I am trying to configure a Bind9 server onto my machine to try to allow a resolver to resolve addresses uniformly, because the DNS servers on my local network do not have forwarders or root hints setup for anything beyond the local network (this is 100% outside of my control). In essence, on the local network, I can only resolve names on the domain example.com (and its subdomains).

However, the network does have the ability to access the internet through HTTP proxy servers, and I have managed to setup a DNS-over-HTTPS stub server to resolved domains that are outside of the network through this proxy.

The trick is somehow getting my system resolver to resolve names regardless of where their zones are located.

To make matters even worse, the local network I am on is utilizing a "split-zone" DNS strategy, where some of the subdomains in example.com are only resolvable from the local network, and some of them from the internet (requiring me to go through the HTTP proxy to reach them). So I don't think I can just forward queries to one forwarder based on the domain name.

I thought I could set this up by setting up Bind9 in forward-only mode, and give it two forwarders (one IP for a DNS on the internal network, and the other is the local stub server), thinking that there was a way to configure it to move the next forwarder if it couldn't resolve the name with the first one. However, I keep getting NXDOMAIN answers for domains I know very well exists in a zone on a particular DNS server, leading me to believe that Bind9 isn't trying both forwarders if one delivers NXDOMAIN (either because Bind9 can't do that, or I am configuring it wrong).

Okay, here is my setup.


options {
        directory "/var/cache/bind";

        forwarders {
                // resolved, http_dns_proxy

        forward only;
        listen-on port 53 {;};
        querylog yes;

        auth-nxdomain no;    # conform to RFC1035


search example.com

I run http_dns_proxy like so:

sudo ./https_dns_proxy -t http://internal-http-proxy.example.com:3128 -a -p 53

systemd-resolved is listening on sending queries to the DNS servers it pulled in from DHCP.

Okay, I know this seems crazy and all, but it almost works. When all of it is running, I can do dig www.google.com and dig internal.example.com, the former resolving though http_dns_proxy, and the latter from my networks DNS servers, but both through Bind9. The problem is that it is very inconsistent. Half of the time it will work, and the other half it begin to only resolve names using one of the forwarders (giving me NXDOMAIN if it can't resolve it), until I flush the Bind9 cache.

So my question to you is: Is there a way that I can configure Bind9 to force it to select the next forwarder in the list in the event of an NXDOMAIN? If not, is there a DNS implementation that could?

Note: I'm fully aware of what I am trying to do doesn't really fit into how DNS was designed (or supposed to be used for that matter).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.