Using two physical Linux servers on different sub-nets, I'd like to have master and slave DNS servers. These DNS servers will only resolve internal names and addresses. Neither the DNS servers nor the peer hosts have Internet access, so a query for something like "google.com" should fail.

I can't quite get my head around what alchemy of configuration directives bind/named needs to do this. For example: recursion. This website suggests that what I want is an "Authoritative Only DNS Server". But it achieves this by disabling recursion. I get the impression that I really don't want to disable recursion, as that is the only type of query some programs/APIs make. I know with dig you can specify recursion/no recursion. But what about nslookup, or gethostbyname()? Everything that needs DNS should "just work".

But on the other hand, that same website shows examples with recursion enabled. But that requires a "." zone to be defined, with the accompanying root servers file. But the whole root servers thing is pointless in my config, as there is only one domain (our internal domain). As far as this network is concerned, our internal domain is the only domain.

For what it's worth, this is a relatively small network (about 200 servers and 50 PCs). There will also be a third DNS slave, running Windows Server.

  • Do you really have no Internet access? – Zoredache Nov 18 '13 at 18:05
  • 3
    If you have no internet access, what would you need recursive queries for? These servers would be authoritative for every name that the clients would ever be able to resolve, right? – Shane Madden Nov 18 '13 at 18:22
  • @Zoredache - yes, the particular environment I'm referring to has no Internet access, by design. – Matt Nov 18 '13 at 19:15
  • @ShaneMadden - That's kind of the gist of my question: it seems I don't need recursive queries. But if I disable recursion, what happens when a client sends a recursive query? – Matt Nov 18 '13 at 19:17
  • 1
    You will get a reply with an answer of REFUSED if recursion is prohibited, if you permit recursion, but do not define a root hints, then you should get NXDOMAIN replies for any record you have not explicitly defined. – Zoredache Nov 18 '13 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.