• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Setting up DNS *correctly*

Scheduled Pinned Locked Moved DHCP and DNS
dnsdns resolutiondns resolversg-3100
20 Posts 3 Posters 5.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    bwalkco @johnpoz
    last edited by Apr 26, 2019, 6:37 PM

    @johnpoz Ok, my apologies. Sorry if this is frustrating you. I'm just trying to learn. So it sounds like I cannot resolve internal requests and forward external requests. Thank you.

    1 Reply Last reply Reply Quote 0
    • B
      bwalkco @KOM
      last edited by Apr 26, 2019, 6:39 PM

      @KOM said in Setting up DNS *correctly*:

      A resolver uses the DNS root hints to find the authoritative server for the queried domain and then query that server. A forwarder just forwards all queries to some other upstream DNS. You need to decide what you want.

      Great, thank you! Appreciate it.

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by Apr 26, 2019, 6:40 PM

        Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        B 1 Reply Last reply Apr 26, 2019, 6:47 PM Reply Quote 0
        • B
          bwalkco @johnpoz
          last edited by Apr 26, 2019, 6:47 PM

          @johnpoz said in Setting up DNS *correctly*:

          Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

          Appreciate the clarity! Thank you. Like I mentioned, it's been a while since I've done this so my nomenclature may be a bit off. After I checked the "Register DHCP leases in DNS resolver", I am able to ping by name locally. That problem is solved. With "DNS Query Forwarding" checked, I am now sending all external (www.example.com) DNS queries to 1.1.1.1 / 1.0.0.1, correct?

          If I am understanding you correctly if I want my Netgate to be the authoritative name server for external queries (from any device behind the SG-3100) I just need to disable "DNS Query Forwarding"?

          1 Reply Last reply Reply Quote 0
          • K
            KOM
            last edited by Apr 26, 2019, 6:56 PM

            An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

            By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

            B 1 Reply Last reply Apr 26, 2019, 7:07 PM Reply Quote 1
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz Apr 26, 2019, 7:07 PM Apr 26, 2019, 6:57 PM

              @bwalkco said in Setting up DNS *correctly*:

              f I want my Netgate to be the authoritative name server for external queries

              What - NO!! For starters unbound not meant to be authoritative for any domain.. Can it ack like one - sure kind of.. If you want to run an authoritative NS for a domain. Run bind..

              I think your just throwing out terms you have heard without any understanding of their meaning...

              So any NS will return what is in its cache or local data when asked. Depending if its a resolver or forwarder is what happens when it is asked to do recursion..

              Normally!!! an authoritative NS will not do recursion... Since normally these are open to the public internet because people want to resolve what they are authoritative for.. And asking them to also do recursion can lead to big issues and ability to answer the queries for what they are authoritative for, etc..

              Unbound is not meant to be authoritative for any zone... It will not hand back a SOA record pointing to itself when you ask for something it does have records for, etc. Can it do that - yeah with some tweaking..

              What it really is meant to do is be a caching ns, that resolves.. Yes you can put in neat stuff local host overrides - really just shit your perm storing in its cache... And sure you can put in domain overrides that tells it hey don't resolve domainX.tld - ask NS xyz..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              B 1 Reply Last reply Apr 26, 2019, 7:09 PM Reply Quote 0
              • B
                bwalkco @KOM
                last edited by Apr 26, 2019, 7:07 PM

                @KOM said in Setting up DNS *correctly*:

                An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

                By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

                Gotcha, ok! I think some of my old web hosting lingo (from years ago) is being conflated in my head. Appreciate the clarity around that.

                1 Reply Last reply Reply Quote 0
                • B
                  bwalkco @johnpoz
                  last edited by Apr 26, 2019, 7:09 PM

                  @johnpoz said in Setting up DNS *correctly*:

                  I think your just throwing out terms you have heard without any understanding of their meaning...

                  Sorry you came to that conclusion...have a great day 👍

                  1 Reply Last reply Reply Quote 0
                  • K
                    KOM
                    last edited by Apr 26, 2019, 7:33 PM

                    If you want to forward all DNS requests to 1.1.1.1, either:

                    1. disable resolver, enable forwarder and put 1.1.1.1 under System - General Setup - DNS Servers.

                    or

                    1. enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.
                    B 1 Reply Last reply Apr 26, 2019, 7:51 PM Reply Quote 2
                    • B
                      bwalkco @KOM
                      last edited by Apr 26, 2019, 7:51 PM

                      @KOM said in Setting up DNS *correctly*:

                      enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.

                      This is the exact configuration I went with. Thank you very much for the help!

                      1 Reply Last reply Reply Quote 0
                      20 out of 20
                      • First post
                        20/20
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received