2

Background

I had a problem loading images from a particular website. ( more details of that here)

Someone at work Suggested I change my DNS servers to openDNS and see if that resolves the problem.

As they thought it may be that the DNS server from my provider is what was slowing down the page/image loads due to the cross domain calls with its javascript.

It turns out that this was indeed the case. The images loaded as expect with the new DNS servers ( google 8.8.8.8 and 8.8.4.4) Changing back the Problem reoccurs.

But I do not really want to change my DNS servers. Especially for just one site.


Question

Is there any way I can use my normal DNS server addresses. But have a proxy (PAC file) that redirects to an alternate DNS server when this web domain (cultofma.com) is used.

1 Answer 1

3

You can specify the DNS servers that will be used for specific domains, but AFAIK this requires you to run BIND (named) on your machine. In this situation, your computer would be running a named process, and will have its configuration file setup to forward DNS requests for most queries to your ISP (i.e., the DNS servers that you were using before Google's Open DNS). This also allows you to specify domains in which you'd like the 'alternative' DNS server to be queried. Once you've got named up and running, you could then configure System Preferences to use your loopback address (127.0.0.1) for DNS lookups. The /etc/named.conf file for this configuration (based on Apple's default named.conf) would look something like:

//
// Include keys file
//
include "/etc/rndc.key";

// Declares control channels to be used by the rndc utility.
//
// It is recommended that 127.0.0.1 be the only address used.
// This also allows non-privileged users on the local host to manage
// your name server.

//
// Default controls
//
controls {
    inet 127.0.0.1 port 953 allow {any;}
    keys { "rndc-key"; };
};

options {
    directory "/var/named";
    /*
     * If there is a firewall between you and nameservers you want
     * to talk to, you might need to uncomment the query-source
     * directive below.  Previous versions of BIND always asked
     * questions using port 53, but BIND 8.1 uses an unprivileged
     * port by default.
     */
    // query-source address * port 53;

    // *** forward all DNS lookups to these servers
    forwarders { 8.8.8.8; 8.8.4.4; };
};
// 
// a caching only nameserver config
// 

zone "." IN {
    type hint;
    file "named.ca";
};

zone "localhost" IN {
    type master;
    file "localhost.zone";
    allow-update { none; };
};

zone "0.0.127.in-addr.arpa" IN {
    type master;
    file "named.local";
    allow-update { none; };
};

// *** requests for records in this zone will be forwarded to 10.0.0.5
zone "test.example.com" IN {
    type forward;
    forwarders { 10.0.0.5; 10.0.0.6; };
    forward only;
};

logging {
        category default {
                _default_log;
        };

        channel _default_log  {
                file "/Library/Logs/named.log";
                severity info;
                print-time yes;
        };
};

Configuring named

Before starting named, it may be necessary to generate the rndc key that's being used for rndc control:

sudo rndc-confgen -a

Note: the only portion of the default /etc/named.conf file that was modified above is the line in "options" that specifies the forwarder DNS servers (the ones that will answer most of your queries), as well as a zone entry for the "special" zone that you'd like to perform split horizon lookups for.

In this example, all queries are forwarded to the DNS servers 8.8.8.8 and 8.8.4.4 (Google Open DNS) with the exception of queries for records in the "test.example.com" domain (which are forwarded to 10.0.0.5 and 10.0.0.6).

Forwarder options

// *** forward all DNS lookups to these servers
forwarders { 8.8.8.8; 8.8.4.4; };

Zone to forward

// *** requests for records in this zone will be forwarded to 10.0.0.5 and 10.0.0.6
zone "test.example.com" IN {
    type forward;
    forwarders { 10.0.0.5; 10.0.0.6; };
    forward only;
};

Test your local named configuration

Next, you can test your named installation by running it in the foreground (before committing to the setup):

sudo /usr/sbin/named -g

In another Terminal window, query your local DNS server to confirm that it is working:

nslookup  apple.com 127.0.0.1

Make sure that your "special" forwarding zone is being utilized:

nslookup test.example.com 127.0.0.1

Setup named process to start at boot

Once you see that the lookups are working as expected, you can kill the named process that's running in the foreground of the first Terminal window by issuing an interrupt using the "Control"+"C" key command (^C).

It's possible to start the DNS server every time the machine boots by enabling the launch daemon job for that process:

sudo launchctl load -w /System/Library/LaunchDaemons/org.isc.named.plist

Lastly, you'd configure that the local machine's loopback address be used as the DNS server in System Preferences -> Network.

How to remove configuration and setup

This setup could potentially cause network problems (if not configured correctly). Here are some instructions on how to undo this setup:

1.) Remove the DNS server (127.0.0.1) from the network interface that you configured in System Preferences.

2.) Disable the launchd job that causes named to start on boot:

sudo launchctl unload /System/Library/LaunchDaemons/org.isc.named.plist
4
  • Hi, Thanks for the idea. I suspect this may be a bit over my head. I can see i simply need to add the options and the zone to my config. The loopback part I assume you men enter the 127.. as my dns server in the Network->advanced->DNS. I assume the 10.0.0.5 is for my ISP fns. Or should not the zone part have the google DNS?. Also do I need to restart something for this to kick in. Cheers
    – markhunte
    Commented Oct 15, 2013 at 17:55
  • I've added additional instruction and detail to the answer. This example may be a bit confusing because I'm using Google Open DNS as the "ISP" servers, and 10.0.0.x as the "special domain" forwarding servers. In your situation, you'd replace the "special" DNS server addresses (10.0.0.5 and 10.0.0.6) with 8.8.8.8 and 8.8.4.4. Your ISP's DNS servers would replace the 8.8.8.8 and 8.8.4.4 values that are specified as the forwarders in the 'options' section of the configuration above. Commented Oct 15, 2013 at 19:24
  • Thanks. I will give it a go and let you know how I get on.
    – markhunte
    Commented Oct 16, 2013 at 16:38
  • Hi, I did not get to test this as everything started working again. It looks like the ad servers have been changes and I no longer get the errors. My ISP seemed to be returning ok now. If there is any change I will report back. But I think your answer deserves to be accepted any way. This is good info to have. Yhanks for your help.
    – markhunte
    Commented Nov 11, 2013 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .