I'm trying to configure, to call it in some way, a "lying" DNS server.

I mean: A DNS server which acts as a DNS cache (slave) for an existing server but having it's own subset of registers for a few domain names.

The desired behaviour is, for example:

  • When queried for "host.domain.com". If it has an entry for it in its own db, then answer with it.

  • If it isn't in its db, then ask it to the master (and optionally cache that answer).

I know I can put bind9 as a slave server but, this way, all queries will be responded with the same answer that the real server would be responded.

Of course, it is a tricky setup, I know, but it has an useful purpose:

Imagine you have complex services (for example Bacula backup configuration and scripts in my case) and you want to test it against real production servers before to put it in real production.

If I just could temporary redirect DNS to that "lying" DNS in a way that all names will be resolved as usual except a few subset of "maskeraded" hosts, it will behave just as a "real" setup but without actually messing real backup servers storage with testing backups.

Of course, I could use a list of entries in the /etc/hosts, but it requires more setup and is more error prone (I have the testing environments fully automated with Vagrant but IPs can change some times).

Cloning the server and using it to do the test, also requires more work and resources and, again, is more error prone because after the tests, I will need to reconfigure the real server by hand while, with the "lying dns" approach, I just need to restore the original resolv.conf file.

I successfully configured a master dns server for our domain and it resolves correctly its own entries and queries to other domains, but doesn't know about the data of the real domain servers.

I think that it should be possible to approach with bind, but I don't know where to search...


Bind, and a few other DNS server implementations supports something called a response policy zone. This zone lets you override specific records.

Here is an example of how you use this feature to force Google safe search to be enabled. This overrides the records google.com, www.google.com, and google.ca.


options {
    response-policy { zone "rpz"; };

zone "rpz" IN {
        type master;
        file "rpdb.zone";
        allow-query {none;};


$TTL 10800
@ IN SOA localhost. hostmaster.example.org. (
        10800 )

        IN      NS      localhost.

; Google forced Safe Search
google.com      IN CNAME forcesafesearch.google.com.
www.google.com  IN CNAME forcesafesearch.google.com.
google.ca       IN CNAME forcesafesearch.google.com.

Response policy zones are pretty flexible in what they can do. They can be used to create a DNS firewall and other things.

  • Thanks for your answer. Unfortunately I think I doesn't understand it very well... I must say I'm a newbie in Bind configuration but the major difference I see between your example and my configuration (assuming the zone name doesn't matter) is the allow-query {none;}; line. But, if I add it, then it doesn't resolve host names in its own db. Of course, I have only A registers, but using only CNAMEs is not an option because the testing servers aren't registered in the production DNS even with other names. – bitifet Dec 23 '16 at 8:08
  • ...I'm not sure if I explained myself very well. To be clear: What I am trying to do is to put an "intermediate" DNS between a few hosts (one production server and some testing machines) and the real corporation DNS server which, by default, forwards (or copies) any request to the real DNS except for a given list of names in which case responds with other predefined addresses. – bitifet Dec 23 '16 at 8:12

Partial answer (it works for my setup but it's not as generic as my original question):

In my case, I just need to override the addresses of a particular subdomain, specifically bacula.ourDomain.com.

As I said, I successfully configured bind as master for bacula.ourDomain.com, but I wasn't able to resolve any other host of ourDomain.com.

Now I just added this:

options {
  forwarders {<real_ns_ip>;};

This way, my server resolves for bacula.ourDomain.com, but for the rest of ourDomain.com asks to <real_ns_ip>.

As I said, it is not a generic solution because it doesn't allow to pick only particular addresses of the domain, but it is currently enough for my purposes.

@Zoredache would probably be a better solution, but I didn't success yet in putting it in practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.