> From: Phil Mayers p.may...@imperial.ac.uk
> To: bind-users@lists.isc.org,
> Date: 05/02/2013 15:44
> Subject: Re: Selective resolution in a corporate environment
>
> On 05/02/13 15:36, funky monkey wrote:
>
> > Could you sandwich that in a forwarding chain - say have a bind
> > 9.<compliant version> in between your normal forwarders to internet, and
> > does it just look fo rthe entries you've specified as either alternate
> > data or does not exist, but otherwise, carries on to forward to an
> > authoritative (or cached, I suppose) version of the domain in question?
>
> Not entirely sure what you're asking, but I don't see any reason you
> couldn't use "forwarders { ... };" to point to an RPZ-enabled server,
> which would be handy to retrofit into bind < 9.8 installations.Sorry, should have probably explained my scenario better... my internal nameservers have a sort of top level (placeholder domain) that are Windows DNS servers, that forward out internet DNS servers for public DNS and anything not resolved internally (by means of either conditional forwarding, or stub zones). All other DNS environments in the organisation (be the BIND or Windows DNS, forward to these 2 "top level" (internal) DNS servers, and only they talk DNS through the firewall to internet DNS. So what I meant was for these 2 DNS servers that go on to forward to the internet, rather than directly forwarding to the internet, forwarding to one (or more) RPZ enabled BIND 9.x servers, which in turn forward on to the internet for anything not specified locally. So say I wanted to resolve fred.domain.com. from something internal, and only www.domain.dom. was specified (kind of as subversion) on these RPZ servers, that not finding a match, they would carry on to attempt to resolve fred.domain.com. from the authoriative domain.com. nameservers (or the first intermediate DNS server that happens to be caching). Hope I've asked that in a bit of a clearer manner! Cheers
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
