[SOLVED] bind9 and DNS theoretical question

tripialos · 11-30-2015, 05:11 AM

I am trying to understand the meaning of a "hint" (bind config term) type nameserver vs a recursive one.

I read on a book that when bind is configured as per below, it will not recursively resolve a query but instead will reply with a referral.

Code:

..text omitted.. 

recursion no;


..text omitted..

zone "." IN {
        type hint;
        file "named.ca";
};

I have bought my own domain name and setup my own Authoritative nameserver with bind9 for that domain. Since my nameserver is the Authoritative of my domain it accepts queries from everyone on the internet but of course "recursive" is disabled in order to avoid having a public-open dns resolver.

My question is, the way I think of it, my nameserver, one way or another, will reply to the query either resolving the answer recursively or by providing a referral. Is that correct?

I mean if someone tries to resolve the example.com using my nameserver, despite the fact that my nameserver recursion is set to off, it will give him the referral , which I guess is the "." nameservers. So even if my server is not set to recursive it will respond to clients.

zhjim · 11-30-2015, 07:33 AM

Quote:

Originally Posted by tripialos

My question is, the way I think of it, my nameserver, one way or another, will reply to the query either resolving the answer recursively or by providing a referral. Is that correct?

This is correct. But you can use the view stanza to limit which clients get a response.

Quote:

Originally Posted by tripialos

I mean if someone tries to resolve the example.com using my nameserver, despite the fact that my nameserver recursion is set to off, it will give him the referral , which I guess is the "." nameservers. So even if my server is not set to recursive it will respond to clients.

Especially as you set recursion to off which means that you only give out referalls. Besides if you have the lookup allready in the cache. Then it sends out the looked up target ip. Regardless of the recursion stanza.
Also be sure about what the hint or . zone realy is. Its the top of the dns tree. Not more not less.

A book i always come back to. The link with the special hint part: http://www.zytrax.com/books/dns/ch4/index.html#caching

tripialos · 11-30-2015, 01:49 PM

Quote:

Originally Posted by zhjim

This is correct. But you can use the view stanza to limit which clients get a response.

Especially as you set recursion to off which means that you only give out referalls. Besides if you have the lookup allready in the cache. Then it sends out the looked up target ip. Regardless of the recursion stanza.
Also be sure about what the hint or . zone realy is. Its the top of the dns tree. Not more not less.

A book i always come back to. The link with the special hint part: http://www.zytrax.com/books/dns/ch4/index.html#caching

Hey. Thanks for the reply and more importantly special thanks for the link. Im in the process of getting myself more than familiar with DNS services and in some parts i got confused. Just like the question i posted.

Well your asnwear clears things enough.