<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 14/09/2016 09:07, EDV-Techniker
wrote:<br>
</div>
<blockquote
cite="mid:CB4F6B4DF8985F4BBEC7ADB3D0F81CD428A2E972@SERVER.marel.local"
type="cite">
<p class="MsoNormal">we want using a nameserver for our domains
only.</p>
</blockquote>
<br>
You mean, you want your own client devices to be able to resolve
your names?<br>
<br>
What do you want them to receive if they try to receive an external
name - an NXDOMAIN as if the domain doesn't exist, or a SERVFAIL as
if the external domain name's servers can't be reached?<br>
<br>
<br>
<blockquote
cite="mid:CB4F6B4DF8985F4BBEC7ADB3D0F81CD428A2E972@SERVER.marel.local"
type="cite">
<p class="MsoNormal"> I can be done without configure a resolver.</p>
</blockquote>
Do you mean, you have configured an authoritative server for your
domain (mydomain.com) and are pointing your clients to it as their
resolver?<br>
<br>
<blockquote
cite="mid:CB4F6B4DF8985F4BBEC7ADB3D0F81CD428A2E972@SERVER.marel.local"
type="cite">
<p class="MsoNormal">Works fine but if query f.e. an external
CNAME, which A record doesn’t exist at our database, then
PowerDNS doesn’t resolve.<o:p></o:p></p>
</blockquote>
<br>
I don't understand that.<br>
<br>
Are you saying your server is authoritative for mydomain.com, then
someone queries foo.mydomain.com which is a CNAME to
bar.external.com, and the problem is that bar.external.com can't be
resolved? That's what you wanted, isn't it?<br>
<br>
Otherwise please explain what the scenario is, what behaviour you
see, and what behaviour you want to see instead.<br>
<br>
<blockquote
cite="mid:CB4F6B4DF8985F4BBEC7ADB3D0F81CD428A2E972@SERVER.marel.local"
type="cite">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Using a resolver does solve this problem. But
now the DNS server is open and frail for attacks.<o:p></o:p></p>
</blockquote>
People across the Internet using DNS all the time. It's not "frail
for attacks" if configured properly. Can you explain specifically
what issues you are trying to avoid? There may be a better solution.<br>
<br>
Regards,<br>
<br>
Brian.<br>
</body>
</html>