<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head><body lang="EN-GB" link="blue" vlink="purple"><div class="WordSection1">
<p class="MsoNormal">We have an external named server (BIND 9.8.2rc1-RedHat-9.8.2-0.37.rc1.el6_7.6) running on Centos 6.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This server is authoritative for all the zones hosted on it (I’ll call it
<i>mydomain.com</i>). We have a new sub-domain (<i>new.mydomain.com</i>) where a different DNS server is authoritative for the single zone. The DNS server for
<i>new.mydomain.com</i> is working ok, but I’m having trouble getting the BIND servers in
<i>mydomain.com</i> to forward requests to the DNS server in <i>new.mydomain.com </i>
that they receive.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We use the view directive in our main BIND servers to control internal and external access to the zones.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is the declaration from our “internal” view<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">view "internal" {<o:p></o:p></p>
<p class="MsoNormal"> match-clients { "our-net"; };<o:p></o:p></p>
<p class="MsoNormal"> allow-query { "our-net"; };<o:p></o:p></p>
<p class="MsoNormal"> recursion yes;<o:p></o:p></p>
<p class="MsoNormal"> additional-from-auth yes;<o:p></o:p></p>
<p class="MsoNormal"> additional-from-cache yes;<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <zone files here><o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is the declaration from our “external” view<o:p></o:p></p>
<p class="MsoNormal"><i><o:p> </o:p></i></p>
<p class="MsoNormal">view "external" {<o:p></o:p></p>
<p class="MsoNormal"> match-clients { "any"; };<o:p></o:p></p>
<p class="MsoNormal"> allow-query { "any"; };<o:p></o:p></p>
<p class="MsoNormal"> recursion no;<o:p></o:p></p>
<p class="MsoNormal"> additional-from-auth no;<o:p></o:p></p>
<p class="MsoNormal"> additional-from-cache no;<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"> <zone files here><o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">“Internal” is listed first in named.conf, followed by “external”. I only want resolution for
<i>new.mydomain.com</i> to work from the external view, but we disable recursion in that zone for good reason. I’ve tried adding
<i>new.mydomain.com</i> as a zone to the “external” view with the ‘type forward’ and ‘forwarders’, but I think the ‘recursion no’ setting in the external view is overriding this, as it still doesn’t work.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I tried adding a new view “other” at the end of named.conf with ‘recursion yes’, but initially this didn’t seem to work either. Out of curiosity, I moved this new view above our “internal” view so it was processed first, and then it worked.
Initially, all looked good, but then it became apparent that everything in the “external” view no longer resolved at all (everything was denied). So, I’m aware that ‘views’ are processed in the order listed in named.conf, but is there a limit on the number
of ‘view’ directives, and if not, why did the ‘other’ view only work when it was listed first?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been pulling my hair out on this one, and it just doesn’t make sense.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for any help<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tony<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br />
<br />
<p style="margin-top:2em;font-family:arial,sans-serif;font-size:9pt">Follow Us: <a href="http://www.linkedin.com/company/roke-manor-research" title="LinkedIn" target="_blank">LinkedIn</a> | <a href="http://plus.google.com/+rokemanor" title="Google+" target="_blank">Google+</a> | <a href="https://twitter.com/rokemanor" title="Twitter" target="_blank">Twitter</a> | <a href="https://www.facebook.com/rokemanor" title="Facebook" target="_blank">Facebook</a></p>
<p style="font-family:arial,sans-serif;font-size:9pt"><span style="color:#C80000">Please update your address book.</span> Roke has transitioned to its original brand and is no longer branded as Chemring Technology Solutions. Email addresses of Roke staff have therefore been changed from <span style="font-style:italic;"><i>.@chemringts.com</i></span> to <span style="font-style:italic;"><i>.@roke.co.uk</i></span> - please use this updated format with immediate effect.</p>
<p style="font-family:arial,sans-serif;font-size:9pt; color:#808080">Roke Manor Research Limited, Romsey, Hampshire, SO51 0ZN, United Kingdom. Part of the Chemring Group. Registered in England & Wales. Registered No: 00267550. The information contained in this e-mail and any attachments is proprietary to Roke Manor Research Limited and must not be passed to any third party without permission. This communication is for information only and shall not create or change any contractual relationship.<br /><a href="http://www.roke.co.uk/?utm_source=Roke&utm_medium=Email&utm_content=Company%20Signature&utm_campaign=Roke" title="Website" target="_blank">www.roke.co.uk</a></p>
<hr style="font-family:arial,sans-serif;font-size:9pt" />
</body></html>