Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I tell BIND to stop forwarding queries to my provider's DNS servers for a specific list of domains, but to forward for everything else?


I'm using BIND as an authorative nameserver for my domain. It also provides DNS resolution for other queries on the host, by forwarding them to my provider's DNS servers:

forward first;
forwarders {
    1.2.3.4;
    5.6.7.8;
};

However I am running SpamAssassin and my queries to various DNS blocklists are being rejected, since they are going through my provider's nameservers (along with many of my fellow customers) and reaching the limit for free queries originating from their IP addresses. Since I only have a small number of queries myself (maybe 5-10 a day) I would like to configure BIND so that it does NOT forward DNSBL queries to my provider's servers, but it DOES forward everything else.

This should allow me to continue to use DNS blocklists to spam check the small amount of e-mail I get, without having to turn off the forwarding/caching entirely.

How can I tell BIND not to forward just a handful of domains, but keep it forwarding everything else?

share|improve this question
1  
Is there any particular reason why you don't want to perform your own recursion? forwarders are meant to be exceptions to your recursion policy. –  Andrew B Jun 7 '13 at 22:27
    
Only because there are so many people using my provider's servers it is significantly faster than performing recursion myself. –  Malvineous Jun 7 '13 at 22:43

2 Answers 2

Try configuring zones for your blacklists, and configure them not to forward. Something like this should work. You will need one of these for each blacklist zone.

zone "blacklist.example.com" {
    type static-stub;
    recursion yes;
};

You will also need to setup the root zone so recursion will work. You likely already have done this.

share|improve this answer
    
Thanks for the suggestion - unfortunately it looks like this only works with BIND 9.8.0 and newer, but my server is running Debian which is still on 9.7.3, so I get an error about static-stub being an unknown type. –  Malvineous Jun 8 '13 at 0:16
up vote 0 down vote accepted

Thanks to @BillThor I was able to come up with this entry which works with older (9.7.3) versions of BIND:

zone "blacklist.example.com" {
    type forward;
    forwarders {};
};

On my Debian machine I added it to /etc/bind/named.conf.local

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.