On Mon, Aug 16, 2010 at 2:24 PM, Matus UHLAR - fantomas
<uh...@fantomas.sk> wrote:
> On 16.08.10 13:48, recvf...@gmail.com wrote:
>> I have several internal DNS servers, one of which is a hidden master
>> for external zones. The nameserver listed in the SOA RR is in a DMZ.
>> The internal DNS servers forward all queries for non-authoritative
>> zones to a DNS server in the DMZ that will perform recursive queries,
>> but the internal nameservers are restricted from sending queries or
>> notifications to outside nameservers (and even if they were, it's
>> unlikely that a third-party slave would accept notifies from anything
>> but the master as listed in the SOA RR). What is the recommended
>> method to configure DNS notify for the internal hidden master? I
>> recognize that I can specify 'notify-to-soa yes;' in the view
>> statement (in which all of these zones are placed; or in individual
>> zone statements), but that will still result in attempted notification
>> to all of the other NS RRs for the zone. I'd prefer that the hidden
>> master notify the NS listed in the SOA RR, and that nameserver issue
>> notification to all of the other NS RRs after it has pulled the
>> zone(s). Will 'notify-to-soa yes;' still initiate a notification even
>> if I turn off notify via 'notify no;'?
>
> I would recommend you:
> - put real (hidden) master to SOA
> - put "notify explicit; also-notify { slave-1; slave-2; };" into its
> configuration
Ahhh, I had forgotten about 'notify explicit;' -- that's exactly what I needed!
I implemented as follows:
Hidden master -- notify --> SOA MNAME -- notify --> all other slaves.
> so the hidden master will only send notifies to your public slaves,
> abd the public slave(s) will send notifies to third party slaves.
>
> ...if you have some third-party slaves, they _must_ fetch the zone from one
> of your servers, your public slaves if not the hidden master. So they can
> send notifies.
Since the hidden master is not publicly accessible, I left it out of
the SOA, but all of your other suggestions were perfect.
> And in fact there's nothing bad in your hidden master sending the notifies
> to all NSs...
Well, except that were all just dropped on the floor at the firewall,
as intended. ;-)
Many thanks!!!
-r
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
