allow-query restrictions

[Michelle Dick]

I'd like to get more information on how allow-query works.

I tried to set up our nameservers with an options default to allow queries
only internally, and then for each domain
we are authoritative for, set an "allow-query { any; };" in the zone
section.

This works fine, generally.  However, in our domain we have a single CNAME
record pointing to a name in another domain we are not authoritative for.
E.g.  in ourdomain.com zone file we have the record:

xxx	IN	CNAME		yyy.otherdomain.com

But with the allow-query restrictions in place, outside lookups for
xxx.ourdomain.com fail with "query refused".

How can we allow lookups for xxx.ourdomain.com but still deny all other
lookups outside of ourdomain.com?

Michelle Dick
mdick at exp.com