<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Monaco;
panose-1:2 0 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I have been banging my head against the wall regarding this very topic and then found this thread from last week. I’m also looking for a solution to this problem, and wondered if anyone may have some suggestions (including potential alternatives).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My situation is due to a security requirement. We have DNS servers at our site running BIND that allow recursion, but I’ve been requested to set up some additional DNS servers for another project that is expected to *<b>only</b>* access
the data that we’re authoritative for. And of course …. there’s a chance that it might need to look up one or two external zones. Essentially, what I really need is a recursive whitelist that doesn’t tell BIND what clients are allowed to do recursive lookups,
but to limit BIND to only allow recursive lookups on a very small list of allowed domains.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I was trying to set up a forwarding zone to forward queries to our DNS servers that do allow recursion, but as I discovered (and as was discussed earlier in the thread), if recursion is not allowed, then forwarding is also not allowed.
I had tried setting the “allow-recursion” field to “localhost” and setting up a forward zone to forward to 127.0.0.1, but that didn’t work either.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is there any potential workaround for this, or do I just need to tell the person who requested this that they can only get all or nothing for recursive queries? We’re still running BIND 9.11, but I was wondering if there may be new features
in BIND 9.16 or 17 that I’m not aware of.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Brian<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:Monaco;color:black">-- </span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Monaco;color:black">Brian Sebby (he/him/his) | Lead Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Monaco;color:black">Email:
<a href="mailto:sebby@anl.gov"><span style="color:#0563C1">sebby@anl.gov</span></a> | Information Technology Infrastructure</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Monaco;color:black">Phone: +1 630.252.9935 | Business Information Services</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Monaco;color:black">Cell: +1 630.921.4305 | Argonne National Laboratory</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">bind-users <bind-users-bounces@lists.isc.org> on behalf of RK K <rvkota@gmail.com><br>
<b>Date: </b>Wednesday, April 7, 2021 at 7:40 PM<br>
<b>To: </b>"bind-users@lists.isc.org" <bind-users@lists.isc.org><br>
<b>Subject: </b>Re: forwarding zone setup from a BIND slave (without recursion?)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Hello Marki, Matus,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you for the insights on this topic.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Answering Marki's question about why the secondary-authoritative (slaves) are used for lookups is some-what history and there was no need to be recursive (until now) as all the queries are authoritatively answered or refused. May be security
is another reason.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Much appreciated your ideas<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Kind Regards<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">RK<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Apr 7, 2021 at 8:01 AM <<a href="mailto:bind-users-request@lists.isc.org">bind-users-request@lists.isc.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Send bind-users mailing list submissions to<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">
https://lists.isc.org/mailman/listinfo/bind-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:bind-users-request@lists.isc.org" target="_blank">bind-users-request@lists.isc.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:bind-users-owner@lists.isc.org" target="_blank">bind-users-owner@lists.isc.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of bind-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. forwarding zone setup from a BIND slave (without recursion?)<br>
(RK K)<br>
2. Re: forwarding zone setup from a BIND slave (without<br>
recursion?) (Matus UHLAR - fantomas)<br>
3. Re: forwarding zone setup from a BIND slave (without<br>
recursion?) (Marki)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 6 Apr 2021 22:47:23 -0400<br>
From: RK K <<a href="mailto:rvkota@gmail.com" target="_blank">rvkota@gmail.com</a>><br>
To: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: forwarding zone setup from a BIND slave (without recursion?)<br>
Message-ID:<br>
<<a href="mailto:CAOtBJRuBejLxC6-UFf5kGkD_iGnOyTg_ku2PkdXbhPoVYzSuUA@mail.gmail.com" target="_blank">CAOtBJRuBejLxC6-UFf5kGkD_iGnOyTg_ku2PkdXbhPoVYzSuUA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
All,<br>
<br>
We have a set of BIND primary servers (MASTERs) and a set of secondary<br>
servers (slaves to the MASTERs).<br>
The secondary BIND DNS servers disabled recursion ( with "*recursion no;" *)<br>
in the global options.<br>
All the applications/systems do use secondary DNS servers for name<br>
resolution.<br>
<br>
Now there is a need to configure a forwarding zone in the "secondary DNS<br>
servers" to an external DNS server.<br>
<br>
In this scenario, in-order for the secondary server to forward the DNS<br>
query to an external DNS server, is it required to enable the recursion in<br>
the global options on the secondary servers?<br>
Based on reference material, I did not see such a requirement. But my<br>
observation is the query is not getting forwarded ( tried to check using<br>
the packet trace)<br>
When recursion is enabled, the query is getting forwarded.<br>
<br>
The BIND version I am using is 9.11.2.x.<br>
<br>
Appreciate your ideas and help.<br>
<br>
Thank you<br>
Kind Regards,<br>
Ravi Kota<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20210406/15bb6cad/attachment-0001.htm" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20210406/15bb6cad/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 7 Apr 2021 10:35:12 +0200<br>
From: Matus UHLAR - fantomas <<a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a>><br>
To: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: forwarding zone setup from a BIND slave (without<br>
recursion?)<br>
Message-ID: <<a href="mailto:20210407083512.GA19977@fantomas.sk" target="_blank">20210407083512.GA19977@fantomas.sk</a>><br>
Content-Type: text/plain; charset=us-ascii; format=flowed<br>
<br>
On 06.04.21 22:47, RK K wrote:<br>
>We have a set of BIND primary servers (MASTERs) and a set of secondary<br>
>servers (slaves to the MASTERs).<br>
>The secondary BIND DNS servers disabled recursion ( with "*recursion no;" *)<br>
>in the global options.<br>
>All the applications/systems do use secondary DNS servers for name<br>
>resolution.<br>
><br>
>Now there is a need to configure a forwarding zone in the "secondary DNS<br>
>servers" to an external DNS server.<br>
><br>
>In this scenario, in-order for the secondary server to forward the DNS<br>
>query to an external DNS server, is it required to enable the recursion in<br>
>the global options on the secondary servers?<br>
<br>
yes.<br>
<br>
>Based on reference material, I did not see such a requirement. But my<br>
>observation is the query is not getting forwarded ( tried to check using<br>
>the packet trace)<br>
>When recursion is enabled, the query is getting forwarded.<br>
><br>
>The BIND version I am using is 9.11.2.x.<br>
<br>
-- <br>
Matus UHLAR - fantomas, <a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a> ;
<a href="http://www.fantomas.sk/" target="_blank">http://www.fantomas.sk/</a><br>
Warning: I wish NOT to receive e-mail advertising to this address.<br>
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br>
It's now safe to throw off your computer.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 7 Apr 2021 10:59:30 +0200<br>
From: Marki <<a href="mailto:bind-users@lists.roth.lu" target="_blank">bind-users@lists.roth.lu</a>><br>
To: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: forwarding zone setup from a BIND slave (without<br>
recursion?)<br>
Message-ID: <<a href="mailto:e1ab189a-1c38-8a52-5b12-b3af9e0a1a30@lists.roth.lu" target="_blank">e1ab189a-1c38-8a52-5b12-b3af9e0a1a30@lists.roth.lu</a>><br>
Content-Type: text/plain; charset="utf-8"; Format="flowed"<br>
<br>
Hello,<br>
<br>
On 4/7/2021 10:35 AM, Matus UHLAR - fantomas wrote:<br>
> On 06.04.21 22:47, RK K wrote:<br>
>> In this scenario, in-order for the secondary server to forward the DNS<br>
>> query to an external DNS server, is it required to enable the <br>
>> recursion in<br>
>> the global options on the secondary servers?<br>
><br>
> yes. <br>
<br>
To elaborate a little bit on that... Indeed that is how it works, <br>
unfortunately. When you start using forwarders or stubs, recursion needs <br>
to be enabled because you're no longer looking for your own <br>
authoritative data only.<br>
<br>
What I've learned from this list is that you should split authoritative <br>
and recursive service.<br>
<br>
In other words, you need two types of servers:<br>
<br>
1) A non-recursive one in the backend containing your authoritative <br>
zones only. This can be a hidden master setup, somewhat like what you <br>
are using now.<br>
<br>
2) The one your users access has recursion enabled, and contains stubs <br>
to the authoritative service. Obviously, it can also contain stubs (or <br>
forwarders) to anywhere else. At the same time it is performing full <br>
recursive service unless you take authority for the root zone.<br>
<br>
May I ask what is the reasoning behind your current setup (pointing your <br>
users to the non-recursive service)? What would you like to achieve? <br>
What would you like to prevent?<br>
<br>
Bye,<br>
<br>
Marki<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.isc.org/pipermail/bind-users/attachments/20210407/b96c3543/attachment-0001.htm" target="_blank">https://lists.isc.org/pipermail/bind-users/attachments/20210407/b96c3543/attachment-0001.htm</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of bind-users Digest, Vol 3678, Issue 1<br>
*******************************************<o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>