I want to run a DNS setup where the zones are managed on an internal Active Directory DNS server. There is a slave DNS server on the edge on the network which runs BIND (I am open to switching this, I read that Unbound may be better?). What I want to do is to run the DNS server on the edge in split-DNS; towards the internal network it should be a slave to the AD DNS, towards the internet it should act as being master and make some changes to the zone (namely removal of A records pointing to RFC1918 IPs).
I made a diagram to illustrate. IP addresses and names are fictive. 10/8 is local, 192.168/16 and 172.16/12 are publicly routable for the sake of this example. EXAMPLE.COM and EXAMPLE.ORG represent two different organisations:
LOCAL NETWORK PUBLIC INTERNET
+------------------+
| |
| 10.0.0.1 |
| AD.EXAMPLE.COM |
| |
| EXAMPLE.COM |
| (master) |
| |
+------------------+
|
+--------+ +------------------+------------------+
| CLIENT |-| | |
+--------+ | 10.0.0.2 | 192.168.200.1 |
+--------+ | BIND.EXAMPLE.COM | NS1.EXAMPLE.COM |
| CLIENT |-| | |
+--------+ | EXAMPLE.COM | EXAMPLE.COM |
+--------+ | (slave) | (master) |
| CLIENT |-| (resolver) | |
+--------+ +------------------+------------------+
|
+------------------+
| |
| 172.16.100.1 |
| NS1.EXAMPLE.ORG |
| |
| EXAMPLE.COM |
| (slave) |
| |
+------------------+
Some key points:
- I do not want to keep zones on the BIND server updated by hand; zones should be transferred from the AD server and modified/rewritten automatically.
- From the public internet, AD.EXAMPLE.COM is not mentioned in SOA or NS records. As far as the internet is concerned, it is not a DNS server. NS1.EXAMPLE.COM is the only master towards the internet.
- Other internet-facing servers can be slave for NS1.EXAMPLE.COM, so zone transfers from BIND must be possible (I don't expect any problems here).
- The BIND server is authoritative-only towards the internet, but an open resolver towards the local network.
- DNSSec (if applicable) is terminated on the BIND server.