ns1 and ns2 are in different subnets, do I need two reverse zones?

Question

I will make an example:

ns1.example.com = 172.27.175.64 (local ip address)

ns2.example.com = 192.168.1.10 (local ip address)

(Obviously it is an example and they are with local IP addresses, but in the case if they were external intranet IPs, and they were in different subnets, it would have to have two reverse zones since they are two totally different IP addresses? On the Internet there are manuals only referred to under one same subnet...

Example: zone "175.27.172.in-addr.arpa { ... }"

would it also create a "1.168.192.in-addr.arpa { ... }" for ns2?

And if I had to create two reverse zones, would it be only on the master DNS server or on the slave as well?

Answer 1

You should create reverse-zones for all the networks, you are responible for. Bigger zones like 168.192.in-addr.arpa are also valid.

All zones (forward and reverse) should be mirrored to (a) slave server(s). And public zones should obviously have NS records in the parent zone.

If the servers are public, also keep in mind to restrict where internal zones can be queried from.

Answer 2

Generally, if the reverse DNS has been delegated to you by a connectivity provider (ISP, data center, etc.) then you would need to set up a reverse DNS zone for each subnet that has been delegated to you.

The fact that you have NS1 on one subnet and NS2 in another subnet isn't really material. Reverse zones are only applicable if you have actually been delegated authority for reverse DNS over those subnets.

For example, if your NS1 and NS2 are simply hosts on a virtual machine at two different hosting providers that have not delegated reverse DNS authority, then you wouldn't need any reverse lookup zones at all.

So the question you need to ask your connectivity providers is A) whether or not you have blocks of static IP addresses assigned to you, and B) have they delegated reverse DNS authority to your DNS servers to provide reverse DNS for those IPs. If both of those are true then you would set up a reverse DNS zone for each IP block delegated to you, regardless of where your DNS servers are actually hosted or what subnets they are on.

As for the last part of your question, if you have been delegated reverse lookup authority, you would want to replicate the zone(s) across your primary and secondary (or more) DNS servers for redundancy.

I would also note that unless you're sending email from a given IP that you have been given reverse lookup authority for, there aren't many use cases where reverse lookups are even necessary aside from convenience.

Lastly, if you have NOT been delegated reverse lookup authority then you wouldn't need the reverse zone(s) at all and you would get the connectivity provider (or whomever has been allocated those IP addresses upstream) to put in reverse DNS entries on your behalf.