The ns1 instances in mirror_root_zone and rfc5011 talk to the root
servers on the live internet: the options-level port must remain 53
for outgoing queries to reach the real servers, and the *-source
addresses must remain unset so that a routable source address is
picked. Exempt these two configs from the standard plumbing and
spell out the intent in a comment.
Assisted-by: Claude:claude-fable-5
{% include "_common/controls.conf.j2" %}
options {
- query-source address 10.53.0.1;
- notify-source 10.53.0.1;
- transfer-source 10.53.0.1;
+ # This instance transfers the root zone from the live internet.
+ # The options-level port and the *-source addresses must stay at
+ # their defaults so that outgoing traffic uses port 53 and a
+ # routable source address.
+ port 53;
pid-file "named.pid";
- listen-on port @PORT@ {10.53.0.1;};
+ listen-on port @PORT@ { @ns.ip@; };
+ listen-on-v6 { none; };
};
zone "." { type mirror; };
*/
options {
- query-source address 10.53.0.1;
- notify-source 10.53.0.1;
- transfer-source 10.53.0.1;
+ # This instance queries the root servers on the live internet.
+ # The options-level port and the *-source addresses must stay at
+ # their defaults so that outgoing traffic uses port 53 and a
+ # routable source address.
+ port 53;
pid-file "named.pid";
- listen-on port @PORT@ { 10.53.0.1; };
- recursion yes;
+ listen-on port @PORT@ { @ns.ip@; };
+ listen-on-v6 { none; };
};
{% include "_common/controls.conf.j2" %}
-