Take the 2-minute tour ×

Preface I use a top level domain provider that only allows me to add "normal" third-party name servers (a list where i can add "ns1.hostingcompany.com" type entries... nothing else) AND "child name servers" which i can later attach to my parent account ( ns1.myowndomain.com and an ip address). They do not provide other means of linking up.

I want to host my own server and dns, even with just one name server (at first).

My setup:

Airport Extreme - get's a static ip address from my ISP

Mac Mini Server - sits behind the Airport and get's a

My problem is that i can't seem to configure DNS correctly. I added a "child nameserver" with my airport's external static ip address at the top level provider, so to my understanding i should have all DNS traffic redirected to my Airport. I've opened port 53 UDP to let the traffic in.

Now, what i don't get is this. My Mini Server is sitting on a address and i have setup dns correctly, with an A record to point and resolve my server AND a reverse lookup to that So it's ok for "internal stuff".

Here is the clicker... How, when a request comes from the exterior for a reverse lookup, does the server "know" ... well look i have everything in but the guy outside needs something from my real address.

I can't begin to describe the MX record bonanza...

How do i set this "right"? Do i "need" my Mini Server to sit on the external address directly (i can see how this could be the preferred solution, being close to a "real" server i have in my mind). If not... do i need a PTR record on the server but with the external address in there?

My dream: I will extend this "setup" with multiple Mini's in different cities where i work. I want a distributed something (Xgrid comes to mind).

PS. Be gentle, i've read 2 books and the subject, and bought both the Lynda Essentials and DNS and Networking to boot, still i'm far from being on top of things.

share|improve this question
Your question was slightly confusing; please check my answer to see if I got everything. –  Jacob Feb 12 '11 at 23:17
I think what you're asking is to have your DNS server return different things when people inside your network ask it for addresses, than when people outside your network ask it for addresses? If so, what you want is called "split horizon" DNS –  DerfK Feb 12 '11 at 23:52
Yes. But a new question arises. Can i run a spit horizon dns INSIDE my internal network... or does it have to sit in the router's place? –  unmircea Feb 13 '11 at 8:34
add comment

2 Answers

up vote 3 down vote accepted

In this situation you really want to have something like a split-horizon DNS setup, where the answers DNS clients get depend on what network (internal or external) they're on. This can be done with OS X server using the BIND nameserver's views feature -- but Apple's configuration UI only supports one view, and it's going to be a pain to set up and maintain. It's much easier to simply use two separate DNS servers, one for inside and one for outside. I'd recommend using a DNS hosting provider for the external DNS (your top level domain provider can almost certainly do this for you), and having the OS X server provide internal DNS only.

EDIT: to get PTR records properly set up, you actually wind up with a third DNS provider: your ISP. Because of the way reverse lookups are delegated, whoever "owns" your public IP is in charge of providing reverse lookup service for it. You can use NS queries to check this: for example, if your public IP is, use the command "host -t NS 56.34.12.in-addr.arpa" to see what DNS server(s) serve PTR records for the block of addresses you're in. If that isn't found it's not delegated that finely, so try "host -t NS 34.12.in-addr.arpa" and even "host -t NS 12.in-addr.arpa" until you get a result.

Here's a breakdown of how I'd set it up, assuming you want your server's primary name to be server.myowndomain.com, the Airport's public IP address is, and that you'll be hosting your own website and email:

In the public forward DNS zone (myowndomain.com, served by your registrar or whatever):

myowndomain.com.         A
server.myowndomain.com.  A
www.myowndomain.com.     CNAME server.myowndomain.com.
myowndomain.com.         MX 10 server.myowndomain.com.
(plus appropriate NS records, etc)

In the public reverse zone (probably 56.34.12.in-addr.arpa, served by your ISP):  PTR server.myowndomain.com.

