<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Wed, Nov 15, 2023, at 11:05, Brian Candler via Pdns-users wrote:<br></div><blockquote type="cite" id="qt" style=""><div class="qt-moz-cite-prefix">On 15/11/2023 14:53, sebastian-n-95---
via Pdns-users wrote:<br></div><blockquote type="cite" cite="mid:trinity-c47de14d-10ca-4076-92c9-83c641cb3058-1700060010213@3c-app-gmx-bap11"><div style="font-family:Verdana;font-size:12px;"><div><div>Hey,<br></div><div> <br></div><div> I am considering migrating my current BIND-Based setup to
PowerDNS.<br></div><div> <br></div><div> For multiple zones, I currently have split-view in bind, so
that I can define DNS-Records available only for internal
clients.<br></div><div> <br></div><div> To achieve this, I have the following zonefiles:<br></div><div> <br></div><div> mydomain.com.ext.zone <- This zonefile is used for the
external view<br></div></div><div>mydomain.com.int.zone <- This zonesfile is used for the
internal view<br></div><div> <br></div><div>But I also have:<br></div><div>mydomain.com.include <- This file is included in both
zonefiles, so records defined there are available in both
zones.<br></div><div> <br></div><div> <br></div><div>I was wondering, how I could replicate a setup like this in
PowerDNS.<br></div></div></blockquote><p>BIND combines the roles of authoritative server and recursor;
PowerDNS has separate programs (pdns and pdns-recursor)<br></p><p>Split views are IMO a bad idea anyway, but if you wanted to do it
you would need to do something like this:<br></p><p></p><div>1. Run pdns-recursor for your internal clients to use<br></div><div> 2. Run an instance of pdns-auth with your internal zones<br></div><p></p></blockquote><div><br></div><div>There is another option to consider:<br><br>1. Run pdns-recursor for your internal clients to use</div><div>2. Run pdns-auth for the external view of the zones<br></div><div>3. Install a Response Policy Zone (RPZ) in the recursor to *override* the results provided by the auth for queries from internal clients<br></div><div><br>Those overrides can add new records, hide existing records, or replace records with alternative answers.<br></div><div><br></div></body></html>