Support for Authoritative Domains, NXDOMAIN Responses, NS and SOA Records
Starting with release 17.1.6, if back-end DNS servers are configured for an Avi DNS virtual service, the VS will not pass them client queries containing FQDNs that are subdomains of the domains for which the DNS VS is authoritative.
Starting with release 17.2.4, an Avi Vantage DNS virtual service includes a Start of Authority (SOA) record with its NXDOMAIN (and other) replies.
NOTE: Responses to SOA queries are not supported.
Related Reading
Features
An NXDOMAIN (“the domain does Not eXist”) response is accompanied by an SOA record if the incoming query’s domain is a subdomain of one of the configured authoritative domains in the DNS application profile.
Negative caching, i.e., the caching of the fact of non-existence of a record, is determined by name servers authoritative for a zone which must include the Start of Authority (SOA) record when reporting no data of the requested type exists. The value of the minimum field of the SOA record and the TTL of the SOA itself is used to establish the TTL for the negative answer.
If the query’s FQDN matches an entry in the DNS table but the query type is not supported, by default the Avi SE generates a NOERROR response, optionally with an SOA record if the domain matches a configured authoritative domain.
Configuration Using the Avi UI
Refer to figure 1.
Queries for FQDNs that are subdomains of the authoritative domain names and do not have any DNS record in Avi are dropped or the NXDOMAIN response is sent. The Avi System-DNS profile comes preconfigured to respond to unhandled DNS requests. However, when creating a DNS profile afresh, the default value of the (Options for) Invalid DNS Query processing field is set to drop unhandled requests. Change it to respond to ensure NXDOMAIN responses get sent when appropriate.
When an NXDOMAIN reply is appropriate for an FQDN that ends with one of the authoritative domains, the value appearing in the Negative TTL field will be incorporated into the attached SOA record. Note the 30-second default; the allowed range is 1 to 86400 seconds.
An Avi DNS VS need not have a back-end DNS server pool. If it does have a back-end pool, the Avi DNS’ Service Engines will only load balance to it if the FQDN is not a subdomain of one of those configured in the Authoritative Domain Names field. All are configured with Ends-With semantics.
Values in the Valid subdomains field are for validity checking and thus optional. If not configured, all subdomains of acme.com will be processed and looked up in the DNS table.
Figure 1. Setting DNS options with the Avi Vantage application profile editor
Configuration Using the Avi CLI
In the below example, we see the before and after configurations of the System-DNS application profile. Various applicationprofile:dns_service_profile subcommands are used to:
- Define the authoritative domain names. In this example, they are
acme.comandcoyote.com. - Enable NXDOMAIN responses. To do this, the value of
error_responseis changed fromDNS_ERROR_RESPONSE_NONE(the default) toDNS_ERROR_RESPONSE_ERROR. Thenegative_caching_ttlis left unchanged from its 30-second default. - Specify subdomains of
acme.comfor which the DNS can provide an IP address. The subdomains aresales.acme.com,docs.acme.com, andsupport.acme.com. These subdomains are for validity checking and thus optional. If not configured, all subdomains ofacme.comandcoyote.comwill be processed and looked up in the DNS table.
configure applicationprofile System-DNS
Updating an existing object. Currently, the object is:
+-------------------------+---------------------------------------------------------+
| Field | Value |
+-------------------------+---------------------------------------------------------+
| uuid | applicationprofile-fdb6a5d6-bbf8-4f15-b851-f436b599992c |
| name | System-DNS |
| type | APPLICATION_PROFILE_TYPE_DNS |
| dns_service_profile | |
| num_dns_ip | 1 |
| ttl | 30 sec |
| error_response | DNS_ERROR_RESPONSE_NONE |
| edns | False |
| dns_over_tcp_enabled | True |
| aaaa_empty_response | True |
| negative_caching_ttl | 30 sec |
| ecs_stripping_enabled | True |
| preserve_client_ip | False |
| tenant_ref | admin |
+-------------------------+---------------------------------------------------------+
dns_service_profile
authoritative_domain_names acme.com
authoritative_domain_names coyote.com
error_response dns_error_response_error
Overwriting the previously entered value for error_response
domain_names sales.acme.com
domain_names docs.acme.com
domain_names support.acme.com
save
save
+---------------------------------+---------------------------------------------------------+
| Field | Value |
+---------------------------------+---------------------------------------------------------+
| uuid | applicationprofile-fdb6a5d6-bbf8-4f15-b851-f436b599992c |
| name | System-DNS |
| type | APPLICATION_PROFILE_TYPE_DNS |
| dns_service_profile | |
| num_dns_ip | 1 |
| ttl | 30 sec |
| error_response | DNS_ERROR_RESPONSE_ERROR |
| domain_names[1] | sales.acme.com |
| domain_names[2] | docs.acme.com |
| domain_names[3] | support.acme.com |
| edns | False |
| dns_over_tcp_enabled | True |
| aaaa_empty_response | True |
| authoritative_domain_names[1] | acme.com |
| authoritative_domain_names[2] | coyote.com |
| negative_caching_ttl | 30 sec |
| ecs_stripping_enabled | True |
| preserve_client_ip | False |
| tenant_ref | admin |
+---------------------------------+---------------------------------------------------------+