<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 13/05/2020 08:18, Pierrick CHOVELON
via Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAHzjrsu7La16FgL0AwJDzMkvX0TtZN9uf3UNmqBL=w-tQYq3xQ@mail.gmail.com">
<div><br>
</div>
<div>Now, let's imagine I want to resolve <a
href="http://foo.example.net" moz-do-not-send="true">foo.example.net</a>
and also <a href="http://bar.example.net"
moz-do-not-send="true">bar.example.net</a>.</div>
<div><br>
</div>
<div>Do I have to create two zone files one for <a
href="http://foo.example.net" moz-do-not-send="true">foo.example.net</a>
and one for <a href="http://bar.example.net"
moz-do-not-send="true">bar.example.net</a>) like I did
previously ? or is it possible to have a single one file (<a
href="http://example.net" moz-do-not-send="true">example.net</a>)
in which I add the two records ?</div>
<div>In that case, will it have some issue with others records ?</div>
</blockquote>
<p>Pdns separates the recursor and authoritate server roles.</p>
<p>At the recursor, you will need forward rules for foo.example.net
and bar.example.net pointing to your authoritative server, which
is providing the fake/non-public data for foo.example.net and
bar.example.net. "forward-zones-file" is the easiest way to do
that.<br>
</p>
<p>At the authoritative server, I'd say it's least confusing if you
also create separate zones for foo.example.net and
bar.example.net. However you *could* make it authoritative for
example.net (or .net, or even the entire DNS root). If it's
private auth DNS, and it's not going to be receiving delegated
queries from anyone else on the Internet, it doesn't matter.</p>
<p>Are you trying to mix in individual private hosts to a public
domain? The way I prefer to handle this is to have a single
domain for private DNS, e.g. int.example.net, and put everything
under there - foo.int.example.net, bar.int.example.net. It's a
lot cleaner, less work to manage, and less opportunity for
mistakes.<br>
</p>
<p>Also, in the public DNS I put an NS record for int.example.net
pointing to a separate public-facing DNS server with an empty zone
file for int.example.net. This server permits dynamic DNS updates
from my internal machines - I use it for responding to dns01
challenges for LetsEncrypt certificates. This means internal
machines can have valid certificates, even though
foo.int.example.net is not reachable from the public Internet, and
its address is not visible in the public DNS either.</p>
<p>Regards,</p>
<p>Brian.<br>
</p>
</body>
</html>