<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">I am attempting to set up an internal DNS server that is authoritative for internal resources, but also will respond for external resources on the same domain that it does not have records for.</div><div class=""><br class=""></div><div class="">For example, I have a domain <a href="http://sub.example.com" class="">sub.example.com</a>, and I want to have internal entries in the BIND zone file for <a href="http://host1.sub.example.com" class="">host1.sub.example.com</a> and <a href="http://host2.sub.example.com" class="">host2.sub.example.com</a>. That part is working fine. However, there is a publicly available DNS entry for <a href="http://sub.example.com" class="">sub.example.com</a> that I want my internal clients to be able to resolve, but I don’t want to have the IP in the BIND zone file, because the IP is dynamic. There are also some hosts (<a href="http://host3.sub.example.com" class="">host3.sub.example.com</a>) and (<a href="http://host4.sub.example.com" class="">host4.sub.example.com</a>) that are externally resolvable that I don’t want to put in my internal BIND file because they are not controlled by me. (Think CNAME to a SaaS application)</div><div class=""><br class=""></div><div class="">I’ve attempted to do this as follows, and it seems to make sense that it would work, but it does not. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">named.conf:</div><div class=""><br class=""></div><div class=""><div class="">zone “<a href="http://sub.example.com" class="">sub.example.com</a>" IN {</div><div class=""> type master;</div><div class=""> file "/etc/bind/sub.example.com.zone";</div><div class=""> forward first;</div><div class=""> forwarders { 1.1.1.1; 1.0.0.1; };</div><div class="">};</div></div><div class=""><br class=""></div><div class=""><a href="http://sub.example.com" class="">sub.example.com</a>.zone:</div><div class=""><br class=""></div><div class=""><div class="">$ORIGIN <a href="http://sub.example.com" class="">sub.example.com</a>.</div><div class="">$ttl 600</div><div class="">@ 300 SOA <a href="http://dns.sub.example.com" class="">dns.sub.example.com</a>. (</div><div class=""> <a href="http://taylor.viertaxa.com" class="">taylor.viertaxa.com</a>. ; address of responsible party</div><div class=""> 2020090101 ; serial number</div><div class=""> 300 ; refresh period</div><div class=""> 300 ; retry period</div><div class=""> 604800 ; expire time</div><div class=""> 300 ) ; minimum ttl</div><div class=""> 300 NS <a href="http://elinore.ns.cloudflare.com" class="">elinore.ns.cloudflare.com</a>.</div><div class=""> 300 NS <a href="http://hal.ns.cloudflare.com" class="">hal.ns.cloudflare.com</a>.</div><div class="">host1 60 A 10.x.x.x</div><div class="">host2 60 A 10.x.x.x</div></div><div class=""><br class=""></div><div class="">What I would expect to happen, is that BIND sees “forward first” and attempts to look up the hostname <a href="http://host3.sub.example.com" class="">host3.sub.example.com</a> on the listed forwarders, and succeeds (there’s an entry publicly available for that one. </div><div class=""><br class=""></div><div class="">What actually happens, is if I query for <a href="http://sub.example.com" class="">sub.example.com</a> I get the following from nslookup:</div><div class="">*** Can't find <a href="http://sub.example.com" class="">sub.example.com</a>: No answer</div><div class=""><br class=""></div><div class="">And if I query for <a href="http://host3.example.com" class="">host3.example.com</a>, I get the following from nslookup:</div><div class="">** server can't find <a href="http://host3.sub.example.com" class="">host3.sub.example.com</a>: NXDOMAIN</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">BIND version:</div><div class=""><br class=""></div><div class=""><div class="">Package: bind9</div><div class="">Version: 1:9.11.5.P4+dfsg-5.1+deb10u2</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thank you in advance for any help you might be able to provide. </div></body></html>