<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 21/02/2026 11:18, Karol Nowicki via
bind-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:279956815.1313442.1771625902084@mail.yahoo.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div class="yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;">
<div dir="ltr" data-setdir="false">Hello </div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">Case Scenario:</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">Client sending query to DNS
Resolver for google.com.</div>
<div dir="ltr" data-setdir="false">DNS Resolver cached from
internal root hints that google.com is delegated to DNS proxy
server ( NS record ).</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">DNS proxy is having locall
information that google.com has to be delegated to public
google name server 8.8.8.8</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">Query from DNS Resolver to
DNS proxy server is being sent with disabled recursion flag as
google.com is defined with NS record.</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">Client -> DNS Caching
Recursive Resolver -> DNS "Proxy" Server -> Public
Google DNS</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">
<div>
<div>Most standard DNS servers (such as BIND, Unbound, or
Windows DNS) do not have a built-in method to force full
recursion for queries received without the recursion flag
enabled (RD=0).</div>
<div>According to RFC standards, if a client does not
request recursion (RD=0), the server should only respond
with data it holds locally (authoritatively) or from its
cache.</div>
</div>
<br>
</div>
<div dir="ltr" data-setdir="false"><br>
</div>
<div dir="ltr" data-setdir="false">Question is do we have any
methods to bypass RFC and force recurion on the DNS proxy for
incoming queries from DNS Resolver to push on DNS Proxy run
recursive queirs to find answer for google.com and send back
to DNS Resolver then DNS Resolver to Client ?</div>
</div>
</blockquote>
<p>Hi Karol.</p>
<p>It sounds like your goal is to have the "DNS proxy" to do all the
recursion (for queries of public domains), instead of the "DNS
Resolver" doing it?</p>
<p>If that is what you are trying to achieve, then the correct way
to do this would be to configure the "DNS Resolver" as a <b>forwarding
resolver</b>, as described in step 3 of the Resolver section of
the BIND documentation:
<a class="moz-txt-link-freetext" href="https://bind9.readthedocs.io/en/latest/chapter3.html#resolver-caching-name-servers">https://bind9.readthedocs.io/en/latest/chapter3.html#resolver-caching-name-servers</a></p>
<p>The way to do this is to add forwarders to your options block.
See:
<a class="moz-txt-link-freetext" href="https://bind9.readthedocs.io/en/latest/reference.html#forwarding">https://bind9.readthedocs.io/en/latest/reference.html#forwarding</a></p>
<p>Nick.</p>
</body>
</html>