Setting up DNS *correctly*

johnpoz

@bwalkco said in Setting up DNS *correctly*:

forward requests when it can't resolve.

And again it doesn't work that way!!!!

You either resolve, or you forward... Its not a fall back sort of scenario..

If you want to forward - sure have at it, zero reason to have the checkbox for dnssec then..

KOM

A resolver uses the DNS root hints to find the authoritative server for the queried domain and then query that server. A forwarder just forwards all queries to some other upstream DNS. You need to decide what you want.

bwalkco

@johnpoz Does that also apply to local queries (I assume no)? My other reply to you may add some clarity.

johnpoz

If you ask unbound for something.domain.tld, and there is no host override or locally registered entry for that then it will either forward or resolve it depending on your settings.

With some caveats to how you setup the zone in unbound, transparent, static, etc. and what the domain of the query is for..

bwalkco

@johnpoz Ok, my apologies. Sorry if this is frustrating you. I'm just trying to learn. So it sounds like I cannot resolve internal requests and forward external requests. Thank you.

bwalkco

@KOM said in Setting up DNS *correctly*:

A resolver uses the DNS root hints to find the authoritative server for the queried domain and then query that server. A forwarder just forwards all queries to some other upstream DNS. You need to decide what you want.

Great, thank you! Appreciate it.

johnpoz

Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

bwalkco

@johnpoz said in Setting up DNS *correctly*:

Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

Appreciate the clarity! Thank you. Like I mentioned, it's been a while since I've done this so my nomenclature may be a bit off. After I checked the "Register DHCP leases in DNS resolver", I am able to ping by name locally. That problem is solved. With "DNS Query Forwarding" checked, I am now sending all external (www.example.com) DNS queries to 1.1.1.1 / 1.0.0.1, correct?

If I am understanding you correctly if I want my Netgate to be the authoritative name server for external queries (from any device behind the SG-3100) I just need to disable "DNS Query Forwarding"?

KOM

An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

johnpoz

@bwalkco said in Setting up DNS *correctly*:

f I want my Netgate to be the authoritative name server for external queries

What - NO!! For starters unbound not meant to be authoritative for any domain.. Can it ack like one - sure kind of.. If you want to run an authoritative NS for a domain. Run bind..

I think your just throwing out terms you have heard without any understanding of their meaning...

So any NS will return what is in its cache or local data when asked. Depending if its a resolver or forwarder is what happens when it is asked to do recursion..

Normally!!! an authoritative NS will not do recursion... Since normally these are open to the public internet because people want to resolve what they are authoritative for.. And asking them to also do recursion can lead to big issues and ability to answer the queries for what they are authoritative for, etc..

Unbound is not meant to be authoritative for any zone... It will not hand back a SOA record pointing to itself when you ask for something it does have records for, etc. Can it do that - yeah with some tweaking..

What it really is meant to do is be a caching ns, that resolves.. Yes you can put in neat stuff local host overrides - really just shit your perm storing in its cache... And sure you can put in domain overrides that tells it hey don't resolve domainX.tld - ask NS xyz..

bwalkco

@KOM said in Setting up DNS *correctly*:

An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

Gotcha, ok! I think some of my old web hosting lingo (from years ago) is being conflated in my head. Appreciate the clarity around that.

bwalkco

@johnpoz said in Setting up DNS *correctly*:

I think your just throwing out terms you have heard without any understanding of their meaning...

Sorry you came to that conclusion...have a great day

KOM

If you want to forward all DNS requests to 1.1.1.1, either:

disable resolver, enable forwarder and put 1.1.1.1 under System - General Setup - DNS Servers.

or

enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.

bwalkco

@KOM said in Setting up DNS *correctly*:

enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.

This is the exact configuration I went with. Thank you very much for the help!