2

I have a DNS resolver running BIND that serves clients in private address space (e.g., some of my clients are in 10.1.0.0/24), and separates them into Views.

There are domains on the public internet that have their NS servers resolving to private address space (e.g., example.com's NS is 10.2.0.1) which causes traffic from BIND to 10.2.0.1 in an attempt to resolve it.

How can I prevent BIND from trying to query authoritative nameservers in private address space when resolving? I still need to be able to respond to clients in private address space for other domains.

1 Answer 1

1

I was able to solve this by using server blocks in my Views to mark private subnets as bogus, e.g.,

server 10.0.0.0/8 {
  bogus yes;
};

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .