I have a public DNS server responsible for my domain local.example.com. Some ISPs always deliver the private IP, some do NOT at all, but most of them answer the correct IP to a DNS request after 5 to 10 tries. The rest of the time they send a NXDOMAIN error. Why is that? Why is this not deterministic? When I ask our public DNS server directly, I always get a correct answer.

I have the following setup:

  1. the private network inside a VPN (OpenVPN)
  2. a server, reachable through the internet with server.example.com
  3. this server provides DNS resolution for the local domain (of the VPN) local.example.com, e.g. this servers VPN IP is server.local.example.com
  4. there is no LAN. All Infrastructure is located in the internet on VServers. Basically the VPN could be seen as the LAN.
  5. we have set server.example.com as Public DNS Server for the domain local.example.com (at our Doamin Registrar)

I have asked for better solutions, but there are no satisfying other options. The main reason for this setup is browsing speed, as an average page these days has minimum around 10 DNS requests and the response speed of our vserver is not compareable with the response time of the DNS servers of ISPs or google. But there are also other reasons. When I visit a customer, I need access to both his and my services, which is not possible with a local DNS server (inside the VPN).

There have been questions about the use of private IPs in public DNS server, but this should not be the topic here. The only offical source in the internet is [a draft of the IETF] of 2004. They recommend to don't use private addresses in public DNS, but I see no better solution for my problems. Maybe the answer lies in IPv6 (but there is no garantee, that a customer has a working IPv6 setup, yet).

Edit1: fixed typo

  • My advice: don't fight the "system", however broken it appears to be.
    – gravyface
    Aug 26, 2014 at 14:49
  • instead of needing DNS entries for private ips, why don't you use host files? or the ip's directly? While there are certain issues you might have with this, depending on the exact setup this can prevent you to "fight" the system. Aug 26, 2014 at 15:25
  • "the response speed of our vserver is not compareable with the response time of the DNS servers of ISPs or google." Get a better DNS server or use a 3rd party like No-IP.com or EasyDNS.
    – gravyface
    Aug 26, 2014 at 16:06
  • @gravyface: this is also a possibility, to put all the infos of the local domain to our DNS registrar, but that is double work. And also the host file would work (I did that in the past), but the effort grows rapidly with number of clients in the network. Also, I don't want to fight the system. But I try to understand, why the system fights me, especially in such a undeterministic way.
    – ribx
    Aug 26, 2014 at 23:12
  • @ribx I guess if I look at this top-down, I think to myself, "what is this guy doing differently than 100s of 1000s of Internet-based businesses are doing successfully with standard DNS configurations?". You should be asking yourself this; it's very likely that your business is not a unique snowflake that needs a solution that's different from everyone else's.
    – gravyface
    Aug 27, 2014 at 13:07


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.