Split DNS (Zimbra) - Revision history

Sstrutt: /* DNS Records */ Updated

2022-06-05T11:51:49Z

DNS Records: Updated

← Older revision		Revision as of 11:51, 5 June 2022
Line 8:		Line 8:

	== DNS Records ==		== DNS Records ==
	Firstly, you need to own a public domain name, then ~~get your ISP to~~ create two DNS records...		Firstly, you need to own a public DNS domain name, then create two DNS records...
	# '''MX record''' - Mail Exchanger (MX) record		# '''MX record''' - Mail Exchanger (MX) record
	#* EG <code> sandfordit.com [MX] -> mail.sandfordit.com </code>		#* EG <code> sandfordit.com [MX] -> mail.sandfordit.com </code>
	#* <code> sandfordit.com </code> is the domain you own, and <code> mail.sandfordit.com </code> is hostname of your email server (can be anything you like). Email addressed to <code><anything>@sandfordit.com</code> will be directed to the server in this record.		#* where <code> sandfordit.com </code> is the domain you own, and <code> mail.sandfordit.com </code> is hostname of your email server (the can be anything you like). Email addressed to <code><anything>@sandfordit.com</code> will be directed to the server in this record.
	#* You'll need to give the record a weighting (this allows you to have multiple email servers for the same domain). The lower the number the higher the server's priority, assuming you only have one email server, its common to use <code>10</code>		#* You'll need to give the record a weighting (this allows you to have multiple email servers for the same domain). The lower the number the higher the server's priority, assuming you only have one email server, its common to use <code>10</code>
	# '''A record''' - Standard DNS record		# '''A record''' - Standard DNS record
	#* EG <code> mail.sandfordit.com [A] -> 158.25.34.124 </code>		#* EG <code> mail.sandfordit.com [A] -> 158.25.34.124 </code>
	#* <code> 158.25.34.124 </code> is the static IP address assigned by your ~~ISP~~. You'll need to set-up a NAT on your router (often ~~oddly~~ called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).		#* <code> 158.25.34.124 </code> is the static IP address assigned to your email server. You'll need to set-up a NAT on your router (often called a virtual server in domestic firewalls/routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).

	Note, instead of an A record, ~~some people will use~~ a CNAME record instead (though ~~obviously~~ the CNAME record will still need to point to a valid A record.) Using a CNAME ~~might~~ be preferable, ~~if for example~~ you~~'ve multiple services running from a single public IP~~, ~~that you might want to split out~~ in the future to ~~run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and it may not work~~, ~~so if you're experiencing issues when using~~ a ~~CNAME consider changing to an~~ A record.		Note, instead of an A record, a CNAME record can be used instead (though the CNAME record will still need to point to a valid A record). Using a CNAME can be preferable, where you might, in the future, want to send inbound email traffic to another email server, addressed by a different A record.

	== Localhost DNS Server Setup ==		== Localhost DNS Server Setup ==

Sstrutt: /* DNS Records */ Slight rewording of CNAME text

2014-09-07T21:29:11Z

DNS Records: Slight rewording of CNAME text

← Older revision		Revision as of 21:29, 7 September 2014
Line 17:		Line 17:
	#* <code> 158.25.34.124 </code> is the static IP address assigned by your ISP. You'll need to set-up a NAT on your router (often oddly called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).		#* <code> 158.25.34.124 </code> is the static IP address assigned by your ISP. You'll need to set-up a NAT on your router (often oddly called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).

	Note, instead of an A record, some people will use a CNAME record instead (though obviously the CNAME record will still need to point to a valid A record.) Using a CNAME might be preferable, if for example you've multiple services running from a single public IP, that you might want to split out in the future to run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and it may not work~~. Therefore~~ you're ~~probably best not~~ to.		Note, instead of an A record, some people will use a CNAME record instead (though obviously the CNAME record will still need to point to a valid A record.) Using a CNAME might be preferable, if for example you've multiple services running from a single public IP, that you might want to split out in the future to run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and it may not work, so if you're experiencing issues when using a CNAME consider changing to an A record.

	== Localhost DNS Server Setup ==		== Localhost DNS Server Setup ==

Sstrutt: Minor tweaking

2013-02-22T20:30:31Z

Minor tweaking

← Older revision		Revision as of 20:30, 22 February 2013
Line 1:		Line 1:
	[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for Zimbra where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network.		[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for [[:Category:Zimbra\|Zimbra]] where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network<ref name="PrivAddr" />.

	Zimbra needs to be able to resolve its own Mail Exchanger (MX) DNS record, otherwise its services will not start. Therefore if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is NAT'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below that enable you to achieve this...		Zimbra needs to be able to resolve its own Mail Exchanger (MX) [[Acronyms#D\|DNS]] record, otherwise its services will not start. Therefore if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is [[Acronyms#N\|NAT]]'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below that enable you to achieve this...
	# [[#Localhost DNS Server Setup\|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.		# [[#Localhost DNS Server Setup\|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.
	# [[#Local Network DNS Server Setup\|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.		# [[#Local Network DNS Server Setup\|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.

