What is the proper way to delegate to a private / hidden sub-domain?

[Sten Carlsen]

I have been doing that for quite some time without knowing it should be difficult.

I have a domain (in the mail address) which is properly delegated to servers and signed. Internally in house I have a number of other internal both hosts and one subdomain.

The internal versions have RFC1812 IPs and the outside ones have public IPs.

Both sides are signed by the same key.

The way this is organised is that I use two views, one internal and one external, I set both to be signed using:

options {
	directory "/var/named/data";
	auth-nxdomain no;
	dnssec-enable yes;
	dnssec-validation auto;
	allow-query { any; };
	allow-transfer { any; };
	listen-on-v6  { any; };
	sig-validity-interval 30 20;
	dnssec-loadkeys-interval 60;
};

Never caused any problems. The downside is that I use views and have to manage both sides.
--
Best regards
Sten Carlsen


For every problem, there is a solution that
is simple, elegant, and wrong.
HL Mencken


> On 6 May 2020, at 19.01, Grant Taylor via bind-users <bind-users at lists.isc.org> wrote:
> 
> Hi,
> 
> What is the proper way to delegate to a private / hidden sub-domain?
> 
> I have a globally registered domain, call it example.net for this thread, that has multiple sub-domains that I'd like to be properly delegated to internal labs; lab#.example.net.
> 
> Example.net itself is following all the industry standards and best practices that I'm aware of; registered (read: rented), delegated from roots to multiple public DNS servers which respond to the world.
> 
> I would like to delegate lab1.example.net in such a way that the outside world sees a delegation to what is effectively an empty zone (save for SOA / NS / etc.) on a public server.  However I'd like the internal lab systems see a delegation to a private zone that has all the necessary records in the lab.
> 
> One hack that comes to mind is to have the example.net parent zone delegate to a separate name server with a separate IP and then to anycast that IP & name server inside the lab.  But that would require an additional globally routed IP on the external public Internet.
> 
> I'm not currently worried about supporting DNSSEC, but it would be nice if the solution would allow DNSSEC signing both the public and private zones.  With the obvious assumption being the DNS servers would have shared keys to be able to sing their copies of the zone correctly.
> 
> Does anybody have any ProTip(s) on how to go about doing this?  What about gotchas to avoid?
> 
> Thank you and have a nice day.
> 
> 
> 
> --
> Grant. . . .
> unix || die
> 
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200506/5a59210d/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200506/5a59210d/attachment.bin>