Using a Fake Parent domain to simplify delegations from ARIN?

Dylan Ulis dylan.ulis at gmail.com
Wed Oct 3 21:50:08 UTC 2007


I recently began working for a very large company, that has a very
fragmented IP space.  In the past, many groups in our company got IP space
directly from ARIN.  Now, things are done through a central office that
manages IP's (and Reverse DNS).
The problem is our legacy space that is delegated from ARIN directly to our
sub-groups.  If someone with the legacy space wants to change DNS servers
for their Reverse Zones, the change gets processed at 1)the central company
IP office (for record keeping purposes)  and then 2) ARIN (for the actual
DNS change).

I am looking to simplify this process so we dont have to go through ARIN for
every change inside our company.  I would like to change all ARIN
delegations to point to our main company servers.  Then, create a Fake
Parent zone on our company's DNS servers, so we can delegate out to the
groups that actually own the space.  (Below is an example... I'm just using
private IP space so I dont have to use our real IP's)

Example current ARIN delegations:
5.168.192.in-addr.arpa.  IN NS ns1.group1.company.com.
15.168.192.in-addr.arpa. IN NS ns1.group2.company.com.
25.168.192.in-addr.arpa. IN NS ns1.group3.company.com.

Planned future ARIN delegations:
5.168.192.in-addr.arpa.  IN NS ns1.company.com.
15.168.192.in-addr.arpa. IN NS ns1.company.com.
25.168.192.in-addr.arpa. IN NS ns1.company.com.

NEW Zone Hosted n ns1.company.com.
168.192.in-addr.arpa. IN NS ns1.company.com.


So my question:
Is this bad Internet/DNS practice to have the 168.192.in-addr.arpa. zone on
ns1.company.com, even though we don't own the whole /16?
Will this taint cache's of other DNS servers if we now answer
authoritatively for a zone we don't own?

Thanks,
-- 
Dylan Ulis
dylan.ulis at gmail.com




More information about the bind-users mailing list