<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto">Have you considered making your internal DNS servers unpublished secondaries for the external domain data? Just because the external primary DNS server is configured to allow an internal server to do domain transfers does not mean that internal
server's identity has to be published in external domain NS records.</div>
<div dir="auto"><br>
</div>
<div dir="auto">That way, only the external primary server authoritatively defines the external records, but the internal servers can authoritatively deliver those records as secondaries.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Of course, this only works if the internal and external data records are clearly separated in different subdomains or zones.</div>
<div dir="auto"><br>
</div>
<div dir="auto">Andrew Pavlin</div>
<div><br>
</div>
<div id="ms-outlook-mobile-signature" dir="auto">Powered by Cricket Wireless<br>
Get <a href="https://aka.ms/AAb9ysg">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Nick Howitt via bind-users <bind-users@lists.isc.org><br>
<b>Sent:</b> Friday, November 3, 2023 1:58:51 PM<br>
<b>To:</b> bind-users@lists.isc.org <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: How should I configure internal and external DNS servers</font>
<div> </div>
</div>
<div>On 03/11/2023 17:54, Marco M. wrote:<br>
<blockquote type="cite">
<pre class="x_moz-quote-pre">
Am 03.11.2023 um 17:48:32 Uhr schrieb Nick Howitt via bind-users:
</pre>
<blockquote type="cite">
<pre class="x_moz-quote-pre">My problem is the use of external IP's duplicated between the
internal and external masters for some IPs/FQDNs which I want to get
rid of.
</pre>
</blockquote>
<pre class="x_moz-quote-pre">
Implement IPv6 and get rid of the old IPv4 technology for internal
communication.
It is a big task, but after it is being done, many nasty stuff is gone
like NAT hairpinning or split-DNS.
</pre>
</blockquote>
Not remotely on the cards with 200+ servers and so on, I'm afraid. Some of the servers are too old, I think for IPv6 - SLES 11.<br>
<br>
Really I am looking to see if it is possible to turn the internal DNS server, bind-internal, into a caching server and help with how to do it. Or not to do it if it is a bad idea.<br>
</div>
</body>
</html>