Hopefully this is possible to do.
Is it possible to configure a DNS server that is authorative for a given domain, to "fallback" and recurse via Forwarders / Root Hints when it cannot find the record locally?
To give a concrete scenario, imagine a private (internal) network that is served by an internal Active Directory-backed DNS server (10.10.10.10) for the domain
Internal clients that query for records like
hostgroupA.poorlyplanned.com get their answer from the local internal DNS server (10.10.10.10).
Queries from internal clients for other domains are recursively resolved via the internal DNS server (10.10.10.10) using forwarders/root hints.
Additionally, there is a public DNS server (large highly available load balanced servers actually), say at IP 18.104.22.168 and is authorative for the same domain name
External clients that query for records go directly to the public DNS server at 22.214.171.124 for resolution. For example, a public query for
webserverX.poorlyplanned.com is resolved directly from public DNS server 126.96.36.199 and returns say 188.8.131.52 to the client. When I say resolved directly, I mean that the NS records point to the public DNS server and the query is not going via the internal server (it isn't publicly accessible anyway).
The internal DNS gets populated with private DNS records for
poorlyplanned.com that are not intended to be publicly resolvable, whereas the external DNS gets populated with public DNS records (for the same domain) that should be publicly resolvable.
So far, pretty standard DNS stuff, though arguably not ideal.
Internal clients cannot resolve public DNS records like
webserverx.poorlyplanned.com because these records are not defined on the internal DNS server. Since the internal DNS server is authorative for the same
poorlyplanned.com domain, it simply returns a 'DNS record not found' result after looking at the internal records only - as authorative DNS server normally do.
A constraint we have is that the public DNS server is administered by a 3rd party and has frequent churn, making it a very hard task to manually maintain a duplicate set of records on the internal DNS server, without dropping the ball.
As a workaround, we tried adding additional client-side DNS lookup server entries pointing to the external DNS servers (in an attempt to supplement the internal DNS servers) but that doesn't work because both are authorative and the client doesn't try subsequent servers on the list once one returns with a result.
Split-brain or horizontal configurations are not feasible either because those have both servers containing the same DNS records, just with different IPs or can share zone files.
However, if it were possible to have the internal DNS server recursively resolve via forwarder/root hints when it cannot find the record locally that would work a charm. But how?
I realise that if the internal domain was originally configured with some sub-domain offset like
int.poorlyplanned.com then we don't have a problem. Unfortunately the scale of the resources already deployed and the sites involved, is prohibitive of such a change.
Surely this isn't a unique problem?
I hope I've expressed myself clearly enough - please let me know if I can help clarify.
Thanks for reading/helping!