We have the following scenario:

  1. Our company has an Internal DNS & an External DNS server.
  2. Both of them holds the same domain (example.com).
  3. Our Internal DNS is a Windows Server that cannot access the Internet, but has setup forwarders for "All others DNS" to the External DNS
  4. We need to setup a sub-domain (vendor.exmaple.com) to an Authoritative name server (ns1.vendor.com) from vendor and the vendor will provide the IP-address for this sub-domain.
  5. And, we have setup the following in our External DNS for Internet people who needs to access the name (vendor.example.com).

    vendor IN NS ns1.outsider.com

So that when Internet people queries the sub-domain

nslookup vendor.example.com

It returns with the corresponding IP-address defined in our vendor name server (ns1.vendor.com)

Now, we encountered the problem that:

If we apply the same setting into our Internal DNS server, we got "Server fails" when an internal staff uses 'nslookup' to query "vendor.example.com" when going through the Internal DNS.

If I use 'dig' with '+nssearch' to query from my PC to our Internal DNS,

C:\>dig +nssearch vendor.example.com
;; reply from unexpected source: <Our Proxy Server>#<Number>, expected <IP of ns1.vendor.com>#53
;; reply from unexpected source: <Our Proxy Server>#<Number>, expected <IP of ns1.vendor.com>#53
;; reply from unexpected source: <Our Proxy Server>#<Number>, expected <IP of ns1.vendor.com>#53

; <<>> DiG 9.9.5 <<>> +nssearch vendor.example.com
;; global options: +short +cmd
;; connection timed out; no servers could be reached

We expected that when the request goes to our Internal DNS, it will forward the request to our External DNS and get the IP-address from the vendor name server. Then, respond to the PC inside our company network.

Could anyone tell me what's wrong on this? And, how we can this correctly?

  • The results with dig rather sounds like your have something in your network that intercepts 53/udp traffic and which provides responses but with the wrong source address compared to where the query was sent? – Håkan Lindqvist Jul 25 '14 at 21:05
  • Either that or asymmetric routing. – Andrew B Jul 26 '14 at 0:29
  • @AndrewB Regular routing (asymmetric or otherwise) does not change the source address, though? – Håkan Lindqvist Jul 26 '14 at 12:28
  • @Håkan If a SNAT is involved on the return path, it's possible. I didn't say anything about good routing... – Andrew B Jul 26 '14 at 15:40
  • We found that the > ;; reply from unexpected source ... is due to the Internal DNS server cannot access Internet to query ns1.vendor.com Therefore, everytime when it queries "ns1.vendor.com", it was being redirected to our Proxy server and blocked there. – user234620 Jul 26 '14 at 18:35

setup a conditional forwarder for this sub-domain, pointing to ns1.vendor.com (assuming ns1.vendor.com is resolvable internally)

| improve this answer | |
  • Since our Internal DNS server cannot access to the Internet directly, it cannot point to ns1.vendor.com. Can we point this to our External DNS server? In addition, if we are doing this, should we remove the NS record from the Internal DNS server first? – user234620 Jul 26 '14 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.