Debian – Cannot resolve domain from within LAN

debiandomain-name-systemdyndnsmac-osx

I just set up a Debian server in our office. We have a business account with comcast without static IP, so I'm using DynDNS to point a domain at the machine. The problem is that I can't resolve the domain from within the network.

It is my understanding that there is no way around this using the comcast business gateway, so I would need to set up some sort of local DNS (if anyone knows otherwise that would be great).

I have a basic understanding of DNS, and I'm assuming that I need a setup that will resolve the domain to the local IP when a user is on the office network and use the global DNS record otherwise. Am I on the right track? If so, what is the best way to achieve this?

All the clients are running OSX.

Best Answer

Set up a DNS server for LAN access only and hand it's address out via DHCP. That DNS server acts as an authoritative server for your domain but issues LAN address rather than the public address.

Related Solutions

DNS Best Practices – Top Level Domain/Domain Suffix for Private Network

Since the previous answers to this question were written, there have been a couple of RFCs that alter the guidance somewhat. RFC 6761 discusses special-use domain names without providing specific guidance for private networks. RFC 6762 still recommends not using unregistered TLDs, but also acknowledges that there are cases where it will be done anyway. Since the commonly used .local conflicts with Multicast DNS (the main topic of the RFC), Appendix G. Private DNS Namespaces recommends the following TLDs:

intranet
internal
private
corp
home
lan

IANA appears to recognize both RFCs but does not (currently) incorporate the names listed in Appendix G.

In other words: you shouldn't do it. But when you decide to do it anyway, use one of the above names.

DNS Records – How to List All DNS Records in a Domain Using Dig

Answer

The short answer to your specific question of listing CNAMEs is that you cannot without permission to do zone transfers (see How to list all CNAME records for a given domain?).

That said, if your company's DNS server still supports the ANY query, you can use dig to list the other records by doing:

dig +noall +answer +multiline yourdomain.yourtld any

These ... +noall +answer +multiline ... are strictly optional and are simply output formatting flags to make the output more easily human readable (see dig man page ).

Example

$ dig +noall +answer +multiline bad.horse any

Returns:

bad.horse.              7200 IN A 162.252.205.157
bad.horse.              7200 IN CAA 0 issue "letsencrypt.org"
bad.horse.              7200 IN CAA 0 iodef "mailto:abuse@sandwich.net"
bad.horse.              7200 IN MX 10 mx.sandwich.net.
bad.horse.              7200 IN NS a.sn1.us.
bad.horse.              7200 IN NS b.sn1.us.
bad.horse.              7200 IN SOA a.sn1.us. n.sn1.us. (
                                2017032202 ; serial
                                1200       ; refresh (20 minutes)
                                180        ; retry (3 minutes)
                                1209600    ; expire (2 weeks)
                                60         ; minimum (1 minute)
                                )

Caveats (RFC8482)

Note that, since around 2019, most public DNS servers have stopped answering most DNS ANY queries usefully. For background on that, see: https://blog.cloudflare.com/rfc8482-saying-goodbye-to-any/

If ANY queries do not enumerate multiple records, the only option is to request each record type (e.g. A, CNAME, or MX) individually.