1

On our local small business network, we have a need to run a intranet-only BIND (named) DNS server for only local, intranet-only addresses. For example, we do a lot of web development on the network, so having a DNS server to manage local addresses (example: testsite3.local) is beneficial.

One aspect of this we are unsure of is, currently all the business desktops have their DNS servers set to 75.75.75.75 and 75.75.76.76, which are Comcast internet DNS servers (Comcast is our business ISP). So if we change the computer's DNS to point instead to our local DNS server, how do you setup bind to "forward" all failed requests out to the Comcast DNS servers?

For example, if someone on the network trys to visit www.google.com, their computer will first check with our local DNS server, which obviously doesn't have internet DNS records in it like google.com. So then, either the computer needs to know to check with the secondary or tertiary DNS servers OR can the local DNS server somehow request the info from 75.75.75.75 or 75.75.76.76? Is this something called zone transfers?

I know that on each individual computer (OSX in this case) that I can manually set the primary DNS to be the local server, and then secondary and tertiary servers to be the Comcast DNS servers. But I wanted to see if there was a better, more manageable way on the server side to do this.

Improve this question

1 Answer 1

Reset to default
2

DNS clients do not work like this, they do not "fall back" to the other records. A properly-functioning DNS client should choose a server at random from its configured list to spread the query load evenly, and have alternate servers in case one should go offline.

If you need to serve both internal and external DNS records then you should have your client machines configured to only use the internal DNS servers, and configure your internal server to attempt to resolve any non-locally defined DNS records from the external server.

The beginning of this would be the allow-recursion directive in BIND. Just be sure that you do not allow recursive lookups from machines not on your network as that is how DNS Amplification Attacks happen.

Improve this answer
8
  • Okay it sounds like allow-recursion is exactly what I'm looking for. Do you have any particular links to tutorials to set this up how I am wanting?
    – Jake Wilson
    Sep 4, 2013 at 17:12
  • What part of the BIND documentation are you having trouble understanding? That setting is explained very very clearly.
    – gparent
    Sep 4, 2013 at 17:16
  • Frankly I just googled "bind recursive tutorial" and this link came up from HowToForge. [which is usually pretty good] Step 4 is pretty much the meat of the matter.
    – Sammitch
    Sep 4, 2013 at 17:17
  • @gparent where is the recursion doc's does it discuss how to set the Internet DNS server IP's (in this case 75.75.75.75 and 75.75.76.76) I want to use for recursion?
    – Jake Wilson
    Sep 4, 2013 at 19:03
  • @Jakobud the DNS server is its own DNS server. BIND will perform all the necessary lookups itself and should not require an external DNS server.
    – Sammitch
    Sep 4, 2013 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .