Soooo, here’s a design that feels unsavory, but seems like it should function. A test reveals that it does not, but I don’t understand why.
I have name servers that are authoritative for a domain: example.com. I need to delegate subdomain.example.com to another set of name servers (let’s call them ns.subdomain.example.com). The example.com name servers are on public IP addresses and the subdomain.example.com name servers are on private IP addresses. So, once set up, a recursive query makes it through all of the nodes of the tree–[.] then [com.] then [example.com.]–but predictably dies when it reaches subdomain.example.com. What’s flummoxing me is why it dies.
The name servers that are authoritative for example.com have glue records for the two name servers that are authoritative for subdomain.example.com–ns.subdomain.example.com. And indeed, dig @ns1.example.com returns an Additional Records section with the right glue. But dig +trace subdomain.example.com times out, with the last lookup failing because it can’t resolve the IP addresses for ns.subdomain.example.com.
I’d get it if this failed because the resolver couldn’t query the name servers with the private IPs, but apparently it doesn’t heed the glue records and fails before that point. tcpdump on my client shows that the ultimate query is being directed to the first name server in /etc/resolv.conf, rather than the name servers in the RDATA in the NS Records for subdomain.example.com, which are ns.subdomain.example.com.
Can someone explain this? Mustn’t glue records be heeded, in case the delegated name servers are in a child domain?
(In case you’re wondering why this crazy setup: it’s a poor man’s way to use public DNS infrastructure for internal as well as external resolution. Intranet users, when connected via VPN, would be able to reach ns.subdomain.example.com and complete the lookups. But it ain’t gonna fly unless glue works the way I thought and is heeded in all cases by resolvers.
Yes, I’m sure this is unsavory as hell, but my goal here is to understand technically why it fails.)
submitted by /u/johnpaulpagano
Powered by WPeMatico