In your private DNS on the Mini server (note the trailing periods all over; this is very important, to keep it from tacking another ".myowndomain.com" onto the end):

  myowndomain.com. zone:

myowndomain.com.         A
server.myowndomain.com.  A
www.myowndomain.com.     CNAME server.myowndomain.com.
myowndomain.com.         MX 10 server.myowndomain.com.

myowndomain.com. NS server.myowndomain.com.

  1.0.10.in-addr.arpa zone (this will be built mostly automatically, just make sure the PTR record is pointing to server.myowndomain.com, not just myowndomain.com):  PTR server.myowndomain.com.

You also need to make sure that DNS queries from your private network are directed to your Mini server, rather than out to the public DNS. If possible, change the DHCP settings to hand out as the DNS server to use; if you can't do this (some models of Airport are annoyingly inflexible), configure the Airport itself to use as its DNS server. You shouldn't need to forward port 53, as you should never get DNS lookups from outside.

Then, when you set up a second office w/server in another city, assuming it has hostname 2ndoffice.myowndomain.com, public IP and private IP, you'd add (note: please make sure the private IP ranges at the offices do not overlap, or interoffice VPNs will be nearly impossible. In fact, if possible I'd change the IP range you're using now, as that's a very popular range, and someday you'll want to VPN in from a client/hotel/Starbucks/whatever that uses that range…):

Add to public forward DNS:

2ndoffice.myowndomain.com.  A

In the new public reverse zone (probably 93.92.91.in-addr.arpa, served by the ISP in your new office):  PTR 2ndoffice.myowndomain.com.

Add to your first-office private DNS, myowndomain.com zone:

2ndoffice.myowndomain.com.  A

And in the new office's private DNS:

  myowndomain.com. zone:

myowndomain.com.            A
server.myowndomain.com.     A
2ndoffice.myowndomain.com.  A
www.myowndomain.com.        CNAME server.myowndomain.com.
myowndomain.com.            MX 10 server.myowndomain.com.

myowndomain.com. NS server.myowndomain.com.

  2.0.10.in-addr.arpa zone:  PTR 2ndoffice.myowndomain.com.

If you set up a network-to-network VPN between offices, switch both servers' private DNSes to serve each other's private rather than public IPs.

share|improve this answer
"Apple's configuration UI only supports one view" you are right in this aspect of the situation. The top level has a policy to not provide this "feature". My best guess is to use a hosting company's dns and add A records pointing to my "external IP", open ports for what I need and route to the internal server. I might have problems with mail since i don't check out when other do a PTR on me?! –  unmircea Feb 13 '11 at 8:31
wow... this is by far the most complete answer... it's exactly what i need. Thanks! –  unmircea Feb 14 '11 at 8:19
add comment

Is the air port a DNS server? if so than forward port 53 TCP AND UDP or do you want your Mini to be the DNS server? As far as the local vs public thing, it will hand out anything it has and the client will close some programs might have logic to detect the local IP and throw it out but I highly doubt it. I'd suggest using .local for your internal stuff and .com for your external stuff. Or if you realy want to use .com edit your hosts file. Unless you have a mail server you don't need a PTR but you can't just use your external address as your ISP is the authoritative server. You may be able to get them to delegate to you but if not they will most of the time host the PTR for you. If you want your primary mail server to be your mini then set a MX of myowndomain.com with a priority of 1.

share|improve this answer
The Airport Extreme does not offer a DNS server in the firmware. You're right, the ISP does provide ptr with an authorative DNS for an entire range of IP's not just mine. –  unmircea Feb 13 '11 at 8:20
So i can't run a split horizon DNS on my "router" where it should naturally be. And, in my understanding of the situation, it is pointless to run an "external horizon" DNS on my internal ip and route DNS traffic to it, or is it? –  unmircea Feb 13 '11 at 8:26
Split Horizon isn't supported in MAC OS so I would setup 2 forward zones mydomain.com with your Public IP and mydomain.local for internal clients this is how most people do it. In reality your local domain could be mydomain.jeff(or anything else other than existing TLDs) if you wanted. –  Jacob Feb 13 '11 at 14:10
add comment

Your Answer


