I'm not sure if I'm approaching this problem correctly, so please correct me here.

Suppose an organization runs its own DNS service. The organization wants the following:

  • DNS queries by all hosts for external.com should return records that point to proxy.organization.com
  • DNS queries by proxy.organization.com should return the real record for external.com

In this scenario, the proxy server should not have a caching DNS server and should not be resolving client queries since the organization has its own DNS servers for the task. Additionally, the extra caching service is another link in the chain that can fail.

Is this a viable configuration (configurable?) under BIND and other DNS servers? I'm having trouble finding the right pages during a search. I'm beginning to think its the wrong approach.

If not, how is this typically handled by an organization?

Thanks in advance.


I think there are a few approaches here.

It would seem to me that the easiest one would be to simply use a "hosts" file on proxy.organization.com to return the real record for external.com, which should 'override' the DNS lookup. Its also "more robust" then doing it through DNS.

If you do want to run it on a Bind server, you probably need to do "split DNS", which is really making 1 DNS server answer differently depending on certain criteria (eg Interface, IP address). This is, IMHO, a lot more likely to cause issues then running a second DNS server on the cache - being that you need 2 configs, but debugging split DNS is harder, as you need to take care with which interface you are querying.

You also have not advised what proxy server you are using, so I've assumed a very generic solution (squid ?). One organization I do work for is doing this "reverse caching" by using Apache and "Mod Proxy". With Mod Proxy you specify the IP address you want the incoming requests to be forwarded to, so no DNS is needed. (I suspect most proxy servers will have this kind of functionality - . Some keywords which might help include "Load Balancer, Reverse Proxy, Linux Virtual Server LVS, httpd accellerator". It was a while ago, but I'm pretty sure I used Squid in reverse proxy mode to "forward" requests in a way similar to what you are doing for another client.

  • Thanks David, perfect. "Split DNS" was what I was looking for. – jww Sep 29 '13 at 6:21
  • "...use a "hosts" file on proxy.organization.com" - what concerns me here is external.com changing its DNS, resulting in proxy.organization.com holding stale information. (I keep trying it in my mind, but I keep hitting that stale information problem). – jww Sep 29 '13 at 6:23
  • "You also have not advised what proxy server you are using" - ah, right. I'm writing my own. I've looked at Squid sources, Boost asio, and a number of other source packages like libcurl and libevent. By the time I get done modifying them for my needs (and fixing their errors like lack of hostname validation in SSL/TLS under PKIX), I think I will have spent a considerable amount of time. Writing from scratch means everything meets my standards and I have a cleaner/lighter solution. – jww Sep 29 '13 at 6:27
  • One last comment.... I was actually thinking about having the proxy get the information for external.com out-of-band (i.e., avoid the local DNS altogether). Something like: directly query; or reach back to my org (call it vendor.com) for the information over 443. I think that captures the spirit of use /etc/hosts without the worry about stale information. – jww Sep 29 '13 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.