Edit: This was a generally awful question, as in not well documented. It wasn't generally awful in that I truly didn't know what was going wrong, and had been searching and researching. I finally turned to ServerFault with a "BBBBLLLLaaarrggghhh" type question. The title still stands, but the body should have been:
My DNS server appears to be resolving my queries with different answers depending on what network I'm attached to. Examples are:
# DiG command
resulting output from first zone
# DiG command
resulting output from second zone
I'll gladly provide more supporting detail. Please explain how I should get the supporting detail, though.
Now back to my awful question:
I've read a lot of other ServerFault BIND9 DNS not forwarding questions and answers. Queries (using DiG) for FQDNs I expect to be forwarded respond as if the public internet has the authoritative answer. Beyond DiG, what tools can I use to trace through my BIND9 configuration? It appears the zone I'm trying to forward is not forwarding.
Specifically, I am at home with a VPN to my work. I want to access my home zone (myhome.com., with DNS server at 10.71.73.10) and also my work zone (mywork.com., with DNS server at 10.10.1.33).
Using DiG to query hostname.mywork.com, DiG reports the AUTHORITY to be the public nameserver. The local resolver seems to ignore the BIND forwarding zone (db.mywork.com).
In /etc/bind/zones/db.mywork.com
// forwards mywork queries to the mywork DNS servers
zone "mywork.com" {
type forward;
forwarders { 10.10.1.33; };
};
bind.conf: include "/etc/bind/named.conf.options"; include "/etc/bind/named.conf.local"; include "/etc/bind/named.conf.default-zones"; include "/etc/bind/rndc.key"; include "/etc/bind/named.conf.logging";
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
named.conf.options
acl goodclients {
10.71.73.0/24;
localhost;
localnets;
};
options {
directory "/var/cache/bind";
forwarders {
8.8.8.8; # Google DNS #1
8.8.4.4; # Google DNS #2
};
recursion yes;
allow-query { goodclients; };
dnssec-enable no;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
listen-on port 53 { localhost; };
};
and named.conf.local
# Forward zone
zone "myhome.com." {
type master;
file "/etc/bind/zones/db.myhome.com";
};
# Reverse zone
zone "73.71.10.in-addr.arpa" IN {
type master;
notify no;
file "/etc/bind/zones/db.10";
};