Domain resolve problem with stock Debian

Question

I have a simple install with Debian as a guest in Virtualbox. I installed the resolvconf package. The resolv.conf file is this:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8
nameserver 10.3.x.x
nameserver 10.219.x.x

I added nameservers through GUI (Applications/System Tools/Network Tools).

The 8.8.8.8 is Google's DNS, and I want to use it to resolve internet addresses. The 10.3.x.x and 10.219.x.x are needed to resolve internal domains like teleportal.company.intra.

When I have these nameservers in resolv.conf(and 8.8.8.8 is the first) I get an error when querying internal an address:

> host teleportal.company.intra           
Host teleportal.company.intra not found: 3(NXDOMAIN)

However if I explicitly set the second nameserver's address as a nameserver for nslookup, it works:

» nslookup teleportal.company.intra 10.3.x.x
Server:     10.3.x.x
Address:    10.3.x.x#53

teleportal.company.intra    canonical name = proxy.dummy1.dummy2.private.
Name:   proxy.dummy1.dummy2.private
Address: 172.27.x.x
Name:   proxy.dummy1.dummy2.private
Address: 172.27.x.x

The resolv.conf documentation states that the nameserver entries will be tried in order, if one of them cannot resolve the query. However if I turn debug on when using nslookup I see that nslookup does not even try other entries, only the first.

If I change the order of the nameservers, then internal addresses will be resolved properly (nslookup still uses only the first entry).

How can I set up 3 nameservers so that utilities will use all of them in order?

Answer 1

The resolv.conf list of nameservers is contacted one after the other only in case of timeout. Not when one nameserver authoritively says "there is no such domain" (NXDOMAIN). In your case the DNS 8.8.8.8 apparently does not know about teleportal.company.intra and the resolver stopped when it got the NXDOMAIN.

If possible you should configure one DNS server and use it for all your resolution and let the DNS server decide how to resolve the name. If 10.3.x.x is your intranet DNS server it would likely be able to resolve the internet hostnames as well.

Having said that, if you really want to relay the requests to different DNS servers based on the names you could try pdnsd. Its a caching DNS proxy program that one would run locally. Install it (apt-get install pdnsd) and add your localhost (127.0.0.1) to resolv.conf. In the pdnsd.conf configuration file you can specify which DNS servers to contact based on name matching. An example paragraph for your /etc/pdnsd.conf:

server {
    label= "google";
    exclude = ".company.intra";
    ip = 8.8.8.8;
}

server {
    label= "intra";
    include = ".company.intra";
    ip = 10.3.x.x;
}

I've snipped out many other parameters in the above file. You should follow the documentation and the example config file that ships with debian package to setup your pdnsd.conf.

Answer 2

I think that the resolver falls back to secondary (or tertiary or ...) DNS only if the first (or second or ...) fails.

In this case the query doesn't fail, it correctly returns NXDOMAIN, i.e. the domain name doesn't exist.

If you really want to use Google's DNS (or any other DNS for that matter) to resolve external domains (instead of your internal nameservers), you can configure your servers 10.3.x.x and 10.219.x.x to be authoritative for your internal names only and to forward all the other queries to external DNS, then use your internal nameservers as your only nameservers on your internal computers.