Bind DNS Question

[Lucas, David]

Kevin,

Thanks for responding to my question.

Here is the current named.conf file:

options {
        directory "/var/named";
        listen-on { 10.254.128.1; };
        };

zone "microsoft.com" in {
        type forward;
        forwarders { x.x.x.x; y.y.y.y; };
        forward only;
        };

When I perform the following command 'dig @10.254.128.1 www.microsoft.com' I
get, "connection timed out; no servers could be reached" but as soon as I
make the following change into the named.conf file it works!!

options {
        directory "/var/named";
        listen-on { 10.254.128.1; };
        forwarders { x.x.x.x; y.y.y.y; };
        };

zone "microsoft.com" in {
        type forward;
        forwarders { x.x.x.x; y.y.y.y; };
        forward only;
        };

I'd like to get this portion to work first before I try yo add the Root into
the mix.  I thought I read somewhere that you need to specify forwarders
under options in order to get forwarding to work.  Of course, I can't find
where I read that, or I may be dreaming it!!!  If that is the case then why
is there an option to add forwarders under a zone??

Thanks in advance for any help that anyone can give me!!!

Dave

-----Original Message-----
From: bind-users-bounce at isc.org [mailto:bind-users-bounce at isc.org] On Behalf
Of Kevin Darcy
Sent: Monday, June 28, 2004 11:12 PM
To: bind-users at isc.org
Subject: Re: Bind DNS Question

Lucas, David wrote:

>Hello Everyone,
>
>I was wondering if any Bind experts can help me out with this one.  I'm 
>working on our campus network registration system and would like to 
>accomplish the following:
>
>1. A computer when they are in the Unknown state they will get a 
>"Bogus" DNS server.  That DNS server thinks it's the root server for 
>everything.  So when a user types www.cnn.com they resolve to a webpage
that we specify.
>(This is working today)
>
>2. I want a user to be able to get to windowsupdate.microsoft.com from 
>our private addresses that are assigned when a computer is in the unknown
state.
>Now, I have half this working.  I have a proxy server that is 
>restricting access to only Microsoft.  When I bring everything onto the 
>same DNS server it does not work.  Basically for the proxy server to 
>work correctly I need to have the public addresses resolved via DNS.  I 
>only want public addresses to be handed out for domains that I specify.
>
>This is what I have tried:
>
>- I have tried to set a forward for zone microsoft.com, well it 
>forwards all requests to the public DNS servers, which in turn gives me 
>public addresses for everything.
>
How did you specify forwarding? With a "type forward" zone, e.g.

zone "microsoft.com" {
    type forward;
    forwarders { x.x.x.x; y.y.y.y; };
    forward only;
};

? Or did you put the "forwarders" and/or "forward only" in the "options" 
block? I can't imagine how "everything" could have started forwarding if
forwarding was only defined for microsoft.com...

>  I don't want this I only want Microsoft's public addresses.
>- I've tried to specify a NS record for Microsoft and that to didn't 
>work, actually it killed everything for resolving the names.
>
Actually, you may need to do *both* delegation and a "type forward" 
zone. If you have a "fake" root zone with a wildcard A record in it (I
assume this is how you implemented #1 above), named may need to see a
delegation for microsoft.com before it will forward queries for that domain.
Otherwise, since it is authoritative for the root zone, it'll just "know"
that microsoft.com doesn't exist. In this case, it doesn't really matter to
_what_ you delegate microsoft.com, since all of the queries will be
forwarded anyway. Just make up some bogus nameserver names and addresses.

                                                                         
                                                - Kevin