We have a domain, say
example.com. We use a cloud-based provider for the authoritative servers. We have some customers with an IPSec tunnel that we need to give some of our internal records to. For that we have "semi-public" name servers that give a different IP address for some records, but if those records are not defined on these "semi-public" servers, the response needs to be forwarded to the "real" authoritative servers. We don't want to duplicate every record (there are somewhere around 1,000) in our "semi-public" name servers.
We're currently using Cisco IOS (yes, IOS routers have name server capabilities) with views to accomplish this. It works okay but it's a bit flaky and the TTL is always 10 seconds with no way to change it. It also means that only the network engineers and not the server admins have exclusive access (politics suck).
I have it working in the lab with BIND using RPZ (Response Policy Zone). However, an unfortunate consequence of that is that the responses never have the authoritative flag set. I'm nervous this will present a problem for some resolvers. I could skip the RPZ feature of BIND and just create a separate zone for every record, but that wouldn't be fun because who wants to maintain somewhere around 100 zones for BIND, just to have one record in each?
dnsmasq would work for this, I believe, because it sets the authoritative flag. But unfortunately I'm constrained to something that will run on Windows Server 2012 R2.
So I'm asking if anyone knows of a Windows solution (which I consider BIND to be since I can install it on Windows and it runs fine) that will provide authoritative answers to queries within a zone but forward on if a particular record is not defined? Perhaps I'm missing how to do this in BIND or perhaps there's another solution (e.g., Unbound).