Resolving CNAMEs with DNS Resolver & domain overrides
-
I'm struggling to configure pfSense DNS resolver to forward queries for a specific internal domain to an internal DNS server, while acting as a resolver for everything else.
Problem: The internal DNS server is recursive, and fully resolves CNAMEs. I added the corresponding domain override to the pfSense resolver configuration, it forwards DNS queries for the internal domain correctly, but it ignores the recursive answer. I confirmed (by watching traffic with tcpdump) that the internal DNS server responds with a full recursive answer, i.e. including target A records for a given CNAME. However, pfSense only replies to the client with the CNAME value. I couldn't find any setting to make it forward the full recursive answer.
One possible solution I was thinking about is to activate both DNS forwarder and DNS resolver in pfSense. Forwarder would be listening on the standard port 53, and forwarding queries to the resolver running on a different port, e.g. 54. The internal domain override would be configured in the forwarder, ensuring the full recursive answer gets forwarded (tested & confirmed forwarder does return the full answer). It seems rather complicated though, I'm wondering if there is a better solution?
Thank you,
Jakub -
@jakub-krauz said in Resolving CNAMEs with DNS Resolver & domain overrides:
pfSense DNS resolver to forward queries for a specific internal domain to an internal DNS server
Like this : https://superuser.com/questions/1753898/how-to-configure-a-forward-zone-to-handle-nested-domains ?
Custom options should look like :
-
@Gertjan Thank you for your response. I tested with the custom options as you suggested, but it gave me the same results as previously with domain overrides.
I realised however what the problem was - the CNAME in question was pointing to a completely different domain (a DNS name of an ALB in AWS). I first confirmed that CNAMEs pointing to records within the same domain do actually resolve correctly. Adding another override for the domain of the ALB resolved the problem for me.
