Hi, What is the proper way to delegate to a private / hidden sub-domain?
I have a globally registered domain, call it example.net for this thread, that has multiple sub-domains that I'd like to be properly delegated to internal labs; lab#.example.net.
Example.net itself is following all the industry standards and best practices that I'm aware of; registered (read: rented), delegated from roots to multiple public DNS servers which respond to the world.
I would like to delegate lab1.example.net in such a way that the outside world sees a delegation to what is effectively an empty zone (save for SOA / NS / etc.) on a public server. However I'd like the internal lab systems see a delegation to a private zone that has all the necessary records in the lab.
One hack that comes to mind is to have the example.net parent zone delegate to a separate name server with a separate IP and then to anycast that IP & name server inside the lab. But that would require an additional globally routed IP on the external public Internet.
I'm not currently worried about supporting DNSSEC, but it would be nice if the solution would allow DNSSEC signing both the public and private zones. With the obvious assumption being the DNS servers would have shared keys to be able to sing their copies of the zone correctly.
Does anybody have any ProTip(s) on how to go about doing this? What about gotchas to avoid?
Thank you and have a nice day. -- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
