0

I am using Bind 9 under Debian. I have one master and one secondary.

My domain names are structured as follows:

  • my-host-1.my-project.my-corp.com
  • my-host-2.area-1.my-project.my-corp.com
  • my-host-3.area-2.my-project.my-corp.com

My nameservers are authoritative for:

  • my-project.my-corp.com
  • area-1.my-project.my-corp.com
  • area-2.my-project.my-corp.com

My nameservers are not authoritative for my-corp.com and I have no administrative rights for the nameservers that are authoritative for my-corp.com.

So, the my-corp.com nameservers delegate queries for my domains to my nameservers, and my nameservers forward queries they can't directly answer to the my-corp.com nameservers. This arrangement is not optional. It is required by my company's IT department. So, specifically, my nameservers cannot perform iterative queries or in any other manner reach any nameserver on the Internet.

The my-corp.com nameservers have the following IP addresses:

  • 10.0.0.1/24 (primary)
  • 10.0.0.2/24 (secondary)

The IP address block allocated to me is 10.1.0.0/23. This is relevant for reverse resolution.

My nameservers have the following IP addresses and hostnames:

  • 10.1.0.1/23, ns1.my-project.my-corp.com (primary)
  • 10.1.1.1/23, ns2.my-project.my-corp.com (secondary)

My primary nameserver's configuration is as follows:

options {
        directory "/etc/bind";
        forward only;
        forwarders {
                10.0.0.1; 10.0.0.2;
        };

zone "my-project.my-corp.com" {
   type master;
   file "db.my-project.my-corp.com";
};

zone "0.1.10.in-addr.arpa" {
   type master;
   file "db.10.1.0";
};

zone "1.1.10.in-addr.arpa" {
   type master;
   file "db.10.1.1";
};

// ALL OF THE FOLLOWING IS DEFAULT IN BIND 9.

// prime the server with knowledge of the root servers

zone "." {
     type hint;
     file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
     type master;
     file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
     type master;
     file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
     type master;
     file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
     type master;
     file "/etc/bind/db.255";
};

My master zone file for my-project.my-corp.com is as follows:

$TTL 3h

my-project.my-corp.com.   IN   SOA   ns1.my-project.my-corp.com. root.localhost. (
   2018010500 ; Serial
   3h         ; Refresh
   1h         ; Retry
   1w         ; Expire
   3h     )   ; Negative Cache TTL

my-project.my-corp.com.   IN   NS   ns1.my-project.my-corp.com.
my-project.my-corp.com.   IN   NS   ns2.my-project.my-corp.com.

ns1.my-project.my-corp.com.                IN   A   10.1.0.1
ns2.my-project.my-corp.com.                IN   A   10.1.1.1
my-host-1.my-project.my-corp.com.          IN   A   10.1.0.2
my-host-2.area-1.my-project.my-corp.com.   IN   A   10.1.0.3
my-host-3.area-2.my-project.my-corp.com.   IN   A   10.1.1.2

My master zone file for 0.1.10.in-addr.arpa is as follows:

$TTL 3h

0.1.10.in-addr.arpa.   IN   SOA   ns1.my-project.my-corp.com. root.localhost. (
   2018010500 ; Serial
   3h         ; Refresh
   1h         ; Retry
   1w         ; Expire
   3h     )   ; Negative Cache TTL

0.1.10.in-addr.arpa.     IN   NS    ns1.my-project.my-corp.com.
0.1.10.in-addr.arpa.     IN   NS    ns2.my-project.my-corp.com.

1.0.1.10.in-addr.arpa.   IN   PTR   ns1.my-project.my-corp.com.
2.0.1.10.in-addr.arpa.   IN   PTR   my-host-1.my-project.my-corp.com.
3.0.1.10.in-addr.arpa.   IN   PTR   my-host-2.area-1.my-project.my-corp.com.

My master zone file for 1.1.10.in-addr.arpa is as follows:

$TTL 3h

1.1.10.in-addr.arpa.   IN   SOA   ns1.my-project.my-corp.com. root.localhost. (
   2018010500 ; Serial
   3h         ; Refresh
   1h         ; Retry
   1w         ; Expire
   3h     )   ; Negative Cache TTL

1.1.10.in-addr.arpa.     IN   NS    ns1.my-project.my-corp.com.
1.1.10.in-addr.arpa.     IN   NS    ns2.my-project.my-corp.com.

1.1.1.10.in-addr.arpa.   IN   PTR   ns2.my-project.my-corp.com.
2.1.1.10.in-addr.arpa.   IN   PTR   my-host-3.area-2.my-project.my-corp.com.

I have two questions.

QUESTION 1

Is it OK to put hosts from my-project.my-corp.com and its two subdomains directly in the same zone as I have done above?

QUESTION 2

Since my nameservers cannot reach the Internet, how should I handle root nameservers? Should I simply not configure them at all since I'll never perform an iterative query? If they must be defined, how should I define them?

1 Answer 1

2

Q2 vhow should I handle root nameservers?

You have forward only; set, along with forwarders. The root hints will not be used.

Is it OK to put hosts from my-project.my-corp.com

Yes that is perfectly fine. You don't need to creation additional zones files unless you need the zones to be handled by different name servers or have different query options or something.

You could make your zone look simpler if you skip appending the zone, and mentioning 'IN'.

$TTL 3h
@  SOA   ns1.my-project.my-corp.com. root.localhost. (
   2018010500 ; Serial
   3h         ; Refresh
   1h         ; Retry
   1w         ; Expire
   3h     )   ; Negative Cache TTL

@  NS   ns1
@  NS   ns2
ns1               A   10.1.0.1
ns2               A   10.1.1.1
my-host-1         A   10.1.0.2
my-host-2.area-1  A   10.1.0.3
my-host-3.area-2  A   10.1.1.2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .