I’m trying to implement different views of same subdomain without having to map all the records one by one (just like redirecting an entire domain) via DNAME.
My scenario:
2 networks/sites: foo and bar
both have a subdomain with the same names pointing to different IPs
each site runs each own unbound instance identically configured and serving all the zones as auth-zones.
I want to implemennt some kind of split-DNS via views, so any ‘*.local.example.net’ (arbitrary wildcard) resolves to the same name at the site that DNS client belongs to.
As both foo.example.net and bar.example.net have the same records (with different rdata), I want to ‘alias’ the entire subdomain via DNAME, as the query name may be arbitrary I want to avoid to have to manually add any possible CNAME.
My try (as simple and as logical I think) is to setup this configuration on both unbounds:
server:
access-control-view: 192.168.1.0/24 foo-view
access-control-view: 192.168.0.0/24 bar-view
view:
name: "foo-view"
local-zone: local.example.net. transparent
local-zone: remote.example.net. transparent
local-data: "local.example.net. DNAME foo.example.net."
local-data: "remote.example.net. DNAME bar.example.net."
view:
name: "bar-view"
local-zone: local.example.net. transparent
local-zone: remote.example.net. transparent
local-data: "local.example.net. DNAME bar.example.net."
local-data: "remote.example.net. DNAME foo.example.net."
foo.example.net and bar.example.net are ‘auth’ zones served by unbound itself. There is no real zone local.example.net (just the local-zone/data).
Although I get the correct response when I query for:
dig @10.24.230.1 local.example.net DNAME
When I query for anything below local.example.net I get NXDOMAIN, ie.:
dig @10.24.230.1 ``a.local.example.net
dig @10.24.230.1 ``b.local.example.net
(I would expect to receive resolved answer 'a.foo.example.net, b.foo.example.net or in bar subdomain)
Basically views work, but DNAME not fully work. I tried both transparent/typetransparent and static, but although unbound sees and returns the DNAME, doesn’t recurse/resolve behind it.
Where is my error/wrong assumption? Could this be easily implemented in unbound?
Although I think I have a good knowledge on how DNS works, I admit is hard to me to understand the internal resolution process unbound does between local-data, stub, auth, … and its tricky details. I’m also aware that unbound clearly states is just a resolver and not a full fledged authoritative server, however I think my idea is simple and may be just one step behind.
Thanks much for any ideas/hints or notes.