1

Using Windows 2008 R2 DNS:

We have a Forward Lookup Zone:

somerealdomain.com

us-wil    |    A    |    10.10.0.1
us-chi    |    A    |    10.10.0.2
us-day    |    A    |    10.10.0.3
us-sea    |    A    |    10.10.0.4
us-sf     |    A    |    10.10.0.5
us-ny     |    A    |    10.10.0.6
give      |    A    |    10.10.0.7
me        |    A    |    10.10.0.8
test      |    A    |    10.10.0.9

If I do an NSLookup for any of those, they obviously get pointed correctly to the internal IP.

Now, if I want any non-existant subdomain to resolve using external DNS as provided by our Forwarders 8.8.8.8, 8.8.4.4 etc. how can I accomplish that? Say, I want to resolve get.somerealdomain.com which is not included in the Forward Lookup Zone, but is resolvable on Public DNS Servers?

I need this so if someone searches a subdomain we haven't included in our Forward Lookup Zone, it will go out the a public DNS server and resolve. I assumed this would happen by default as it does with any other domain we have not written records for, but because we have the somrealdomain.com as a Forward Lookup Zone, any subdomain which does not have a record written just dies instead of asking external DNS. Why? How can I resolve this?

Improve this question

3 Answers 3

Reset to default
2

DNS requires that there be only one instance of a given zone (the zone can be served by multiple authoritative servers, but only one instance of the zone is allowed). You simply cannot get a DNS server to first query a local forward zone (i.e. locally defined, be it a master or slave zone) and then query another DNS server if it does not find a matching entry. You are effectively overriding the very definition of the somerealdomain.com on your local server (so as far as it is concerned, the public version of that zone does not exist).

There are a number of workarounds possible. If you have access to the public zone file (directly or by zone transfer), then a suitable script could backfill your local zone with the public entries which are not overridden locally. This is not trivial and requires some in-depth knowledge.

An alternative would be to place a filtering DNS proxy in front of your DNS server - the kind of DNS proxy used for penetration testing which can be configured to forward queries to different DNS servers based on the query's contents (or fake answers directly - which is effectively what you are doing).

Finally, you could use a DNS cache such as dnsmasq (same principle as a filtering DNS proxy) - see this answer for details.

Improve this answer
4
  1. Delete somerealdomain.com zone
  2. Create us-wil.somerealdomain.com zone
  3. Add A record to us-wil.somerealdomain.com zone and leave the hostname blank (use internal IP address).
  4. Repeat steps 2 and 3 for all internal hostnames
Improve this answer
0

Normally subdomains are pointed to from the higher domain. Your DNS server thinks it is the authority for somerealdomain.com. When a request for subdomain.somerealdomain.com is received, it checks its own records and says "That doesn't exist. I should know I'm the father".

You need a record to point to the DNS server of your subdomain. Normally this involves delegating the subdomain (or subzone) to another DNS server. I believe that you right-click on the domain in the DNS console and select "New Delegation". It can also be done with the dnscmd command.

Improve this answer
3
  • 1
    I think the OP wants to override specific entries within a publically available domain. Subdomain delegation won't work in this case.
    – isedev
    Commented Mar 19, 2013 at 23:40
  • Ah. I read it differently. Hopefully he will clarify.
    – lmickh
    Commented Mar 19, 2013 at 23:43
  • Yes, @isedev that is correct. I have tried sub domain delegation and it does not help in my case.
    – TryTryAgain
    Commented Mar 20, 2013 at 0:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .