<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Greg,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Greg Choules <gregchoules+bindusers@googlemail.com>
<br>
<b>Sent:</b> Wednesday, December 18, 2024 5:04 PM<br>
<b>To:</b> Cuttler, Brian R (HEALTH) <brian.cuttler@health.ny.gov><br>
<b>Cc:</b> bind-users <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: forwarding non-domain queries<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #CBCBCB 3.0pt;background:#E35205;padding:0in 3.75pt 0in 3.75pt">
<p align="center" style="text-align:center;line-height:105%"><i><span style="font-size:10.0pt;line-height:105%;color:yellow">ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.</span></i><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Brian. <o:p></o:p></p>
<div>
<p class="MsoNormal">Just checking; you removed or commented this config?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Yes, on my test server where I was making the changes prior to making changes on my production level server this was commented out.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">zone ".: {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> type hint;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> file <whatever>;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">};<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">A couple of points about dig:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1) The syntax dig <domain> (with no @<something>) will send a query to the address(es) defined as your system DNS. On a *x system this is defined in /etc/resolv.conf with the "nameserver" command.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Yes, I was aware that dig does not qualify the query the way host or nslookup does.<br>
In this case, attempting to test fowarders I did fully qualify the query.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Retesting now for an A record defined in our own zones files I did see the expected behavior “curie.wadsworth.org” resolved and “curie” did not.</span>
<span style="background:yellow;mso-highlight:yellow">As expected</span>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">2) dig @<name> <domain> will cause dig to send a query for <name> to your system-defined DNS (see point 1) firstly to try and resolve <name> and get its address. If that works, then it will send a query for <domain> to that address. If
the query for <name> doesn't work then the query for <address can't happen. Can you paste your complete resolv.conf file here?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">nameserver 10.50.156.21<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">nameserver 10.50.156.70<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">search wadsworth.org health1.hcom.health.state.ny.us</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Given what you just said I realize this system is badly configured, the test server is relying on the production level servers and that was not the intent.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">I have retested with the nameservers both removed and replaced with the IP of the test server/local machine, 10.50.156.104.<br>
I am able to correctly resolve <a href="http://www.gloogle.com/">www.gloogle.com</a> with dig without the root server errors.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">3) dig @<address> <domain> (v4 or v6, if your network allows it) will send a query for <domain> to that address. I would always recommend using this form, to be certain where your queries are going.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Agree</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">4) dig +trace will cause dig itself to follow addresses it gets back. So whilst the first query may go to your local BIND (depending on 1, 2 or 3) subsequent queries will go to your system DNS.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">May I ask why you want to use +trace at all?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Try using Wireshark to see what's actually going on.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Correctly or incorrectly I’d thought that the initial query for something not in a local zone file or cached would be to the root server, then a second query to the TLD server, than a
third query to the domain server.<br>
I thought I might see all of the queries going to the server(s) defined by the forwarders and forwarder zones.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Yes, watching the network, verifying that queries were through a router to the forwarder servers and not through my FW to the internet is a more reliable way to do this.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Yes, tremendously helpful.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Thank you,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">Brian</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hope that helps.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Greg<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, 18 Dec 2024 at 19:47, Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov">brian.cuttler@health.ny.gov</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Greg,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Modified by test-dns server. Removed the db.cache file and added the two forwarder IP addresses and set ‘forward only”.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Testing with Dig I get replies just fine.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">When I run dig +trace I see failures attending to access the root servers and the tld servers for the domain, in this case I queried a .edu address.<br>
<br>
Is there a way to prevent these errors, or was my query ill thought out or have I simply misconfigured my server?<br>
<br>
thanks,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Brian<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Dig without trace<br>
<br>
root@intest:/etc/bind# dig @intest <a href="http://ns1.albany.edu/" target="_blank">
ns1.albany.edu</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">18-Dec-2024 14:45:04.452 queries: info: client @0x7f10f4447468 10.50.156.104#57192 (<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a>): query:
<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a> IN A +E(0)K (10.50.156.104)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> @intest
<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; (3 servers found)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; global options: +cmd<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; Got answer:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7225<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; OPT PSEUDOSECTION:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; EDNS: version: 0, flags:; udp: 1232<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; COOKIE: b363a3c730e019cd01000000676326403a59b45d7f84c7d4 (good)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; QUESTION SECTION:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a>. IN A<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; AUTHORITY SECTION:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="http://albany.edu/" target="_blank">albany.edu</a>. 10234 IN SOA
<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a>. <a href="http://hostmaster.albany.edu/" target="_blank">
hostmaster.albany.edu</a>. 3005050 3600 3600 3600000 28800<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; Query time: 0 msec<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; SERVER: 10.50.156.104#53(intest) (UDP)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; WHEN: Wed Dec 18 14:45:04 EST 2024<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; MSG SIZE rcvd: 118<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">With trace<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">root@intest:/etc/bind# dig +trace @intest
<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">18-Dec-2024 14:40:52.623 queries: info: client @0x7f10fc0c4978 10.50.156.104#50839 (.): query: . IN NS +E(0)DK (10.50.156.104)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> +trace @intest
<a href="http://ns1.albany.edu/" target="_blank">ns1.albany.edu</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">; (3 servers found)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; global options: +cmd<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://b.root-servers.net/" target="_blank">b.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://e.root-servers.net/" target="_blank">e.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://g.root-servers.net/" target="_blank">g.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://i.root-servers.net/" target="_blank">i.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://k.root-servers.net/" target="_blank">k.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://d.root-servers.net/" target="_blank">d.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://h.root-servers.net/" target="_blank">h.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://a.root-servers.net/" target="_blank">a.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://f.root-servers.net/" target="_blank">f.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://m.root-servers.net/" target="_blank">m.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://c.root-servers.net/" target="_blank">c.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://j.root-servers.net/" target="_blank">j.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN NS
<a href="http://l.root-servers.net/" target="_blank">l.root-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">. 492210 IN RRSIG NS 8 0 518400 20241231050000 20241218040000 61050 . gmkXjFBTwdt2gE7B6UNsaRHVF15aVtk0+WiV4a1Wy+5E5E9SrlFxcRcL jYGAIIYQllvcyLog7VED454djTSJv58z/DawPUczxwwWEtJzb2dnFOTN
HyrGSPgLbF5QcZw4mqKHzHkYaq+kAfq7IUU99wzYdHmLjRbwGuZQ40g5 B7X/hqEGZS7VDHf1ISdR0OZnymx9UX5dHS/6b+GdPCXJBO8CzyhzJwPZ S/L30j8MzmyCB9iZRvTIK5RQcYU4F+EwoGwFUM/7o0U0j5K9Gz0AKZhh 87d9+CUsdNRBHTwbuemPYcBdumTheKsvF+gzhVpM7IpLZ5mFl5xBrcUz Ce0sVg==<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">;; Received 1137 bytes from 10.50.156.104#53(intest) in 0 ms<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://a.edu-servers.net/" target="_blank">a.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://b.edu-servers.net/" target="_blank">b.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://c.edu-servers.net/" target="_blank">c.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://d.edu-servers.net/" target="_blank">d.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://e.edu-servers.net/" target="_blank">e.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://f.edu-servers.net/" target="_blank">f.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://g.edu-servers.net/" target="_blank">g.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://h.edu-servers.net/" target="_blank">h.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://i.edu-servers.net/" target="_blank">i.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://j.edu-servers.net/" target="_blank">j.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://k.edu-servers.net/" target="_blank">k.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://l.edu-servers.net/" target="_blank">l.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 172800 IN NS
