<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1029" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>Hello guys<o:p></o:p></p><p class=MsoNormal>Asking for your help, again.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So after setting up DNSSEC I’ve found I couldn’t reach some internal sites on my top domain, served by internal DNS servers<o:p></o:p></p><p class=MsoNormal>There’s no need in hiding domains as my e-mail is shown here.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Top domain<o:p></o:p></p><p class=MsoNormal><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="Arrow_x003a__x0020_Down_x0020_1" o:spid="_x0000_s1028" type="#_x0000_t75" style='position:absolute;margin-left:2.25pt;margin-top:2.6pt;width:18.75pt;height:24.75pt;z-index:251659264;visibility:visible;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text'>
<v:imagedata src="cid:image003.png@01D972A6.676FD460" o:title="" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><![endif]--><![if !vml]><span style='mso-ignore:vglayout'><table cellpadding=0 cellspacing=0 align=left><tr><td width=3 height=4></td></tr><tr><td></td><td><img width=25 height=33 style='width:.2604in;height:.3437in' src="cid:image003.png@01D972A6.676FD460" v:shapes="Arrow_x003a__x0020_Down_x0020_1"></td></tr></table></span><![endif]><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><br style='mso-ignore:vglayout' clear=ALL><p class=MsoNormal>ubi.pt (external DNS Servers authoritative)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> Internal DNS servers (windows, Active directory - Recursive)<o:p></o:p></p><p class=MsoNormal style='text-indent:36.0pt'><span lang=PT> Internalsite1.ubi.pt<o:p></o:p></span></p><p class=MsoNormal><!--[if gte vml 1]><v:shape id="Arrow_x003a__x0020_Down_x0020_2" o:spid="_x0000_s1027" type="#_x0000_t75" style='position:absolute;margin-left:-3.75pt;margin-top:15.65pt;width:18.75pt;height:24.75pt;z-index:251661312;visibility:visible;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text'>
<v:imagedata src="cid:image003.png@01D972A6.676FD460" o:title="" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><![endif]--><![if !vml]><span style='mso-ignore:vglayout;position:absolute;z-index:251661312;margin-left:-5px;margin-top:21px;width:25px;height:33px'><img width=25 height=33 style='width:.2604in;height:.3437in' src="cid:image003.png@01D972A6.676FD460" v:shapes="Arrow_x003a__x0020_Down_x0020_2"></span><![endif]><span lang=PT> Internalsite2.ubi.pt<o:p></o:p></span></p><p class=MsoNormal><!--[if gte vml 1]><v:shape id="Arrow_x003a__x0020_Curved_x0020_Up_x0020_5" o:spid="_x0000_s1026" type="#_x0000_t75" style='position:absolute;margin-left:88.85pt;margin-top:-18.95pt;width:94.45pt;height:74.25pt;z-index:251664384;visibility:visible;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:margin;mso-height-relative:margin'>
<v:imagedata src="cid:image004.png@01D972A6.676FD460" o:title="" cropright="-16995f" />
<o:lock v:ext="edit" aspectratio="f" />
</v:shape><![endif]--><![if !vml]><span style='mso-ignore:vglayout;position:relative;z-index:251664384'><span style='position:absolute;left:118px;top:-25px;width:126px;height:99px'><img width=126 height=99 style='width:1.3125in;height:1.0312in' src="cid:image005.png@01D972A6.676FD460" v:shapes="Arrow_x003a__x0020_Curved_x0020_Up_x0020_5"></span></span><![endif]><span lang=PT> …<o:p></o:p></span></p><p class=MsoNormal><span lang=PT><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>di.ubi.pt <o:p></o:p></p><p class=MsoNormal>(both authoritative and recursive for my networks)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Previously I had the following to get internal sites resolved, but now it seems it is completely discarded by dnssec.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>zone "ubi.pt" IN {<o:p></o:p></p><p class=MsoNormal> type forward;<o:p></o:p></p><p class=MsoNormal> forwarders { 192.168.100.1; 192.168.100.2; };<o:p></o:p></p><p class=MsoNormal>}<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there any configuration to allow me to be able to access internal sites served by internal dns servers, I guess not using DNSSEC?<o:p></o:p></p><p class=MsoNormal>Can this only be accomplished by adding these entries to my parent domain?<o:p></o:p></p><p class=MsoNormal>Thanks!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Kind regards<o:p></o:p></p><p class=MsoNormal>David Carvalho<o:p></o:p></p></div></body></html>