Hopefully this is possible to do.
The question
Is it possible to configure a DNS server that is authorative for a given domain, to "fallback" and recurse via Forwarders / Root Hints when it cannot find the record locally?
The scenario
To give a concrete scenario, imagine a private (internal) network that is served by an internal Active Directory-backed DNS server (10.10.10.10) for the domain poorlyplanned.com
Internal clients that query for records like hostgroupA.poorlyplanned.com
get their answer from the local internal DNS server (10.10.10.10).
Queries from internal clients for other domains are recursively resolved via the internal DNS server (10.10.10.10) using forwarders/root hints.
Additionally, there is a public DNS server (large highly available load balanced servers actually), say at IP 1.2.3.4 and is authorative for the same domain name poorlyplanned.com
.
External clients that query for records go directly to the public DNS server at 1.2.3.4 for resolution. For example, a public query for webserverX.poorlyplanned.com
is resolved directly from public DNS server 1.2.3.4 and returns say 50.51.52.53 to the client. When I say resolved directly, I mean that the NS records point to the public DNS server and the query is not going via the internal server (it isn't publicly accessible anyway).
The internal DNS gets populated with private DNS records for poorlyplanned.com
that are not intended to be publicly resolvable, whereas the external DNS gets populated with public DNS records (for the same domain) that should be publicly resolvable.
So far, pretty standard DNS stuff, though arguably not ideal.
The problem
Internal clients cannot resolve public DNS records like webserverx.poorlyplanned.com
because these records are not defined on the internal DNS server. Since the internal DNS server is authorative for the same poorlyplanned.com
domain, it simply returns a 'DNS record not found' result after looking at the internal records only - as authorative DNS server normally do.
A constraint we have is that the public DNS server is administered by a 3rd party and has frequent churn, making it a very hard task to manually maintain a duplicate set of records on the internal DNS server, without dropping the ball.
As a workaround, we tried adding additional client-side DNS lookup server entries pointing to the external DNS servers (in an attempt to supplement the internal DNS servers) but that doesn't work because both are authorative and the client doesn't try subsequent servers on the list once one returns with a result.
Split-brain or horizontal configurations are not feasible either because those have both servers containing the same DNS records, just with different IPs or can share zone files.
However, if it were possible to have the internal DNS server recursively resolve via forwarder/root hints when it cannot find the record locally that would work a charm. But how?
I realise that if the internal domain was originally configured with some sub-domain offset like int.poorlyplanned.com
then we don't have a problem. Unfortunately the scale of the resources already deployed and the sites involved, is prohibitive of such a change.
Surely this isn't a unique problem?
I hope I've expressed myself clearly enough - please let me know if I can help clarify.
Thanks for reading/helping!