Re: DNSSEC + Split DNS
Brian Candler via Pdns-users <[email protected]> Thu, 9 Apr 2026 10:09:11 +0100
| Newsgroups | gmane.network.dns.powerdns.user |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============6498502322578609676==
Content-Type: multipart/alternative;
boundary="------------63D6TVKTRbcVDeR0Gq70x0CF"
Content-Language: en-GB
This is a multi-part message in MIME format.
--------------63D6TVKTRbcVDeR0Gq70x0CF
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
On 09/04/2026 09:57, rob777 via Pdns-users wrote:
> The headache comes indeed mainly with this few shadow records - tough
> i'm not sure if i mean exactly the same as you with the term "Shadow
> Record".
>
> Example what i mean:
>
> External Side:
> - a configured A Record server01.bla.test.com
> <http://server01.bla.test.com> points to 194.88.45.32 on the external
> Public Zone of test.com <http://test.com> in the AWS R53 config
> - only external clients are resolving server01.bla.test.com
> <http://server01.bla.test.com> to this 194.88.145.32 IP
>
>
> Internal Side:
> - a configured A Record server01.bla.test.com
> <http://server01.bla.test.com> points to 192.168.1.22 on the internal
> bla.test.com <http://bla.test.com> Zone on the internal Powerdns
> Authoritative
> - only internal Clients/Servers resolve server01.bla.test.com
> <http://server01.bla.test.com> to this 192.168.1.22 IP via the
> forward-zone=bla.test.com <http://bla.test.com> on the internal DNS
> Recursor
>
Ah, so these subdomains are also visible to public clients, not purely
for internal consumption? And you're going to sign these subdomains?
To get internal clients to see a different result for
server01.bla.test.com than what is in the public DNS, configuring a
Response Policy Zone on the recursor is the way I'd do it. This is what
RPZ is designed for: to override specific DNS answers.
However, I believe it should also work to have a different,
internal-only (and unsigned) bla.test.com zone with forward-zones and
NTA for bla.test.com on the recursor.
--------------63D6TVKTRbcVDeR0Gq70x0CF
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 09/04/2026 09:57, rob777 via
Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAPVCxwb30k9bPcbPUDqbjxdHvvzvc4chZ_9v1Ssmeeeh1HUQw@mail.gmail.com">
<div>The headache comes indeed mainly with this few shadow records
- tough i'm not sure if i mean exactly the same as you with the
term "Shadow Record".</div>
<div><br>
</div>
<div>Example what i mean:<br>
<br>
</div>
<div>External Side:</div>
<div>- a configured A Record <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
points to 194.88.45.32 on the external Public Zone of <a
href="http://test.com" moz-do-not-send="true">test.com</a> in
the AWS R53 config</div>
<div>- only external clients are resolving <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
to this 194.88.145.32 IP</div>
<div><br>
</div>
<div><br>
</div>
<div>Internal Side:<br>
</div>
<div>- a configured A Record <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
points to 192.168.1.22 on the internal <a
href="http://bla.test.com" moz-do-not-send="true">bla.test.com</a>
Zone on the internal Powerdns Authoritative</div>
<div>- only internal Clients/Servers resolve <a
href="http://server01.bla.test.com" moz-do-not-send="true">server01.bla.test.com</a>
to this 192.168.1.22 IP via the forward-zone=<a
href="http://bla.test.com" moz-do-not-send="true">bla.test.com</a>
on the internal DNS Recursor</div>
<div><br>
</div>
</blockquote>
<p>Ah, so these subdomains are also visible to public clients, not
purely for internal consumption? And you're going to sign these
subdomains?</p>
<p>To get internal clients to see a different result for
server01.bla.test.com than what is in the public DNS, configuring
a Response Policy Zone on the recursor is the way I'd do it. This
is what RPZ is designed for: to override specific DNS answers.</p>
<p>However, I believe it should also work to have a different,
internal-only (and unsigned) bla.test.com zone with forward-zones
and NTA for bla.test.com on the recursor.</p>
</body>
</html>
--------------63D6TVKTRbcVDeR0Gq70x0CF--
--===============6498502322578609676==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Pdns-users mailing list
[email protected]
https://mailman.powerdns.com/mailman/listinfo/pdns-users
--===============6498502322578609676==--