in-addr.arpa.

share|improve this answer
    
So I need to create a new forward lookup zone for just "local"? rather than just mysubdomain.local? Will that be enough to make it authoritative? –  Baodad Apr 2 '12 at 18:14
    
Yes, it will. The queries making it out of your network are outside of mysubdomain.local, correct? –  Shane Madden Apr 2 '12 at 18:19
    
I can't tell exactly what ".local" queries are making it beyond my network. All I know is what is shown in my OpenDNS statistics screenshot linked in my original question, which shows ".local". I guess I will need to turn on debug logging? –  Baodad Apr 2 '12 at 18:29
    
Turned on debug logging but still can't find any .local dns queries that are not prepended by one of my subdomains. –  Baodad Apr 3 '12 at 18:49
    
So are queries for a subdomain your server's authoritative for making it out to OpenDNS? –  Shane Madden Apr 3 '12 at 19:18
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.