<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body style="word-wrap:break-word; color:rgb(0,0,0); font-size:14px; font-family:Calibri,sans-serif" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>Howdy John,</div>
<div><br>
</div>
<div>Eh, I was afraid of that <sad> let me try again.</div>
<div><br>
</div>
<div>Can something like this:</div>
<div><br>
</div>
<div>[ internal recursive resolver + non-authoritative slave for foo.edu ] <-> [ internal authoritative slave for foo.edu ] <-> [ internal hidden master for foo.edu | external hidden master for foo.edu ] <-> [ external authoritative slave for foo.edu / listed
in whois ]</div>
<div><br>
</div>
<div>... be safely collapsed to this:</div>
<div><br>
</div>
<div>[ internal recursive resolver + authoritative slave for foo.edu ] <-> [ internal hidden master for foo.edu | external hidden master for foo.edu ] <-> [ external authoritative slave for foo.edu / listed in whois ]</div>
<div><br>
</div>
<div>... or this *shudder*:</div>
<div><br>
</div>
<div>
<div>[ internal recursive resolver + non-authoritative slave for foo.edu ] <-> [ internal hidden master for foo.edu | external hidden master for foo.edu ] <-> [ external authoritative slave for foo.edu / listed in whois ]</div>
</div>
<div><br>
</div>
<div>The first case seems like it is wasting N copies of [ internal authoritative slave for foo.edu ] that aren't ever used for anything except dynamic updates (and not even that if you don't allow it, so possibly literally sitting idle).</div>
<div><br>
</div>
<div>The second case seems unsafe on the concern of cache poisoning risks, but... is it really necessary to invoke the fairly size-able case 1 to avoid cache poisoning? This feels like too much of an edge case to easily answer with Mark Andrew's comments on
"strict separation lore".</div>
<div><br>
</div>
<div>The third case seems efficient, but ridiculous and not really possible; e.g. what would you put in the NS/SOA records to keep the master hidden and the slaves non-authoritative?</div>
<div><br>
</div>
<div>Thanks again,</div>
<div><br>
</div>
<div>-Mathew Eis</div>
<div><br>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF523209" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> John W. Blue [john.blue@rrcic.com]<br>
<b>Sent:</b> Monday, April 04, 2016 7:12 PM<br>
<b>To:</b> Mathew Ian Eis; bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Split horizon and authoritative servers<br>
</font><br>
</div>
<div></div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">
<div>
<div>Hello Matthew,</div>
<div><br>
</div>
<div>
<div>I am mobile right now and a bit distracted sitting here in a parking lot so what exactly your question is eludes me.</div>
<div><br>
</div>
<div><grin></div>
</div>
<div><br>
</div>
<div>Speaking from experience, running a split horizon environment has several advantages and is quit liberating. For example, internally your BIND servers can be authortative for the root of your zone and then you delegate a subzone to Active Directory. It
keeps external/internal root neat and tidy and internally allows Active Directory the freedom to run dynamic updates without risk of leakage.</div>
<div><br>
</div>
<div>Every host get DNS from the Domain Controllers and the DC's get recursion exclusively from BIND.</div>
<div><br>
</div>
<div>That said, you will want authorative name severs for both external and internal. If you choose to go with hidden external/internal masters that is fine. No need to separate the roles of the slaves out unless there is an unknown operational requirement.</div>
</div>
<div><br>
</div>
<div>Finally, if you have a lot of RR churn, look to an IPAM solution the help shoulder the load. Editing db files by hand is asking for mistakes to be made.</div>
<div><br>
</div>
<div>Hope that helps!</div>
<div><br>
</div>
<div>John</div>
<div><br>
</div>
<div id="signature-x" style="">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF" target="_blank">
Nine</a></div>
</div>
<div id="quoted_header" style="clear:both"><br>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Mathew Ian Eis <Mathew.Eis@nau.edu><br>
<b>Sent:</b> Apr 4, 2016 7:38 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Split horizon and authoritative servers<br>
</span></div>
</div>
<br type="attribution">
<div>
<div>Hi BIND,</div>
<div><br>
</div>
<div>I have a question about authoritative servers in a split horizon environment (suppose two views “internal” and “external”).</div>
<div><br>
</div>
<div>Is is necessary to have separate internal authoritative (listed in internal zone NS records, but not in whois or external NS records) servers, if the internal recursive servers are also authoritative (in the same way) slaves to an internal hidden master
for the relevant zones?</div>
<div><br>
</div>
<div>It seems like cache poisoning should not be a concern, since the only servers listed in the (internal) NS records would as slaves always have full copies of relevant zones, and would not actually be recursing for those records. I can’t think of any other
reason to separate the internal authoritative slaves and the internal recursive resolvers… am I missing anything obvious?</div>
<div><br>
</div>
<div>Thanks in advance,</div>
<div><br>
</div>
<div>
<div id="">
<div>
<div>
<div>Mathew Eis</div>
<div>Northern Arizona University</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>