<a href="http://m.edu-servers.net/" target="_blank">m.edu-servers.net</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 86400 IN DS 35663 13 2 A2E1614291831A4746B5AC52B4B345357687271E85353082741F1CF3 D06A4C1D<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">edu. 86400 IN RRSIG DS 8 1 86400 20241231170000 20241218160000 61050 . hqpVkaatHhZAsmVPL9S4Cv7Ln2aGc3jnSecW9N56N5rEloBIydTeGmGV sGnISjn3BOUW+TmIULKyOS2/voPMyIVBNmkwMuWR1INtPyDDnO30M8ew
3dGkKzQLFecwV60tetwyQGsaOBT1O/O9VTeyyif27M9hYTSpZ6vd7Opp 7+9GypXEoPtcBkrBPmEtnv4naltqV9wXYsepIr/EfFMRcRjhbJ7lCnQm 41TCTb0bZh7YvyvMwsTIgT2dGTHD/C6anjWD/PZ51KL5ltMcvlZ36s9M sNWdMa5w+zksyDoXaq2y6vX++68Mt/CVXVTarwHv/Hk4rZYrN6xWhByV DJejJw==<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://a.edu-servers.net/" target="_blank">a.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://b.edu-servers.net/" target="_blank">b.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://c.edu-servers.net/" target="_blank">c.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://d.edu-servers.net/" target="_blank">d.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://e.edu-servers.net/" target="_blank">e.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://f.edu-servers.net/" target="_blank">f.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://g.edu-servers.net/" target="_blank">g.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">^C^Ccouldn't get address for '<a href="http://h.edu-servers.net/" target="_blank">h.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://i.edu-servers.net/" target="_blank">i.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://j.edu-servers.net/" target="_blank">j.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://k.edu-servers.net/" target="_blank">k.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://l.edu-servers.net/" target="_blank">l.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">couldn't get address for '<a href="http://m.edu-servers.net/" target="_blank">m.edu-servers.net</a>': failure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">dig: couldn't get address for '<a href="http://a.edu-servers.net/" target="_blank">a.edu-servers.net</a>': no more<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Cuttler, Brian R (HEALTH)
<br>
<b>Sent:</b> Tuesday, December 10, 2024 10:25 AM<br>
<b>To:</b> Greg Choules <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>><br>
<b>Cc:</b> bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
<b>Subject:</b> RE: forwarding non-domain queries<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Greg,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I have a test server I will enable the changes on before I roll them out to my primary and secondary servers.<br>
The test server is where we make all tests and updates to zone files.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">As I configure the forwarders stanza, I will remove the zone for db.cache and test it out.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Brian<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Greg Choules <<a href="mailto:gregchoules+bindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>>
<br>
<b>Sent:</b> Tuesday, December 10, 2024 9:54 AM<br>
<b>To:</b> Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov" target="_blank">brian.cuttler@health.ny.gov</a>><br>
<b>Cc:</b> bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
<b>Subject:</b> Re: forwarding non-domain queries<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #CBCBCB 3.0pt;background:#E35205;padding:0in 3.75pt 0in 3.75pt">
<p align="center" style="text-align:center;line-height:105%"><i><span style="font-size:10.0pt;line-height:105%;color:yellow">ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.</span></i><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">And my point is that you just don't need that hint zone definition at all, especially using custom NS in an environment such as this. Maybe try commenting it out and see if it makes
any difference. <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Greg<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, 10 Dec 2024 at 14:48, Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov" target="_blank">brian.cuttler@health.ny.gov</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Greg,<br>
<br>
Yes, I do have that but it looks like this<br>
<br>
(/etc/dns-root is a link to /etc/bind/zones carry over from an older platform)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">These are the servers I want to use as the forwards for all queries that aren’t either local zones or more specific zones in the internal corp network.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">brian@cedar:/etc/dns-root$ more db.cache<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">@ IN A 10.108.43.7<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">@ IN A 10.108.43.8<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">@ IN NS @<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Greg Choules <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>>
<br>
<b>Sent:</b> Tuesday, December 10, 2024 9:38 AM<br>
<b>To:</b> Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov" target="_blank">brian.cuttler@health.ny.gov</a>><br>
<b>Cc:</b> bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
<b>Subject:</b> Re: forwarding non-domain queries<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #CBCBCB 3.0pt;background:#E35205;padding:0in 3.75pt 0in 3.75pt">
<p align="center" style="text-align:center;line-height:105%"><i><span style="font-size:10.0pt;line-height:105%;color:yellow">ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.</span></i><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi Brian.
