[Pdns-users] Authoritative vs Recursor
Peter van Dijk
peter.van.dijk at netherlabs.nl
Sat Jan 14 16:46:28 UTC 2012
On Jan 14, 2012, at 11:57 , Daniel L. Miller wrote:
> I'm confused as to the proper pairing of the authoritative server vs the recursor. I have a small LAN and provide authoritative DNS for a handful of sites. In the past, using other DNS software (djbdns), my configuration was:
> 1. An authoritative server for Internet domain names hosted by me. Reachable by internet clients.
> 2. An authoritative server for internal domain names. Only visible to the LAN recursor.
> 3. A caching recursive server, accessible by the LAN clients, that had a list of local authoritative servers & domains as well as direct queries to the Internet.
> So my authoritative Internet server was reachable via public IP, my internal authoritative listened on localhost, and my internal caching recursor was pushed via DHCP to my LAN clients. I have setup a similar configuration using pdns - the authoritative is reachable via public IP, and the recursor has a forward-zone file and is pushed to the clients via DHCP. So my LAN clients query the recursor - not the pdns authoritative server.
> My question - this works, but is it "correct" usage with pdns?
Yes, this is a fine setup. LAN clients (workstations) cannot talk directly to auths (unless those auths also proxy to a recursor).
There is one possible variant (that djbdns would not support): if you use 'auth-zones=' in recursor.conf, you can do without the internal auth.
Peter van Dijk
More information about the Pdns-users