I have BIND9 server that is serving some local zones (for dev environment). Now I need to be able to merge the content of the local zone with the "remote" zone for the same zone:


host1 IN A
host2 IN A


www   IN A
mail  IN A
host1 IN A

As a result, I need to "merge" local with remote, giving preferences to the local records (hence host1 will get the address

www   IN A
mail  IN A
host1 IN A
host2 IN A

And if I change anything on the remote zone - it should resolve it correctly, like: if there's no such record in the local zone - try the remote one using

Looks like mix of forwarders and local zone.


You would probably want to use RPZ zones. The response policy feature allows you to override single resource records with bind. This way you can keep the external zone as-is, and only override single records you need to get your dev environment working.

In the options section, add:

    response-policy { zone "rpz.int.mtak.nl"; };

(rpz.int.mtak.nl is just used for referencing the RPZ zone, it's not used by end-users).

Add the RPZ zone:

zone "rpz.int.mtak.nl" {
    type master;
    file "/etc/bind/db/rpz.int.mtak.nl.zone";
    allow-transfer { slaves; };

And the zonefile:

$TTL 60
@            IN    SOA  localhost. root.localhost.  (
                      3H  ; refresh
                      1H  ; retry
                      1W  ; expiry
                      1H) ; minimum
              IN    NS    localhost.

; Redirect www.twinings.com to www.twitter.com
www.twinings.com    IN CNAME    www.twitter.com.    

; Make google.com unavailable (NXDOMAIN)
google.com          IN CNAME    .

; Rewrite www.superuser.com to
www.superuser.com   IN A
  • You probably want to fully qualify those host names, otherwise they will have $ORIGIN appended to them. I don't know what that'll be in this particular case, but adding a simple . to the end of the names removes the issue entirely. So www.twinings.com., google.com. and www.superuser.com.. Oh, and I don't think Twitter's web servers will know what www.twinings.com is, so you aren't actually redirecting anything... – a CVn Aug 14 '17 at 11:58
  • You have to make sure you don't fully qualify the RR's, otherwise it will not work. -- Of course, requesting twinings.com at the servers twitter.com doesn't make any sense, but it's just an example, right? – mtak Aug 14 '17 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.