Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I know that to disable recursive queries in BIND, I need add the following lines to the options section of /etc/bind/named.conf.options

allow-transfer {"none";};
allow-recursion {"none";};
recursion no;

Will the above configuration disable all DNS recursive queries?

How can I disable DNS recursion only to external network queries and keep recursion only for Internal network?

If I disable the recursion, then what process will be performed by the BIND resolve the name request? Iterative or Inverse?

share|improve this question
2  
In future, please ask on unix.stackexchange.com, as this is not Ubuntu-specific at all. –  Celada Aug 1 '12 at 12:34
    
@Celada Sure :-( –  Mithun P Aug 1 '12 at 13:21
    
Somebody can move this to unix.stackexchange.com –  Mithun P Aug 7 '12 at 7:08
    
Actually, @Celada, the configuration files for Ubuntu are not generally in standard Unix/POSIX, and they often have different names. –  sventech Nov 8 '13 at 14:56

1 Answer 1

up vote 5 down vote accepted

You can enable recursion for some clients and disable recursion for others using views, but it is not recommended because you will lose some of the advantages of turning off recursion in the first place. You should use different nameservers for recursive resolution and authoritative service. (The two servers could run on the same machine if necessary.) Still, here's how to do it:

// global options apply to external clients
options {
    recursion no;
    additional-from-auth no;
    additional-from-cache no;
};

view "local" in {
    // view options enable recursion only for local clients
    match-clients { 172.16.45.80/23; 192.168.12.0/24; 127.0.0.1/8; ::1; };
    recursion yes;
    additional-from-auth yes;
    additional-from-cache yes;

    zone "." in {
            type hint;
            file "/etc/bind/db.root";
    };

    // put definitions for zones like "localhost" and "127.in-addr.arpa" here
}

// put definitions for real authoritative zones here.

As for the question in your last sentence, "what process will be performed by the BIND resolve the name request? Iterative or Inverse?", I do not understand the question. A nameserver configured not to offer recursive service will simply refuse to answer recursive queries.

share|improve this answer
    
Actually, a nameserver configured to not recurse will return a SOA record of the root nameservers when queried for a domain that the non-recursive DNS server is not authoritative for. It will not simply drop the request or send an error -- it will actually respond that it is not allowed to recurse (DNS Header Flags Section), but will provide SOA records for the root servers. It basically tells the requestor, "I can't tell you, but I'll point you in the right direction..." –  Benjamin Jul 17 '13 at 15:32
    
Depends on the software and configuration. In this case (BIND with recursion no configured), it should respond with a REFUSED error and nothing else (no SOA records). –  Celada Jul 17 '13 at 20:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.