<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Simon,<br><br>The records that I am looking up are all A records, no CNAMEs in use here, I've confirmed this by performing a dig against the Bind server for queries that were missing the cache with recursion disabled. Additionally if I perform a tcpdump I can see the requests listing as "A?" and "AAAA?", while on the named logs show "A +" and "AAAA +" in the query logs.<br><br>Technically the Bind server does have recursion enabled, however it is only allowed from a single IP address, that is the IP address of a Squid proxy server.<br><br>This allows clients in the network to browse the Internet via the Squid proxy, as the Squid proxy server will still be able to perform recursive DNS queries for random domains on the Internet. The point of this configuration is to prevent all other client systems in the network from otherwise resolving external DNS, which has been done as a security measure.<br><br>On the Bind server as soon as I put in the "allow-recursion { Squid-IP; };" value, the query log on this Bind server gets absolutely smashed due to the amount of DNS queries coming in that are no longer being cached. These queries are all for A records of other internal systems on the local network, so prime candidates for caching.<br><br> As soon as I comment this out and restart the named service (thereby allowing recursion from any host), the DNS query logs drop off completely, as does the tcpdump port 53 traffic, and I can see the cache hits of dnsmasq rising quickly.<br><br>Thanks.<br><br><div>> To: dnsmasq-discuss@lists.thekelleys.org.uk<br>> From: simon@thekelleys.org.uk<br>> Date: Sat, 23 Jan 2016 09:24:08 +0000<br>> Subject: Re: [Dnsmasq-discuss] No caching unless recursion enabled?<br>> <br>> -----BEGIN PGP SIGNED MESSAGE-----<br>> Hash: SHA256<br>> <br>> <br>> <br>> On 21/01/16 23:16, bob tatus wrote:<br>> > <br>> > Hi there,<br>> > <br>> > I've been using Dnsmasq for a few days now with no problems, it<br>> > was caching well and helping a lot.<br>> > <br>> > Yesterday I disabled recursive DNS queries on my DNS server (Bind<br>> > 9) as this is not required within the environment, since doing this<br>> > it appears that the caching is no longer working correctly.<br>> > <br>> > To test I enabled recursion once more and the cache hit rate<br>> > started climbing again and I saw significantly less queries being<br>> > logged on the bind server, confirming that this was the issue.<br>> > <br>> > I've checked the man page but have not found anything about this?<br>> > I need to have recursive DNS queries disabled on the DNS server<br>> > and still have the clients that use this DNS server cache the<br>> > queries received with Dnsmasq.<br>> > <br>> > The DNS server in question is authoritative for the queries that I <br>> > want to cache so there should not be any need for recursive DNS.<br>> > <br>> > Thanks, Robert.<br>> <br>> I just looked in the current code, and there's nothing obvious that<br>> would account for this effect.<br>> <br>> I would note that not having recursion available on _any_ server used<br>> by dnsmasq as an upstream is unwise. It may work but it will be<br>> fragile. The most obvious case is if you add a CNAME to the<br>> authoritative zone which points outside it. Dnsmasq will not look up<br>> the target of the CNAME, it relies on the upstream server to do that,<br>> and if the upstream server doesn't (because recursion is disabled)<br>> then you'll get a valid but wrong answer.<br>> <br>> Cheers,<br>> <br>> Simon.<br>> <br>> > <br>> > <br>> > <br>> > _______________________________________________ Dnsmasq-discuss <br>> > mailing list Dnsmasq-discuss@lists.thekelleys.org.uk <br>> > http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss<br>> > <br>> -----BEGIN PGP SIGNATURE-----<br>> Version: GnuPG v2.0.22 (GNU/Linux)<br>> <br>> iQIcBAEBCAAGBQJWo0a4AAoJEBXN2mrhkTWifXUP/i11BrFvf/XSj3oPYfsrbEES<br>> ZQ4TgyaZN0SWOZjUkFNkXMIMvcBBJsnEpKI2num2wb7ZDSnUAvBAVRpiLmqFwNWz<br>> HhEEIKE1PGfIO8BJXgbt8kHlRW4dfHJybGoUAI8xiJxmrv607OU/6LdD9kpW+FGN<br>> npgvH8RCCJDmr0KkjnCqoIWaB22mMUYlwX5QGktUZsxrvhA1KZ1lmA34/JSTH8Ey<br>> +93fKjIN7vzOXJzr52YBoprQLNK1ngRf7uABF1DSaxpxMWdS4oPjGiW6AXRDy9Gg<br>> IHae1hxH6rAbQ2J9dGYz2zPLY9An/+4VClki3YFUB/waAMPU6njFFpVR6ExRo04s<br>> vu79zn6/SvQlP32Xg1LYT94JFpk+xNkycr4ETP3VNrl6Os36rj6Yw8QbILcm4EzX<br>> OCb28tOD6lRBKvXaM8Qrs8xF++Jlea7e39AueMUORX7OCC27L5VLn5B83noMWJBb<br>> b1c8NxCy0BfB2d1DE6LH+JAx7XjRKiWiQpxGTonYDIyZeIvvQhZyDatq3fsSOgct<br>> t1tWL7NT/rhWL/5G2mDM1WofhSkH/XTb1FUlanyJf3p1qiiFcvMxlqpiT4WYLy5P<br>> p5lhbnIxLF6w6zL9o0PfeXmt4Lm/RWbQMnyPm00e577bzTbWpPg9qgTdH92iRnMR<br>> obOjWAwKOKVRNnApyGHo<br>> =viMc<br>> -----END PGP SIGNATURE-----<br>> <br>> _______________________________________________<br>> Dnsmasq-discuss mailing list<br>> Dnsmasq-discuss@lists.thekelleys.org.uk<br>> http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss<br></div> </div></body>
</html>