Re: DNSSEC + Split DNS

--===============3091931533763007430==
Content-Type: multipart/alternative; boundary="0000000000001a9ada064f03371f"

--0000000000001a9ada064f03371f
Content-Type: text/plain; charset="UTF-8"

Hi

Thanks a lot for the reference to NTAs - yes this seems to be straight
forward.

The headache comes indeed mainly with this few shadow records - tough i'm
not sure if i mean exactly the same as you with the term "Shadow Record".

Example what i mean:

External Side:
- a configured A Record server01.bla.test.com points to 194.88.45.32 on the
external Public Zone of test.com in the AWS R53 config
- only external clients are resolving server01.bla.test.com to this
194.88.145.32 IP


Internal Side:
- a configured A Record server01.bla.test.com points to 192.168.1.22 on the
internal bla.test.com Zone on the internal Powerdns Authoritative
- only internal Clients/Servers resolve server01.bla.test.com to this
192.168.1.22 IP via the forward-zone=bla.test.com on the internal DNS
Recursor


I would assume that since the internal resolution path would be via
forward-zone configuration of bla.test.com it should work when the internal
Zone bla.test.com is not dnssec enabled and the external bla.test.com is
dnssec enabled

But i'm absolutely and 100% unsure about this and i dont like this
situation at all..

Best Regards


Am Do., 9. Apr. 2026 um 10:38 Uhr schrieb Brian Candler <[email protected]
>:

> On 09/04/2026 09:13, rob777 via Pdns-users wrote:
>
> Do i create a mess with this planned DNSSEC enabling on the external
> test.com DNS Zone?
>
> If it's just a case of private, unsigned subdomains of test.com, then all
> you need to do is to set Negative Trust Anchors for these subdomains on
> your internal recursor(s), and it will be fine.
>
> See: https://doc.powerdns.com/recursor/settings.html#forward-zones
>
> The fact that you have conflicting parent zones ("shadow zone") might be
> more problematic, but I'm not sure. Personally, I'd get rid of the shadow
> test.com zone and use an RPZ to override the specific answers that you
> want to be different for internal clients - which you say is only 2 or 3
> records. It's much more maintainable too, since anything you add to the
> public test.com zone will be visible to internal clients automatically;
> you don't have to keep the shadow zone file in sync.
>
> https://doc.powerdns.com/recursor/lua-config/rpz.html
>
>
>

--0000000000001a9ada064f03371f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi</div><div><br></div><div>Thanks a lot for the refe=
rence to NTAs - yes this seems to be straight forward.</div><div><br></div>=
<div>The headache comes indeed mainly with=C2=A0this few shadow records - t=
ough i&#39;m not sure if i mean exactly the same as you with the term &quot=
;Shadow Record&quot;.</div><div><br></div><div>Example what i mean:<br><br>=
</div><div>External Side:</div><div>- a configured A Record <a href=3D"http=
://server01.bla.test.com">server01.bla.test.com</a> points to 194.88.45.32 =
on the external Public Zone of <a href=3D"http://test.com">test.com</a> in =
the AWS R53 config</div><div>- only external clients are resolving <a href=
=3D"http://server01.bla.test.com">server01.bla.test.com</a> to this 194.88.=
145.32 IP</div><div><br></div><div><br></div><div>Internal=C2=A0Side:<br></=
div><div>- a configured A Record <a href=3D"http://server01.bla.test.com">s=
erver01.bla.test.com</a> points to 192.168.1.22 on the internal <a href=3D"=
http://bla.test.com">bla.test.com</a> Zone on the internal Powerdns Authori=
tative</div><div>- only internal Clients/Servers resolve <a href=3D"http://=
server01.bla.test.com">server01.bla.test.com</a> to this 192.168.1.22 IP vi=
a the forward-zone=3D<a href=3D"http://bla.test.com">bla.test.com</a> on th=
e internal DNS Recursor</div><div><br></div><div><br></div><div>I would ass=
ume that since the internal resolution path would be via forward-zone confi=
guration of <a href=3D"http://bla.test.com">bla.test.com</a> it should work=
 when the internal Zone <a href=3D"http://bla.test.com">bla.test.com</a> is=
 not dnssec enabled and the external <a href=3D"http://bla.test.com">bla.te=
st.com</a> is dnssec enabled</div><div><br></div><div>But i&#39;m absolutel=
y=C2=A0and 100% unsure about this and i dont=C2=A0like this situation at al=
l..</div><div><br></div><div>Best Regards</div><div><br></div><div></div><b=
r><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">Am Do., 9. Apr. 2026 um 10:38=C2=A0Uhr schrieb Brian Candle=
r &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt;:<b=
r></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex=
;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>

 =20
   =20
 =20
  <div>
    <div>On 09/04/2026 09:13, rob777 via
      Pdns-users wrote:<br>
    </div>
    <blockquote type=3D"cite">Do
      i create a mess with this planned DNSSEC enabling on the external
      <a href=3D"http://test.com" target=3D"_blank">test.com</a> DNS
      Zone?</blockquote>
    <p>If it&#39;s just a case of private, unsigned subdomains of <a href=
=3D"http://test.com" target=3D"_blank">test.com</a>,
      then all you need to do is to set Negative Trust Anchors for these
      subdomains on your internal recursor(s), and it will be fine.</p>
    <p>See:
      <a href=3D"https://doc.powerdns.com/recursor/settings.html#forward-zo=
nes" target=3D"_blank">https://doc.powerdns.com/recursor/settings.html#forw=
ard-zones</a></p>
    <p>The fact that you have conflicting parent zones (&quot;shadow zone&q=
uot;)
      might be more problematic, but I&#39;m not sure. Personally, I&#39;d =
get
      rid of the shadow <a href=3D"http://test.com" target=3D"_blank">test.=
com</a> zone and use an RPZ to override the
      specific answers that you want to be different for internal
      clients - which you say is only 2 or 3 records. It&#39;s much more
      maintainable too, since anything you add to the public <a href=3D"htt=
p://test.com" target=3D"_blank">test.com</a>
      zone will be visible to internal clients automatically; you don&#39;t
      have to keep the shadow zone file in sync.</p>
    <p><a href=3D"https://doc.powerdns.com/recursor/lua-config/rpz.html" ta=
rget=3D"_blank">https://doc.powerdns.com/recursor/lua-config/rpz.html</a></=
p>
    <p><br>
    </p>
  </div>

</blockquote></div></div>

--0000000000001a9ada064f03371f--

--===============3091931533763007430==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users

--===============3091931533763007430==--