Hello DNS gurus, I'm mastering a sinkhole DNS for a quarantine VLAN. My sinkhole DNS resolves any request to the same host - so that the quarantined clients get redirected to my server. I have following DNS configuration (running bind-9.8.2-0.17.rc1 on RHEL 6.4):
options { listen-on port 53 { 10.10.0.1;}; // listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { 10.10.0.0/24; }; allow-transfer {"none";}; recursion no; dnssec-enable yes; dnssec-validation yes; dnssec-lookaside auto; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type master; file "/var/named/named.sinkhole"; }; // include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; The file /var/named/named.sinkhole has following content: $TTL 600 @ IN SOA localhost root.localhost. ( 11 ; serial 3H ; refresh 15M ; retry 1W ; expire 1D ) ; minimum IN NS @ IN A 10.10.0.1 * IN A 10.10.0.1 So far this is working perfect. I have a new requirement now - the quarantined client should have an access to an external host. I haved added following configuration to /etc/named.conf: zone "test.com" IN { type master; file "/var/named/named.test"; }; /var/named/named.test: $TTL 600 @ IN SOA ns.test.com. root.localhost. ( 22 ; serial 3H ; refresh 15M ; retry 1W ; expire 1D ) ; minimum IN NS ns.test.com. ns IN A 10.10.0.1 www IN A X.X.X.X ;; X is replaced to an actual IP address Unfortunately my naive approach did not work. "www.test.com" is still resolved to 10.10.0.1 and I see that the global zone "." is always hit unless I comment out the global zone definition. I'm a bit new in DNS. Any help is appreciated. Ideally my DNS should delegate the "www.test.com" request and do not store its IP locally. Many Thanks, Sergey Emantayev _______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users