Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is more of a Best Practices question than a technical one. I know I can fix this problem from my end. The question is whether I should...

I administer a private network/subdomain within the larger auspices of the corporate domain. So, I run dom.pvt, sub1.dom.pvt, sub2.dom.pvt, and sub3.dom.pvt. Outside of my little fiefdom, we have,,, and probably other sub-domains I don't know about. Those domains are used across the corporate globe. My named.conf file includes a forwarders{} clause to point to a DNS stack outside my domain for those hosts out there.

(Irrelevant "why am I asking this?" I have DNS sanity checking ("UseDNS yes") set for all of my SSH daemons. If a host in the outside world tries to ssh to one of my hosts, the connection hangs or times out at the point that leads me to believe the sanity check isn't getting a return.)

If I do a simple hostname search ("host -v hostname") for a host inside my private subdomain, I get a good return from my DNS server. If I do a simple search for any host outside my domain, the request times out. However, if I explicitly search for "host -v" I will get an immediate return.

So, if I wanted to expand my resolve.conf search parameter to include these "external" sub-domains, I could solve the problem. My question is whether or not doing so is my responsibility. Or, should I be telling the external administrators they need to change setting X to value Y, instead?

I already know of three sub-domains outside my little world. How many entries should I be expected to put my resolv.conf search value?

(Aside the second: I'm going to go do some Google searching on how to tell named to scan through all of its entries across all of its sub-domains before it forwards to the next host up the chain. If that's even possible.)

share|improve this question
UseDNS doesn't confer much security advantage (there are far better ways to enhance authentication), so how about turning it off? – Paul Dec 20 '12 at 22:20
Unfortunately, our end customer uses it. One of the reasons we have our own little fiefdom is to run hosts that mimic this customer's configurations... shrug – dafydd Dec 20 '12 at 22:39

If you wish to use short hostnames for hosts outside the domains you control, it is indeed your responsibility to update resolv.conf for those search strings. There is nothing anyone outside your domain can do to make it work otherwise.

As for how many domain you can expect to put into the search string - that's a question only you can answer as it is highly dependent on your environment and the expectations of your users.

share|improve this answer
I don't know about "wish to." I may be forced to, since I don't control whether these external hosts/workstations send their simple hostnames or FQDNs when they name themselves during handshakes... The odd thing is that this worked as recently as last week. No, I don't know what changed... – dafydd Dec 20 '12 at 22:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .