<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>We are asked to forward queries for foo.example.com to a set of
private resolvers. So we have something like this in our .conf</p>
<p>
<blockquote type="cite"><font face="monospace">zone
"foo.example.com" {type forward; forward only;<br>
forwarders { 10.1.2.3; 10.1.4.5; };<br>
};</font></blockquote>
</p>
<p>And when queried for an A-record for <font face="monospace">bar.foo.example.com</font>
(and the A-record exists), the query is forwarded, the answer is
received, cached, and returned to the customer.<br>
</p>
<p>But in the case where <font face="monospace">bar.foo.example.com</font>
is an alias to a record in some other domain (e.g. foo.baz.local),
the behavior is different.</p>
<p>With a packet capture, I can see the query being forwarded to one
of the targets (with the 'recursion desired' bit set). I can see
the reply coming back with the 'recursion available' bit set, and
the answer containing the CNAME, and the ultimate A-record. The
distant server has performed the requested recursion.<br>
</p>
<p>My recursive server does not, however, return the final A-record
to the customer. It attempts to resolve the intermediate CNAME,
and (since the CNAME is to another private domain of which I have
no knowledge) it fails. An NXDOMAIN is returned to the customer.</p>
<p>I understood the 'type forward' to be a 'hand off'. My server
would set the rd-bit, forward the query on, and accept (and
return) whatever answer was received. If I'm correctly
interpreting what I see, my server will accept whatever answer is
received but only for exactly the zone named in zone-statement.
When the answer contains an alias to some other domain, my server
hands that name back into its own recursing process.</p>
<p>Is there some way to configure BIND so it will simply pass back
to the customer whatever answer is received from the distant
resolver?</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
</body>
</html>