Description Arvid Requate 2018-06-11 20:41:12 CEST

For Bug 32626 I checked if delegation of a DNS subdomain to a different DNS server actually works.

Unfortunately our global "forwarders" configuration in /etc/bind/named.conf.samba4 and /etc/bind/named.conf.proxy causes bond9 to contact the forwarders for all DNS zones except for the ones he is authoritative himself.

The usual workaround is to explicitly specify an empty list of forwarders for the hosted zones, see: https://deepthought.isc.org/article/AA-00538/0/How-can-I-disable-global-forwarding-for-delegated-subdomains.html

I have tasted this with the named.conf.proxy and it works. We could adjust univention-bind/bind.py to add this line to the zones and I'll attach a patch below.

Things look more complicated for the Samba/AD case, where a DLZ module is used. In our current named.conf.samba4 we don't explicitly configure individual zones but use the default "search yes" feature of Bind9 DLZ. I think we would have to switch to the "search no" configuration as documented here: https://kb.isc.org/article/AA-00995/0/Using-DLZ-in-BIND-9.8.html

My first tests with this where unsuccessful though and the nameserver didn't resolve his own FQDN any more (Host master10.ar41i1.qa not found: 2(SERVFAIL)). After digging a bit in the bind9 dlz.c and the dlz_dlopen driver I think that the Samba dlz_bind9.c module needs to be adjusted to initialize its  zone_partition_relation in the dlz_create function already, instead of later in dlz_configure. In my tests it looked like dlz_configure didn't get called at all when the "search no" DLZ option is active.