<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1493283596704_8363">Hi all,</div><div id="yui_3_16_0_ym19_1_1493283596704_8363"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">We own a few domains for which our ISP is authoritative (let's say domain1.com & domain2.com). So it serves public IP addresses. We also have two internal DNS resolvers in our DMZ (192.168.10.0/24).</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">We would like them to resolve internet, but also fake some records in domain1.com & domain2.com. The reason is that we host servers, webservers for example, in the DMZ, and they are NATed behind public IP addresses. We want these records to be resolved as private IP addresses by our DNS resolvers, to be routable internally.</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">So if you are on the internet, our ISP servers answer with :</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">web1.domain1.com -> 1.1.1.1</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">other.domain1.com -> 2.2.2.2</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">If you are inside the LAN and query our DNS resolvers :</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">web1.domain1.com -> 192.168.10.101 (overridden)</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">other.domain1.com -> 2.2.2.2 (not faked)<br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">We have been able to achieve this by using only PDNS Resolver as our internal resolver, and "export-etc-hosts". /etc/hosts would contain :</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">192.168.10.101 web1.domain1.com</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">It works, as pdns resolver still would query the authoritative servers for domain1 records not in the /etc/hosts file.</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">However, this is not very satisfying, as :</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">- we have many records to manage in hosts files</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">- we need to manually keep hosts files in sync between our recursors</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">Would it be possible to install a PDNS authoritative server for domain1.com beside of PDNS recursor to achieve the same result ? It would allow to manage the records with a web GUI and use MySQL to keep the records in sync between the servers. The problem is that as soon as we set PowerDNS authoritative for domain1.com, it answers to web1.domain1.com with the private address, but with NXDOMAIN for other.domain1.com, and the recursor forwards this answer to the client, instead of querying the real authoritative servers (our ISP).</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">Could the "allow-recursion-override" setting help ? Is it possible to make this work ?</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr">DG</div><div id="yui_3_16_0_ym19_1_1493283596704_8363" dir="ltr"> </div></div></body></html>