<p dir="ltr">Carl, Sten, <br>
Thanks! That's exactly what I was looking for. <br>
Steve</p>
<div class="gmail_quote">On Jan 31, 2014 12:10 PM, "Sten Carlsen" <<a href="mailto:stenc@s-carlsen.dk">stenc@s-carlsen.dk</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I can add that this is what I do to solve the same problem.<br>
<br>
I have one difference that you may consider:<br>
I am a stealth master for my external zone, so all changes to IPs will<br>
be controlled from my side and slaved on the public facing servers.<br>
<br>
On 31/01/14 17:44, Rich Goodson wrote:<br>
> Steve,<br>
><br>
> If you must use the same domain for internal names as external, here is<br>
> one way to do that.<br>
><br>
> On the recursive resolving name server that you use inside your network,<br>
> also make that server authoritative for the domain name in question.<br>
> You’ll need to do double-entry for every externally accessible resource<br>
> record that you also want to access from inside the network.<br>
><br>
> So, for example:<br>
><br>
> External:<br>
> SOA record<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. IN NS <a href="http://ns1.example.com" target="_blank">ns1.example.com</a><br>
> <<a href="http://ns1.example.com" target="_blank">http://ns1.example.com</a>>.<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. IN NS <a href="http://ns2.example.com" target="_blank">ns2.example.com</a><br>
> <<a href="http://ns2.example.com" target="_blank">http://ns2.example.com</a>>.<br>
> ns1 IN A external.ip.address<br>
> ns2 IN A external.ip.address<br>
> www IN A external.ip.address<br>
> mail IN A external.ip.address<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. 10 IN MX <a href="http://mail.example.com" target="_blank">mail.example.com</a><br>
> <<a href="http://mail.example.com" target="_blank">http://mail.example.com</a>>.<br>
><br>
> Internal:<br>
> SOA record<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. IN NS <a href="http://ns3.example.com" target="_blank">ns3.example.com</a><br>
> <<a href="http://ns3.example.com" target="_blank">http://ns3.example.com</a>>.<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. IN NS <a href="http://ns4.example.com" target="_blank">ns4.example.com</a><br>
> <<a href="http://ns4.example.com" target="_blank">http://ns4.example.com</a>>.<br>
> ns3 IN A internal.ip.address<br>
> ns4 IN A internal.ip.address<br>
> www IN A external.ip.address<br>
> mail IN A external.ip.address<br>
> server1 IN A internal.ip.address<br>
> <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. 10 IN MX <a href="http://mail.example.com" target="_blank">mail.example.com</a><br>
> <<a href="http://mail.example.com" target="_blank">http://mail.example.com</a>>.<br>
><br>
> Obviously, if you move your web site to a different server, you’ll need<br>
> to change the IP on both the external and internal name servers.<br>
><br>
> This configuration can cause confusion (you can’t resolve<br>
> <a href="http://name.example.com" target="_blank">name.example.com</a> <<a href="http://name.example.com" target="_blank">http://name.example.com</a>>? what resolver are you<br>
> using?), but it does have some advantages, like you can specify<br>
> <a href="http://jabber.example.com" target="_blank">jabber.example.com</a> <<a href="http://jabber.example.com" target="_blank">http://jabber.example.com</a>> in the external version<br>
> of the zone to resolve to 12.34.56.78, and have <a href="http://jabber.example.com" target="_blank">jabber.example.com</a><br>
> <<a href="http://jabber.example.com" target="_blank">http://jabber.example.com</a>> in the internal version of the zone resolve<br>
> to 10.11.12.13, but it depends on everyone inside the company using your<br>
> supplied recursive resolvers.<br>
><br>
> You can also keep recursive and authoritative separate by doing<br>
> approximately this same thing but dedicating a server to your internal<br>
> zone(s), then on your recursive resolvers using a forward statement or<br>
> stub zones to short circuit recursion for that/those particular domain<br>
> name(s).<br>
><br>
> Is this the right way to manage your name space? I don’t know, but<br>
> that’s a whole other argument. Some people will tell you that you<br>
> should absolutely use a different name internally than you do out on the<br>
> Internet. Some companies use <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> outside<br>
> and example.corp inside (this is what my current company does), but when<br>
> the .corp TLD gets approved sometime in the indefinite and unknowable<br>
> future, all of a sudden there are big problems (or a big migration).<br>
><br>
> Good luck,<br>
><br>
> -Rich<br>
><br>
> On Jan 31, 2014, at 10:10 AM, Steve Presser <<a href="mailto:steve@pressers.name">steve@pressers.name</a><br>
> <mailto:<a href="mailto:steve@pressers.name">steve@pressers.name</a>>> wrote:<br>
><br>
>> Hey all,<br>
>> Please forgive me if any of my terminology is off - I have not spent<br>
>> as much time in the documentation as I'd like.<br>
>> I have an odd situation that I would like to know if it is possible<br>
>> and would much appreciate a pointer to any relevant documentation or<br>
>> write-ups.<br>
>> I manage a domain name which, for reasons of reliability, uses an<br>
>> externally managed DNS server (zoneedit). We're looking to add private<br>
>> network DNS for internal machines. I've got BIND up and running on an<br>
>> internal machine. However, we have public records that need to be<br>
>> accessible internally (SPF, DKMS, jabber servers, MXs, etc).<br>
>> Additionally, using an internal-only namespace is not an option, due<br>
>> to laptops which go in and out of the network and need to be able to<br>
>> connect without settings modification.<br>
>> I'm trying to figure out how to do some sort of pass through<br>
>> arrangement, where the internal BIND server will first attempt to do<br>
>> the lookup with local records. If it has no local record, it will then<br>
>> fall back to the answer returned by the external (zoneedit) server.<br>
>> I know that if there was only one server, this would simply be split<br>
>> horizon. However, I don't know what to call this setup, and am having<br>
>> a hard time searching for it because of that. (So I apologize if this<br>
>> is then a dumb question).<br>
>><br>
>> Any help you can offer is much appreciated. Thanks!<br>
>> Steve<br>
>><br>
>> _______________________________________________<br>
>> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to<br>
>> unsubscribe from this list<br>
>><br>
>> bind-users mailing list<br>
>> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a> <mailto:<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>><br>
>> <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
><br>
> bind-users mailing list<br>
> <a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
> <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
><br>
<br>
--<br>
Best regards<br>
<br>
Sten Carlsen<br>
<br>
No improvements come from shouting:<br>
<br>
"MALE BOVINE MANURE!!!"<br>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>