Hi Greg,
thank you very much for your explanation.
Let’s supposte AD domain was ‘my domain.it’ and I have 6000 computers of government institute.
Here my bind configuration:
named.conf
———
include “…. named.conf.options" ;
zone "." IN {
type hint;
file "named.ca";
};
include “…. named.rfc1912.zones";
include “…. named.root.key";
———
named.conf.options
———
logging {
channel named_debug {
syslog local6;
severity debug 1;
print-category yes;
print-severity yes;
print-time yes;
};
category default { named_debug; };
};
options {
auth-nxdomain no; # conform to RFC1035
allow-recursion {127.0.0.1; A.B.C.D; dc1.mydomain.it; dc2.mydomain.it; ….. } ;
allow-query {127.0.0.1; A.B.C.D; dc1.mydomain.it; dc2.mydomain.it; ….. } ;
recursive-clients 3000;
allow-query-cache {127.0.0.1; A.B.C.D; dc1.mydomain.it; dc2.mydomain.it; ….. } ; ;
listen-on port 53 { 127.0.0.1; A.B.C.D; };
directory “….. named";
dump-file “….. cache_dump.db";
statistics-file “….. named_stats.txt";
memstatistics-file “…. named_mem_stats.txt";
recursing-file “… named.recursing";
secroots-file “… named.secroots";
recursion yes;
dnssec-enable no;
dnssec-validation no;
bindkeys-file "….. named.iscdlv.key";
managed-keys-directory "….. dynamic";
pid-file "….. named.pid";
session-keyfile "….. session.key";
———
>Thirdly, I would not forward to AD DNS, unless the AD servers also recurse and can provide >resolution for delegated names below the AD domain
>that are not hosted on the AD servers themselves.
There is no forward option to AD DNS. Forward is enable from AD DNS to A.B.C.D. bind9 server.
All clients are using AD DNS infact every query, about name of ‘mydomain.it,’ is resolved from AD DNS.
When client asks an external domain, e.g. www.google.it, AD server forward query to A.B.C.D. server. (Forward option is set on every domain controller)
Only AD DNS make queries to A.B.C.D server and it’s necessary only to solve external domains.
A.B.C.D. server never makes queries to AD server. A.B.C.D. is next dns server which partecipates when it’s necessary to resolve an external domain
I hope to have explained right.
I thought A.B.C.D server made query to root server because into configuration there is no reference to forward option, because I thought to set as DNS forward a government dns of my country. What do you think?
I have doubts about recursive and iterative queries options too.
Thanks
