Providing proxy DNS service with an all-the-hats-at-once DNS server software.

You've come to this page because you've asked a question similar to the following:

My DNS server software is one of the ones that vainly try to wear all of the hats at once. How do I configure it to provide proxy DNS service, so that I can look up the DNS data that are published by the rest of Internet ?

This is the Frequently Given Answer to that question.

What you do if you use Microsoft's DNS server

• Enable (any form of) recursion, by turning off the "disable recursion" option.

• Remove any "." "zone" that you may have (transferring any data in it that you might have entered and wish to keep to a "zone" further down the namespace tree).

• Either

  • configure your server to forward queries to some other proxy DNS server that is closer to the rest of Internet (optionally enabling the egregiously misnamed "do not use recursion" option if you don't want your server to attempt query resolution);

    Note: If you removed a "." "zone", Microsoft's DNS Server Management tool will not recognize your having done so, and will not consequently enable the forwarding page. It decides whether to enable the forwarding page at startup. So you must stop and re-start the tool.

    or

  • enable query resolution by disabling the egregiously misnamed "do not use recursion" option and ensuring that your server has a set of "root hints";

  choosing which mechanism to employ by applying the decision criteria for deciding whether to have a forwarding proxy DNS server to your particular situation.

Best practice is to have separate content and proxy DNS servers, and thus to remove all DNS database content from the server, apart from the content that is recommended by RFC 1912 § 4.1. Some DNS server softwares don't require explicit DNS database content at all in order to address this issue, because they simply generate the answers for "localhost.", "1.0.0.127.in-addr.arpa.", and the like on the fly. Microsoft's DNS server, however, simply automatically re-creates certain "zones", covering most of these domain names, in its DNS database at service startup, populating them with fixed, well-known, content.

What you do if you use ISC's BIND

• Enable (any form of) recursion, by setting the recursion option in BIND's configuration file to yes.

  Check that the allow-recursion option lists the IP addresses of the DNS Clients who will be sending the queries to your server's front-end.

• Ensure that any "." "zone" that you may have is one of type "hint" and not of any other type.

• Either

  • configure your server to forward queries, to some other proxy DNS server that is closer to the rest of Internet, by providing a list of such forwardees in the egregiously misnamed forwarders option in BIND's configuration file (optionally also setting to the forward option in BIND's configuration file to only if you don't want your server to attempt query resolution);

    or

  • enable query resolution by ensuring that the forward option in BIND's configuration file is not set to only and ensuring that your server has a set of "root hints";

  choosing which mechanism to employ by applying the decision criteria for deciding whether to have a forwarding proxy DNS server to your particular situation.

Best practice is to have separate content and proxy DNS servers, and thus to remove all DNS database content from the server, apart from the content that is recommended by RFC 1912 § 4.1. Some DNS server softwares don't require explicit DNS database content at all in order to address this issue, because they simply generate the answers for "localhost.", "1.0.0.127.in-addr.arpa.", and the like on the fly. ISC's BIND requires that the administrator create, populate, and configure the relevant "zones" by hand.