Wildcarding top level zones

[Matt Shields]

On a previous thread I noticed someone else trying to wildcard all of .com,
.net and .org because people had their domains pointed to his server. I
have the same issue and I was able to get this to work by adding the
following 3 zones.

Zcom:ns1.mydomain.com.:hostmaster.mydomain.com
&com::ns1.mydomain.com:86400
&com::ns2.mydomain.com:86400
+*.com:1.1.1.1:3600
@*.com::.:0:3600
'*.com:v=spf1 -all:3600

Znet:ns1.mydomain.com.:hostmaster.mydomain.com
&net::ns1.mydomain.com:86400
&net::ns2.mydomain.com:86400
+*.net:1.1.1.1:3600
@*.net::.:0:3600
'*.net:v=spf1 -all:3600

Zorg:ns1.mydomain.com.:hostmaster.mydomain.com
&org::ns1.mydomain.com:86400
&org::ns2.mydomain.com:86400
+*.org:1.1.1.1:3600
@*.org::.:0:3600
'*.org:v=spf1 -all:3600


The question I have is, when I do a dig (see below) in the AUTHORITY SECTION
it says com, net or org instead of the domain I'm querying, will this cause
problems?

[***@aquarium root]# dig @127.0.0.1 whatever.com

; <<>> DiG 9.3.4-P1 <<>> @127.0.0.1 whatever.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9855
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;whatever.com. IN A

;; ANSWER SECTION:
whatever.com. 3600 IN A 1.1.1.1

;; AUTHORITY SECTION:
com. 86400 IN NS ns1.mydomain.com.
com. 86400 IN NS ns2.mydomain.com.

;; ADDITIONAL SECTION:
ns1.mydomain.com. 86400 IN A 127.0.0.1
ns2.mydomain.com. 86400 IN A 127.0.0.1

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jun 7 12:51:07 2010
;; MSG SIZE rcvd: 124


-matt

[Matt Shields]

I'm not sure if my message got through the mail list so I'm posting again.

On a previous thread I noticed someone else trying to wildcard all of .com,
.net and .org because people had their domains pointed to his server. I
have the same issue and I was able to get this to work by adding the
following 3 zones.

Zcom:ns1.mydomain.com.:hostmaster.mydomain.com
&com::ns1.mydomain.com:86400
&com::ns2.mydomain.com:86400
+*.com:1.1.1.1:3600
@*.com::.:0:3600
'*.com:v=spf1 -all:3600

Znet:ns1.mydomain.com.:hostmaster.mydomain.com
&net::ns1.mydomain.com:86400
&net::ns2.mydomain.com:86400
+*.net:1.1.1.1:3600
@*.net::.:0:3600
'*.net:v=spf1 -all:3600

Zorg:ns1.mydomain.com.:hostmaster.mydomain.com
&org::ns1.mydomain.com:86400
&org::ns2.mydomain.com:86400
+*.org:1.1.1.1:3600
@*.org::.:0:3600
'*.org:v=spf1 -all:3600


The question I have is, when I do a dig (see below) in the AUTHORITY SECTION
it says com, net or org instead of the fqdn I'm querying, will this cause
problems? Will applications trust the dns lookup if the authority just says
com, net or org?

[***@aquarium root]# dig @127.0.0.1 whatever.com

; <<>> DiG 9.3.4-P1 <<>> @127.0.0.1 whatever.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9855
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;whatever.com. IN A

;; ANSWER SECTION:
whatever.com. 3600 IN A 1.1.1.1

;; AUTHORITY SECTION:
com. 86400 IN NS ns1.mydomain.com.
com. 86400 IN NS ns2.mydomain.com.

;; ADDITIONAL SECTION:
ns1.mydomain.com. 86400 IN A 127.0.0.1
ns2.mydomain.com. 86400 IN A 127.0.0.1

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jun 7 12:51:07 2010
;; MSG SIZE rcvd: 124

-matt

[Joe Baptista]

Mat - I'm not sure if Bernstein DNS does views. In BIND you can make it give
different answers for internal and external DNS queries. But I'm not sure if
that is what your trying to do.

Basically i think you want your computer which uses your DNS resolvers to
provide you with the correct answers but unauthorized DNS requests will get
the wildcard answers. Is that what your trying to do?

regards
joe baptista

Post by Matt Shields
I'm not sure if my message got through the mail list so I'm posting again.
On a previous thread I noticed someone else trying to wildcard all of .com,
.net and .org because people had their domains pointed to his server. I
have the same issue and I was able to get this to work by adding the
following 3 zones.
Zcom:ns1.mydomain.com.:hostmaster.mydomain.com
&com::ns1.mydomain.com:86400
&com::ns2.mydomain.com:86400
+*.com:1.1.1.1:3600
@*.com::.:0:3600
'*.com:v=spf1 -all:3600
Znet:ns1.mydomain.com.:hostmaster.mydomain.com
&net::ns1.mydomain.com:86400
&net::ns2.mydomain.com:86400
+*.net:1.1.1.1:3600
@*.net::.:0:3600
'*.net:v=spf1 -all:3600
Zorg:ns1.mydomain.com.:hostmaster.mydomain.com
&org::ns1.mydomain.com:86400
&org::ns2.mydomain.com:86400
+*.org:1.1.1.1:3600
@*.org::.:0:3600
'*.org:v=spf1 -all:3600
The question I have is, when I do a dig (see below) in the AUTHORITY
SECTION it says com, net or org instead of the fqdn I'm querying, will this
cause problems? Will applications trust the dns lookup if the authority
just says com, net or org?
; (1 server found)
;; global options: printcmd
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9855
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;whatever.com. IN A
whatever.com. 3600 IN A 1.1.1.1
com. 86400 IN NS ns1.mydomain.com.
com. 86400 IN NS ns2.mydomain.com.
ns1.mydomain.com. 86400 IN A 127.0.0.1
ns2.mydomain.com. 86400 IN A 127.0.0.1
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jun 7 12:51:07 2010
;; MSG SIZE rcvd: 124
-matt

[Alejandro Mery]

Post by Joe Baptista
Mat - I'm not sure if Bernstein DNS does views.

tinydns supports split-horizons since long before bind developers
added "views" to theirs.

Regards,

[Jeremy Kister]

Post by Matt Shields
The question I have is, when I do a dig (see below) in the AUTHORITY SECTION
it says com, net or org instead of the fqdn I'm querying, will this cause
problems? Will applications trust the dns lookup if the authority just says
com, net or org?

[...]

Post by Matt Shields
com. 86400 IN NS ns1.mydomain.com.
com. 86400 IN NS ns2.mydomain.com.

nope, it'll be discarded as out-of-bailiwick poison. and all will be good.

the only problem with that approach is that you can't differentiate
between tinydns answering configured domains vs. non-configured domains
in your log file. otherwise, it's good to go.