The dns servers run at least bind 9.3.x.x.x.
Recursion is on (means set to yes) by default and limited globally via allow-recursion as part of options.
A DNS connected to the Internet.

Meanings below:
IPA = IP Address
IPAR = IP Address Range
NS-IPA = Name Server IP Address.
The config has been simplified for this example.

Contents of named.conf file.

options {
directory "/var/named";
allow-recursion { IPAR1; IPAR2; IPAR3; IPA1; IPA2; IPA3; localnets; localhost; };
allow-transfer { IPA4; IPA5; IPA6; IPA7; localhost; };
check-names master ignore;

logging {
category lame-servers {null; };

zone "." IN {
type hint;
file "named.root";

zone "localhost" IN {
type master;
file "forward.localhost";
allow-update { none; };

zone "" IN {
type master;
file "reverse.127.0.0";
allow-update { none; };

zone ""{
type master;
file "";

zone "" {
type forward;
forwarders {NS-IPA8; NS-IPA9;};
forward first;

zone ""{
type master;
file "";

Lookups on domain name fail.
For example, using an outside public DNS to lookup, I get the error "can't Server failed".

If I do a nslookup from an IPA within IPAR1, which is listed in the allow-recursion, then the lookup works.

The impression I have gotten are the following:
1. Doing a forward on a domain is doing a recursive lookup on a domain name.
2. Due to setting the type as forward, bind now sees it as a recursive lookup for a domain name it is not authoritative for, and now denies lookup for it from the public (this means the forward does not work) as recursive lookups are limited to specific IPAs as listed in the allow-recursion line above.

How can I get forwarding done to accomplish all the following with the same DNS:

1. Provide recursion to selected network IPA ranges on Internet, and no recursion to the rest of the public Internet (such as indicated by the allow-recursion line).
2. Be master for many domain names (as shown by the above example).
3. Forwards requests from the public for many other selected domain names to other DNS on the Internet.

Is this even possible to do?

C) I don't see how it can be done via view clause method either. If you know how, please provide examples showing forward, and master, and recursion limiting within the view definition.


Thank you in advance for any input and/or guidance on this topic.