Our company controls a domain called foobar.com, which is used for various public services (w.g. www.foobar.com directs to our website). The domain has public DNS records in a DNS service.

We have some internal network devices which we were hoping to assign names for using subdomains of the foobar.com TLD.

How can Bind9 be configured as such:

  1. First check if a public DNS server has defined a domain for some IP address
  2. If not, then check an internal DNS server whether it has defined the domain for some internal IP address
  3. If that fails, fail the lookup "normally".

Currently, our config incorrectly operates on an "on/off" basis, e.g. it either reads the public DNS or the private DNS, not both. This makes it unusable as we want to access both public and private DNS records at the same time.

The DNS servers are managed separately, and the private DNS is on a local device with Bind9 installed.

I've tried the following:

  1. Have something like this in the private DNS records

    IN NS privatens.foobar.com ; the private (local) DNS
    IN NS publicns.foobar.com ; the public DNS
  2. Set forwarding in named.conf.options to public DNS servers

    options {
        forwarders { ... };
        forward first;
  3. Juggle with priority inside resolv.conf

None of these seem to work. Examples:

www.foobar.com points to a web server using public DNS. printer.office.foobar.com is a CNAME to unique1.foobar.com which is an A record to I want queries to www.foobar.com to work with public DNS and queries printer.office.foobar.com to work with private DNS.

Now all queries to printer.office.foobar.com work, but all queries to www.foobar.com result in an NXDOMAIN response and halt there.

Is it even possible to read two different zones for a single domain (e.g. foobar.com) or will it just ignore the other?


To make the issue more clear, I've made this super nifty diagram of our network and the external thingies:

enter image description here

Anything inside the orange is our private network, with no access from outside. The things inside green are public servers with domain names set to them. is our router, is our private DNS server, and ns1.dnsprovider.com is some DNS server provided by a 3rd party.

Assuming I'm the user on I want the following to happen:

  1. When querying for user1.foobar.com I get the DNS results from privns.foobar.com/
  2. When querying for www.foobar.com or sub.foobar.com I get the DNS results from ns1.dnsprovider.com
  • Ah thanks, I'll try searching with those terms! – ojrask Nov 18 '16 at 13:12

One of the possible configurations is to have different internal and external assignments to a domain is BIND views. Typically this setup is done in a single server.

BIND views allow you to have different records in the same domain whether people are viewing it from the inside or the outside, or more interestingly, the same records with different IP addresses. (for instance addresses that map via NAT to different external addresses in others not to burden your border firewall with internal traffic).

The advantage of such setup is having to maintain two (or more) separate zones for the same domain.

To define the view you simply define in the 1st view to which networks it answers, and the rest will be shown the second view.

As in, in named.conf:

acl networks1 {;; };
acl networks2 {; };

view "nets1" {
    match-clients { networks1; };
    recursion yes;

    include "mydomain.view1";

view "nets2" {
    match-clients { networks2; };
    recursion yes;

    include "mydomain.view2"; 

See:Understanding views in BIND 9, by example

  • I'm looking for adjusting the DNS request by destination, not source. We're not allowing external access to the DNS server. Users need to be able to query both DNS servers from a single source IP in the private network. – ojrask Nov 18 '16 at 13:24
  • changed it accordingly, I hope. What do you understand by destination? The views defined are the networks of the clients. – Rui F Ribeiro Nov 18 '16 at 13:27
  • Destination is a server either inside a local network or an external network. Sources (clients) are solely inside a single private network (e.g. – ojrask Nov 21 '16 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.