Linux

Ask something
Discussion Locked

DNS

0 helpful
3 replies

by cpfeiffe

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have Bind 8.2.2P5 with Solaris 8 running on an Ultra 10. The domain I represent is ric.us.power.alstom.com which is delegated from another domain I manage - us.power.alstom.com. That domain is delegated from power.alstom.com. There is also another subdomain of the us zone, which is win.us.power.alstom.com managed by a person at another site.

From my ric.us.power.alstom.com name server I query the SOA record for power.alstom.com and get back the external servers. That is not good, I need the internal servers. From the us.power.alstom.com or the win.us.power.alstom.com name servers the query returns the internal servers.

Because of this flaw My users can't resolve a lot of servers that reside on power.alstom.com or its othersubdomains.

My understanding is that my ric.us.power.alstom.com server contains no data for power.alstom.com (it is not a slave, forwarder or anything for that domain) and therefore it should go up to us.power.alstom.com to get its data which iscorrect on that server. Of course there is what is in cache, but I have rebooted and thought that would clear the cache.

I have verified that I have a clear path to the correct name servers at power.alstom.com and that there is no firewall blocking the exchange of DNS data between the power server and my ric server. I just pointed the ric server directly to the power server via the domain/nameserver entries in /etc/resolv.conf and performed the query. I got the correct results then.

If anyone has any ideas on how I'm getting this incorrect data and/or how to get rid of it without waiting for the three week TTL to expire please advise.

3 replies

by stillatit

If your DNS is not a forwarder, if it is looking for a site it comes down from the top... First root, then .com then alstom.com then power.alstom.com and so on. Given this, you WILL see the external servers.

A solution, if there are internal servers your people need, is to put them into your DNS files. Give them an "internal" name, and use a CNAME record to point to their IP. Downside -- if you are authoritive for your domain outsiders can see these boxes.

A less elegant solution is to put the fully qualified name (include the terminal dot) of each of these servers in your DNS. Insiders, querying your DNS, will find them. Outsiders will never query your DNS for these, since you are not authoritive for the domain these servers are in, and are not in the chain that logically leads to them.

Another way is to maintain a separate version of your DNS for internal users, which knows about the internal servers and forwards everything else.

Good luck.

This discussion is closed to new replies.