Switching from forwarding to recursion

[Ben Croswell]

If you have a global forwarder in place there are two options that affect
its use. Forward first, the default, and forward only.
Forward first will exhaust the forwarders you have and then attempt to
follow NS records. Forward only will only use forwarders.

The delay you are seeing is likely the delay in exhausting the forwarders
before attempting the roots.

-Ben Croswell
On Nov 1, 2011 9:23 AM, "Will Lists" <listswill at gmail.com> wrote:

> We recently tried a test to see how our internal servers would react to a
> loss of their external peers, with the goal being that the internal servers
> would switch from forwarding to doing recursive queries for clients.
>  Normally, the internal servers forward to the external servers.  To
> simulate the loss of the external servers, we pushed a new firewall rule
> that blocked port 53 to the external servers from the internal servers.
>  That did seem to cause the internal servers to start using the root
> servers in a recursive manner.
>
> We did see that some recursive queries were answered, eventually, though
> usually much, much slower than if the request had been forwarded as normal
> to the external servers.  We saw traffic (lots of traffic) going across the
> firewall to the roots as well as multiple domain specific name servers, so
> that flow path is working as best as I can tell.  All servers are running
> BIND 9.7.4.
>
> The issue we saw was that the queries would time out more often than not
> and on the off chance they did get an answer back to the requesting client,
> it was very slow after several retries.
>
> Am I missing something in the named.conf file?  Is there something
> specific I should be looking for in the syslog or daemon.log?
>
>
> The relevant portion of the named.conf file for the INTERNAL view is below:
>
>
>     forwarders { NS2; NS1; };
>     forward first;
>     allow-recursion { 10.0.0.0/8; 192.168.0.0/16; 172.16.0.0/12; };
>     recursion yes;
>
>     // zone: . [hint]
>     include "...";
>
>
> The hints DB file is current as of the version of BIND in use (2011060800).
>
>
> Thanks.
>
> -Will
>
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to
> unsubscribe from this list
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20111101/113e1a27/attachment.html>