Nathaniel Hall wrote:
Our DNS resolves domain.com. I have system1.domain.com correctly resolving using the DMZ DNS.When you set up DNS, you declare that it is authoritative for the domain. That's the basis premise. Then when you ask it to resolve something associated with the domain, it knows its authoritative for the domain and therefore doesn't have to ask anyone else for anything. It is THE authoritative reference. That's the problem you face. You have declared on the one hand that your DNS server is authoritative, and then on the other hand you say it isn't authoritative. You can't have it both ways to the best of my knowledge.
The ISP DNS also resolves system1.domain.com for users outside the firewalls. In addition to system1, system2.domain.com resolves on the ISP DNS from the outside.
If I am on the inside and try to resolve system2.domain.com, it doesn't get resolved because it is not setup in the DMZ DNS. I want to be able to resolve system2.domain.com by passing the query from the DMZ DNS to the ISP DNS.
Maybe what you should do is what we do. Internally, we run a bogus domain to resolve internal boxes - private.ycc . Then when we ask for www.ycc.com (our public real domain is ycc.com) our internal DNS knows its not authoritative for that domain and asks the DNS servers we have at our ISP that are authoritative for the ycc.com domain to resolve the addresses. All our internal boxes are told they are part of the "private.ycc" domain and therefore there are no conflicts.
You may also want to look into split horizon DNS where depending on who is asking for name resolution the dns server gives out different answers, usually either a private or public IP address. Bind 9 has it, but its messy to set up. DJBDNS is easier to set up but doesn't have very many followers. The different "zone" files don't have to have identical named elements, so maybe that can solve your problem as well.
-- Bill Gradwohl bill@xxxxxxx http://www.ycc.com spamSTOMPER Protected email