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">So in your config you still have a section like this?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">zone ".: {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> type hint;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> file <whatever>;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">};<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">You don't need it a) at all anyway, for the reason I gave and b) because you are forwarding everything non-local and if you specify "forward only;" for both global forwarding (last
resort, similar to default route) *and* all your forward zones - which I recommend you do - then the box will never recurse, so hints become moot.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I don't know anything about your network topology, addressing or routeing, so I can't guess why traffic (outbound queries from this server?) might be going to either a local router
or a firewall.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">As an aside, I would try to keep the forwarding to a minimum; if several things forward to the same place(s), try to aggregate them. Also, if the servers you are forwarding to are
authoritative, I would use one of stub/static-stub/secondary zones instead.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Cheers, Greg<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, 10 Dec 2024 at 14:22, Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov" target="_blank">brian.cuttler@health.ny.gov</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Greg,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thank you.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Replacing the db.cache file seems to work for replacing the root servers, I saw traffic shift to an internal router were I had expected/previously seen traffic through the FW.<br>
Manager noticed that secondary queries to domain servers were still going through the FW.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The forwarder zones I have in place now will continue to function since they are more specific than the new fowarders setting, that serves as a forwarder of last resort (for lack
of a better term and borrowing from words I use for network routing).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Example.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Let say I have forwarder zones for
<a href="http://health.ny.gov/" target="_blank">health.ny.gov</a> and <a href="http://ny.gov/" target="_blank">
ny.gov</a> and <a href="http://its.ny.gov/" target="_blank">its.ny.gov</a>, those will continue to word when I add a forwarders statement for the servers that
<a href="http://ny.gov/" target="_blank">ny.gov</a> servers for all more generic queries.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Many thanks,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Brian<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Greg Choules <<a href="mailto:gregchoules%2Bbindusers@googlemail.com" target="_blank">gregchoules+bindusers@googlemail.com</a>>
<br>
<b>Sent:</b> Monday, December 9, 2024 6:26 PM<br>
<b>To:</b> Cuttler, Brian R (HEALTH) <<a href="mailto:brian.cuttler@health.ny.gov" target="_blank">brian.cuttler@health.ny.gov</a>><br>
<b>Cc:</b> bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>><br>
<b>Subject:</b> Re: forwarding non-domain queries<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #CBCBCB 3.0pt;background:#E35205;padding:0in 3.75pt 0in 3.75pt">
<p align="center" style="text-align:center;line-height:105%"><i><span style="font-size:10.0pt;line-height:105%;color:yellow">ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.</span></i><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi Brian.
<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">If that's what you want to do; answer authoritatively from local zones you own and forward everything else to Corporate, then you have it correct. "forwarders {...etc" and "forward
only;" go in the "options" block.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Since you are forwarding everything that's not local *and* disabling recursion if forwarding fails, you don't need the hint zone at all; please delete it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Actually you don't need it anyway, even if you are doing recursion, as Internet root hints have been built into BIND for many years. The only reason you would need a hint zone is
to define custom roots for a private network that is *completely* isolated from the Internet. Your corporate network does not meet that criterion because your corporate DNS servers will be answering names from the Internet. Therefore, lose the hint zone.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I hope that helps.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Greg<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Mon, 9 Dec 2024 at 21:34, Cuttler, Brian R (HEALTH) via bind-users <<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello, looking for a sanity check.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Inside our network we are running BIND 9.18.28-0ubuntu0.22.04.1-Ubuntu on Ubuntu 22.04.5 LTS<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Currently our server serves our own zones files - A/CNAME/PTR/TXT/etc records for our domain.<br>
We have already modified the db.cache file to reference two servers provided by our corporate IT rather than using the internet root servers.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We have numerous forwarder zones for corporate zones, both forward and reverse zones.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We are looking to no longer use recursion but rely entirely on the corporate servers for anything we would normally resolve from external servers.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<pre style="vertical-align:baseline">I think all we need to do is create a forwarders stanza set “forwarder only” , similar to(but with the correct IPS)<o:p></o:p></pre>
<pre style="vertical-align:baseline"><br><span style="color:#0C0D0E;border:none windowtext 1.0pt;padding:0in"> forwarders {</span><o:p></o:p></pre>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;vertical-align:baseline">
<span style="font-size:10.0pt;color:#0C0D0E;border:none windowtext 1.0pt;padding:0in"> 1.2.3.4; # External DNS</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;vertical-align:baseline">
<span style="font-size:10.0pt;color:#0C0D0E;border:none windowtext 1.0pt;padding:0in"> 1.2.3.5; # External DNS</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;vertical-align:baseline">
<span style="font-size:10.0pt;color:#0C0D0E;border:none windowtext 1.0pt;padding:0in"> };</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;vertical-align:baseline">
<span style="font-size:10.0pt;color:#0C0D0E;border:none windowtext 1.0pt;padding:0in"> forward only;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The desire is to continue to use our own zone files, and to continue to use the already established fowarder zones, but to replace recursion managed by our own internal servers
with queries to ONLY the 2 servers we are already using as replacement root servers.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Seems so simple that I have to believe I’ve missed something.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks in advance,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Brian<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Brian Cuttler, System and Network Administration</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Wadsworth Center, NYS Department of Health</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Albany, NY 12201 POB 509</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><a href="mailto:Brian.Cuttler@Health.NY.gov" target="_blank"><span style="color:#0563C1">Brian.Cuttler@Health.NY.gov</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">518 486-1697</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">--
<br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">
https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>