bind named server - forward some requests to other servers

Question

Is there a way to make bind answer some queries but forward all other queries (of the same domain) to another server, as in:

example.com A 127.0.0.1
www.example.com A 127.0.0.1

everything not on this list (example.com MX, ftp.example.com A etc) - ask 192.168.0.1 (another DNS server)

Essentially I want to intercept some (but not all) queries going to (in this example) 192.168.0.1 and answer for it.

example.com A- intercept
www.example.com - intercept
example.com MX - pass trough
ftp.example.com - pass trough

Answer 1

This is rather tricky to do with BIND. While it isn't quite what you asked have you considered using another DNS server like DNSMasq where this sort of thing is relatively simple?

Answer 2

Your BIND server will by default use the DNS servers in /etc/resolv.conf to resolve records that it isn't authoritative for, but only for localhost (i.e. itself) and localnets (see below). You should make sure that these are set accordingly.

Definition of localnets:

matches all the IP address(es) and subnetmasks of the server on which BIND is running. For example, if the server has a single interface with an IP address of 192.168.2.3 and a netmask of 255.255.255.0 (or 192.168.2.2/24) then localnets will match 192.168.2.0 to 192.168.2.255 and 127.0.0.1 (the loopback is always present and has a single address, that is a netmask of 255.255.255.255). Some systems do not provide a way to determine the prefix lengths of local IPv6 addresses. In such a case, localnets only matches the local IP addresses, just like localhost though in this case it will apply to external and internal (same host) requests.

You can also explicitly define global forwarders like this, remembering to secure your environment:

options {
  recursion yes;
  allow-recursion-on {
    192.168/24;
  };

  forwarders {
    8.8.8.8;
    8.8.4.4;
  };
};

If you want to direct queries for a specific domain to specific servers, you can do this by configuring forwarders for individual domains:

zone "myothernet.local" {
  type forward;
    forwarders {
      192.168.50.11;
      192.168.50.12;
    };
};

Further reading:

• http://www.zytrax.com/books/dns/ch2/index.html#recursive
• http://www.zytrax.com/books/dns/ch7/queries.html

Answer 3

I think you need subdomain delegation.. However, it is usually set up to point a specific subdomain in a zone to another server.

In your case, it might be easier to give the zone to your secondary server, set up a wildcard record in there, and set up subdomain delegation for that specific subdomain pointing to your primary server..