2

I am setting up a DNS server at home to make it easier for me to alias some of my local servers, and also as a project to better understand DNS. Since I am new to this please forgive (and correct if you would) any mistakes with terminology!

The purpose of my local DNS server is to use my domain for accessing some of my local machines. So, let's say my domain is my-domain.com. I have a media server at home that I want to access as media.my-domain.com, and I have two local DNS servers that I use for this purpose. These DNS servers delegate to Google DNS for other queries.

Here is my zone file for my-domain.com, which is stored in /etc/bind/zones/db.my-domain.com on my local DNS server ns1:

;
; BIND data file for local loopback interface
;
$TTL    604800
@   IN  SOA ns1.my-domain.com. admin.my-domain.com. (
                  3     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
; name servers - NS records
@   IN  NS  ns1.my-domain.com.
@   IN  NS  ns2.my-domain.com.
;
; name servers - A records
ns1.my-domain.com.  IN  A   10.55.55.55
ns2.my-domain.com.  IN  A   10.55.55.56
;
; 10.55.55.0/24 - A records
media.my-domain.com.    IN  A   10.55.55.100

Here is my options file which is stored in /etc/bind/named.conf.options on my local DNS server ns1:

acl "trusted" {
    10.55.55.0/24; # home network
};
options {
    directory "/var/cache/bind";

    recursion yes;
    allow-recursion { trusted; };
    listen-on { 10.55.55.55; };
    allow-transfer {none; }; # disable zone transfers

    forwarders {
        8.8.8.8; # google1
        8.8.4.4; # google2
    };

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
    dnssec-validation auto;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

Here 10.55.55.0/24 is my local subnet, and ns1 and ns2 are my primary and secondary DNS servers, respectively.

I am using my-domain.com for other purposes on the internet, so for example when I access admin.my-domain.com it takes me to the admin console of a publicly visible website. Meaning, if you perform an nslookup on admin.my-domain.com from Google's DNS servers you will see it mapped to a globally-accessible public IP address.

Unfortunately, after I implemented my local DNS servers I cannot resolve admin.my-domain.com correctly. My nslookup requests hit my local DNS servers, which are not configured for this subdomain, and I get "No answer" from my local DNS.

The behavior I would like, instead, is for my DNS servers to forward requests for my-domain.com to Google DNS, and to only provide answers for ns1.my-domain.com, ns2.my-domain.com, and media.my-domain.com. I have seen some questions that are similar to mine, but the responses tend to be to create a single zone file for each subdomain. Is this really the only way? I would really like to be able to say, "if I've specified a rule for x.my-domain.com then follow that rule. Otherwise, delegate up the chain (to Google DNS in my case)."

I am not sure of how to troubleshoot this with Google since I'm not really clear on the terminology, and since I am a total noob I don't know where to begin on fixing it myself. Is what I'm asking for even possible? Any help on how I might implement this behavior, or search for it, would be greatly appreciated. Thanks!

migrated from serverfault.com Aug 9 '16 at 10:50

This question came from our site for system and network administrators.

2

The problem is that you configured Bind to be authoritative for the whole of example.com.

So you must either configure your local Bind to hold not only your internal DNS records, but also a copy of all your public DNS records in the zone file for example.com.

Alternatively rather than making Bind authoritative for example.com you reserve a subdomain of example.com for your internal use, make your internal DNS only authoritative for that. i.e. create a zone called home.example.com and use media.home.example.com. That way you can't have conflicting records in your internal and public DNS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.