I'm going to start this off with a quick, yes this is similar to many other questions, but I have a very specific question related to how to configure bind9 which doesn't seem to have been covered else where.

This is my situation:

  • We have a bunch of dev machines behind a firewall.
  • The dev machines have no external access.
  • All programmers are on a vpn that gives them access to the dev machines.

I'd like to have a way to allow multiple 'dev' DNS records, without messing around with our public DNS records.

Broadly speaking this is my plan:

  • Run a DNS server on the dev network
  • Have all programmers have a pair of DNS servers defined on their local network configs

So it'd work like this; I have a bunch of dev dns entries, eg.

*.dev.mysite1.com -> vpn ip *.dev.mysite2.com -> vpn ip

However, since the client machines have two DNS entries defined, they will chain the request and requests for www.mysite1.com, etc. will resolve to the normal (public) dns server.

So, question:

How do you setup bind so that it will resolve a subdomain (eg. dev.mysite.com) but will not resolve any other subdomains (eg. www.mysite.com)?

This is probably trivial to do, but after installing bind and creating a zone file, things seem to not be working?

What should my named.conf.local file / specific zone file look like to resolve a specific subdomain, but not the entire domain?


Edit: Yes, I saw Overriding some DNS entries in BIND for internal networks, but I was sort of hoping there was a way to do this easily using bind...

3 Answers 3


You need to delegate dev and make the nameservers authoritative.

On site1.com:

dev.site1.com.            NS      ns1.dev.site1.com.
dev.site1.com.            NS      ns2.dev.site1.com.
ns1.dev.site1.com.        A
ns2.dev.site1.com.        A

On ns1/ns2.dev.site1.com:

@       SOA     ns1.dev.site1.com. hostmaster.site1.com ( 2011050802 3H 1H 1W 10M )
dev.site1.com.            NS      ns1.dev.site1.com.
dev.site1.com.            NS      ns2.dev.site1.com.
ns1.dev.site1.com.        A
ns2.dev.site1.com.        A
  • I don't like the idea of putting resources for private networks in public name servers. RFC 1597 at the very least suggests querying an internal server from inside the private network.
    – Sven
    Commented May 10, 2011 at 8:08
  • who said anything about public nameservers? You can do this delegation on your private internal nameserver. Or look at views.
    – dmourati
    Commented May 10, 2011 at 21:51

Strictly speaking not an answer to your question (configuring bind), but maybe still a solution to your problem.

I don't know how many programmers and dev machines you're talking about, but it might be very feasible to include all dev machines into the appropriate hosts-files on the programmer's clients.


Using two DNS entries on your clients will not work. If they query the first server and it returns that it couldn't find the entry, they will not try the second server but fail instead.

The usual way to go around this is to push out a DNS entry for your internal server via DHCP when your users connect to the VPN. This server then has to be configured to be authoritative for dev.mysite1.com and/or dev.mysite2.com and either be recursive or redirect to your primary DNS server for every other query.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .