Hi Brian.
If that's what you want to do; answer authoritatively from local zones you
own and forward everything else to Corporate, then you have it correct.
"forwarders {...etc" and "forward only;" go in the "options" block.
Since you are forwarding everything that's not local *and* disabling
recursion if forwarding fails, you don't need the hint zone at all; please
delete it.
Actually you don't need it anyway, even if you are doing recursion, as
Internet root hints have been built into BIND for many years. The only
reason you would need a hint zone is to define custom roots for a private
network that is *completely* isolated from the Internet. Your corporate
network does not meet that criterion because your corporate DNS servers
will be answering names from the Internet. Therefore, lose the hint zone.
I hope that helps.
Greg
On Mon, 9 Dec 2024 at 21:34, Cuttler, Brian R (HEALTH) via bind-users <
bind-users@lists.isc.org> wrote:
> Hello, looking for a sanity check.
>
>
>
> Inside our network we are running BIND 9.18.28-0ubuntu0.22.04.1-Ubuntu on
> Ubuntu 22.04.5 LTS
>
>
>
> Currently our server serves our own zones files - A/CNAME/PTR/TXT/etc
> records for our domain.
> We have already modified the db.cache file to reference two servers
> provided by our corporate IT rather than using the internet root servers.
>
> We have numerous forwarder zones for corporate zones, both forward and
> reverse zones.
>
>
>
> We are looking to no longer use recursion but rely entirely on the
> corporate servers for anything we would normally resolve from external
> servers.
>
>
>
> I think all we need to do is create a forwarders stanza set “forwarder only”
> , similar to(but with the correct IPS)
>
>
> forwarders {
>
> 1.2.3.4; # External DNS
>
> 1.2.3.5; # External DNS
>
> };
>
> forward only;
>
>
>
> The desire is to continue to use our own zone files, and to continue to
> use the already established fowarder zones, but to replace recursion
> managed by our own internal servers with queries to ONLY the 2 servers we
> are already using as replacement root servers.
>
>
>
> Seems so simple that I have to believe I’ve missed something.
>
>
>
> Thanks in advance,
>
> Brian
>
>
>
>
>
>
>
> Brian Cuttler, System and Network Administration
>
> Wadsworth Center, NYS Department of Health
>
> Albany, NY 12201 POB 509
>
> brian.cutt...@health.ny.gov
>
> 518 486-1697
>
>
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> ISC funds the development of this software with paid support
> subscriptions. Contact us at https://www.isc.org/contact/ for more
> information.
>
>
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
