0

I inherited an evironment that has a BIND server for our internal LAN. I noticed it doesn't have any forwarders for external request (i.e. google.com). How the heck does my laptop know that google.com is outside our LAN? My DHCP scope has the BIND server listed as it's primary DNS server.

Improve this question

3 Answers 3

Reset to default
6

BIND has what is called a "root hints" list pre-installed inside the binary. It lists where root servers are, or at least were when that specific version of BIND was released. Luckily, they rarely move, although more addresses may be added. Usually these are IPv6 addresses.

When BIND first starts up, it will use these hints to find what the current address set really is. This is called "priming" and is done entirely behind the scene.

So, once this is done, and you configure some local zones for your own use, it knows enough to answer questions for your zones and for any other domain out there. In this case, google.com is not a local zone in your file, so it asks a root server for google.com, gets sent to servers for .com, and then those send BIND off to google.com's name servers. They answer, and you get your answer.

As an author of BIND, I'm happy it appears to be magic. :)

Improve this answer
1
  • what about the case where you want to just add a namespace reference to some outside ip? i.e. maybe call it by its hostname? I was trying to use an A record in my local pvt zone file but thats not working....
    – Brian Thomas
    Dec 11, 2015 at 4:13
2

BIND differentiate Forwarding (AKA Proxy) and Caching ( AKA recursive).
Forwarding will forward queries to a specific target server and cache the result.
Caching will query root name server and cache the result.

In your case, BIND might be configured with Caching/recursive to do external lookup. You might find something along these line : 

// recursion is on by default 
recursion yes;
// the DOT indicates all domains
zone "." IN {
    type hint;
    file "root.servers";
Improve this answer
2
  • Is a bad idea to let recursion on since your server could be used for a DNS resolution amplification attack and you'd loose some outgoing bandwidth.
    – Marcel
    Apr 13, 2013 at 8:25
  • On Ubuntu, the file is located in /etc/bind/named.conf.default-zones
    – t7e
    Sep 6, 2020 at 23:13
1

Bind will be doing proper lookup from the internet's Root Servers -you don't really need forwarders as Bind is a proper DNS client.

If you wish to set up forwarding (eg don't actually look up any of these domains, just ask this other server about it) then the following might be appropriate:

 forwarders {
      a.a.a.a;
      b.b.b.b;
 };`

where a.a.a.a and b.b.b.b are your other name server entries.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .