<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<p>On 02-Aug-22 11:09, <a class="moz-txt-link-abbreviated" href="mailto:bind-users-request@lists.isc.org">bind-users-request@lists.isc.org</a> wrote:</p>
<blockquote type="cite"
cite="mid:mailman.1098.1659452963.56945.bind-users@lists.isc.org">
<pre class="moz-quote-pre" wrap="">| Before your authoritative view, define a recursive view with the internal
! zones defined as static-stub, match-recursive-only "yes", and a
! server-address of localhost.
Uh? Why before?</pre>
</blockquote>
<p>Because each request attempts to match the views in order. You
want the stub view to match recursive requests. The non-RD
requests will fall thru to the internal zone and get the
authoritative data. The latter includes the requests that the
stub zone makes for authoritative data for its zones. (You don't
want the authoritative view to match the recursive requests, since
that will not return AD.) The ordered evaluation is why
"match-clients {any;}};" in the "external" (last) view does NOT
match the preceding views.<br>
</p>
<p>Then any non-matching clients (e.g. external) go thru the same
process. Generally external follows internal because you know how
to match internal (e.g. your IP addresses / RCC1918 addresses),
and "external" is everyone else.</p>
I find that views require less management than multiple instances,
and properly set up, I don't buy the "safety in separate instances
for authoritative and recursive servers" But that's somewhat of a
religious discussion - there are arguments on both sides. <br>
<p>In any case, the point is that contrary to other advice, it IS
possible to run an authoritative server that also returns AD to
recursive requests. <br>
</p>
<p>You seem to have more than two views - that doesn't change the
principle. For each authoritative view that you want to return
AD, you need to add a recursive view that is a static-stub.<br>
</p>
<p>The outline that I provided is extracted from my working
configuration.<br>
</p>
<p>You do need the allow-* and match-clients, but those are
site-specific.</p>
<p>You can also slave the root zone - that's orthogonal to AD.</p>
<p>I suggest taking one step at a time.<br>
</p>
<pre class="moz-signature" cols="72">Timothe Litt
ACM Distinguished Engineer
--------------------------
This communication may not represent the ACM or my employer's views,
if any, on the matters discussed.
</pre>
<blockquote type="cite"
cite="mid:mailman.1098.1659452963.56945.bind-users@lists.isc.org">
</blockquote>
<blockquote type="cite"
cite="mid:mailman.1098.1659452963.56945.bind-users@lists.isc.org">
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
</body>
</html>