Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure if I'm approaching this problem correctly, so please correct me here.

Suppose an organization runs its own DNS service. The organization wants the following:

  • DNS queries by all hosts for should return records that point to
  • DNS queries by should return the real record for

In this scenario, the proxy server should not have a caching DNS server and should not be resolving client queries since the organization has its own DNS servers for the task. Additionally, the extra caching service is another link in the chain that can fail.

Is this a viable configuration (configurable?) under BIND and other DNS servers? I'm having trouble finding the right pages during a search. I'm beginning to think its the wrong approach.

If not, how is this typically handled by an organization?

Thanks in advance.

share|improve this question
up vote 1 down vote accepted

I think there are a few approaches here.

It would seem to me that the easiest one would be to simply use a "hosts" file on to return the real record for, which should 'override' the DNS lookup. Its also "more robust" then doing it through DNS.

If you do want to run it on a Bind server, you probably need to do "split DNS", which is really making 1 DNS server answer differently depending on certain criteria (eg Interface, IP address). This is, IMHO, a lot more likely to cause issues then running a second DNS server on the cache - being that you need 2 configs, but debugging split DNS is harder, as you need to take care with which interface you are querying.

You also have not advised what proxy server you are using, so I've assumed a very generic solution (squid ?). One organization I do work for is doing this "reverse caching" by using Apache and "Mod Proxy". With Mod Proxy you specify the IP address you want the incoming requests to be forwarded to, so no DNS is needed. (I suspect most proxy servers will have this kind of functionality - . Some keywords which might help include "Load Balancer, Reverse Proxy, Linux Virtual Server LVS, httpd accellerator". It was a while ago, but I'm pretty sure I used Squid in reverse proxy mode to "forward" requests in a way similar to what you are doing for another client.

share|improve this answer
Thanks David, perfect. "Split DNS" was what I was looking for. – jww Sep 29 '13 at 6:21
"...use a "hosts" file on" - what concerns me here is changing its DNS, resulting in holding stale information. (I keep trying it in my mind, but I keep hitting that stale information problem). – jww Sep 29 '13 at 6:23
"You also have not advised what proxy server you are using" - ah, right. I'm writing my own. I've looked at Squid sources, Boost asio, and a number of other source packages like libcurl and libevent. By the time I get done modifying them for my needs (and fixing their errors like lack of hostname validation in SSL/TLS under PKIX), I think I will have spent a considerable amount of time. Writing from scratch means everything meets my standards and I have a cleaner/lighter solution. – jww Sep 29 '13 at 6:27
One last comment.... I was actually thinking about having the proxy get the information for out-of-band (i.e., avoid the local DNS altogether). Something like: directly query; or reach back to my org (call it for the information over 443. I think that captures the spirit of use /etc/hosts without the worry about stale information. – jww Sep 29 '13 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .