<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 27/02/2020 10.58, Jochen Demmer via
dnsdist wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2f42feb7-5e60-6c95-8b70-647a071bd9aa@relaix.net">
<pre class="moz-quote-pre" wrap="">In your example queries from internal network are being redirected to
the pool that can answer those.</pre>
</blockquote>
<p>Exactly.</p>
<blockquote type="cite" style="color: #000000;">
<br>
<blockquote type="cite" style="color: #000000;">addAction(AndRule({NetmaskGroupRule(internal_dns_ips,
false),
<br>
NetmaskGroupRule(internal_network)}),
PoolAction('internal_auth_pool'))
<br>
</blockquote>
But queries from internal network do not neccessarily ask only for
<br>
internal zones, they might as well need recursion or maybe even
the
<br>
public pool.
<br>
</blockquote>
But those queries should go to different IPs. So you give out a set
of IPs for recursion, another set of IPs for public auth zones and a
third set of IPs for internal zones.
<br>
<blockquote type="cite" style="color: #000000;">How can I handle
that? Should the DNS server that the clients of the
<br>
internal network use make the distinction between where normal
recursive
<br>
queries shall be sent to and where to send those who are private
domains?
<br>
</blockquote>
<br>
The clients should only talk to the recursive resolver, I guess?
<br>
<br>
<p>Best regards, <br>
</p>
<p>Jacob</p>
<p>P.S. Jochen, sorry for writing to you directly - I wanted to
answer on-list.<br>
</p>
</body>
</html>