	Note that Split DNS, Split-Horizon DNS, Split-Brain DNS all refer to the same technique, and the terminology can be used interchangeably.		'''Note that Split DNS, Split-Horizon DNS, Split-Brain DNS all refer to the same technique''', and the terminology can be used interchangeably.

	== DNS Records ==		== DNS Records ==
Line 17:		Line 17:
	#* <code> 158.25.34.124 </code> is the static IP address assigned by your ISP. You'll need to set-up a NAT on your router (often oddly called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).		#* <code> 158.25.34.124 </code> is the static IP address assigned by your ISP. You'll need to set-up a NAT on your router (often oddly called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).

	Note, instead of an A record, some people will use a CNAME record instead (though obviously the CNAME record will still need to point to a valid A record.) Using a CNAME might be preferable, if for example you've multiple services running from a single public IP, that you might want to split out in the future to run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and may not work. Therefore you're probably best not to.		Note, instead of an A record, some people will use a CNAME record instead (though obviously the CNAME record will still need to point to a valid A record.) Using a CNAME might be preferable, if for example you've multiple services running from a single public IP, that you might want to split out in the future to run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and it may not work. Therefore you're probably best not to.

	== Localhost DNS Server Setup ==		== Localhost DNS Server Setup ==
Line 84:		Line 84:
	#* '''A record''' for your server's hostname and internal IP address		#* '''A record''' for your server's hostname and internal IP address
	#* '''MX record''', pointing to the A record just created		#* '''MX record''', pointing to the A record just created

			== Additional Notes ==
			<references>

			<ref name="PrivAddr">For example, your Zimbra server may have an IP address of 10.0.1.5 or 192.168.3.7, but from the outside world its accessible via a public address such as 159.105.10.35</ref>

			</references>

	[[Category:Zimbra]]		[[Category:Zimbra]]
	[[Category:DNS]]		[[Category:DNS]]

Sstrutt: Minor rewording and Meta updates

2012-06-18T13:50:53Z

Minor rewording and Meta updates

← Older revision		Revision as of 13:50, 18 June 2012
Line 1:		Line 1:
	[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for Zimbra where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network. Zimbra needs to be able to resolve its own Mail Exchanger (MX) DNS record, ~~therefore~~ if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is NAT'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below...		[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for Zimbra where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network.

			Zimbra needs to be able to resolve its own Mail Exchanger (MX) DNS record, otherwise its services will not start. Therefore if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is NAT'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below that enable you to achieve this...
	# [[#Localhost DNS Server Setup\|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.		# [[#Localhost DNS Server Setup\|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.
	# [[#Local Network DNS Server Setup\|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.		# [[#Local Network DNS Server Setup\|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.

Sstrutt: /* Local Network DNS Server Setup */ Minor rewording

2012-06-18T13:47:27Z

Local Network DNS Server Setup: Minor rewording

← Older revision		Revision as of 13:47, 18 June 2012
Line 72:		Line 72:
	== Local Network DNS Server Setup ==		== Local Network DNS Server Setup ==
	This is most appropriate to use if you have an existing internal DNS server, that internal clients are already using. Note that all clients		This is most appropriate to use if you have an existing internal DNS server, that internal clients are already using. Note that all clients
	of the DNS server will use it to resolve '''all''' addresses for the domain that your Zimbra server is on. So if your domain ~~was~~ <code>sandfordit.com</code>, all name resolution for that zone will be handled by it. So if you have a server on the internet (eg <code> www.sandfordit.com </code>, you will need to have a local record for it your DNS. Otherwise local clients will request a DNS resolution with your local DNS, which will simply respond that there is no such host, and local client will ~~then fail~~ to connect.		of the DNS server will use it to resolve '''all''' addresses for the domain that your Zimbra server is on. So if your domain is <code>sandfordit.com</code>, all name resolution for that zone will be handled by it. So if you have a server on the internet (eg <code> www.sandfordit.com </code>, you will need to have a local record for it added to your DNS. Otherwise local clients will request a DNS resolution with your local DNS, which will simply respond that there is no such host, and the local client will be unable to connect.

	So if you have to create a new zone in order to get Split DNS working, you may need to add additional records that replicate existing public DNS records. If you already have a zone in your DNS server (which should already be up to date), or have no other address in that DNS domain, then this shouldn't be a problem.		So if you have to create a new zone in order to get Split DNS working, you may need to add additional records that replicate existing public DNS records. If you already have a zone in your DNS server (which should already be up to date), or have no other device address in that DNS domain, then this shouldn't be a problem.

	If you are in any doubt, installing a local DNS server on your Zimbra server is the safest way to proceed. Any problems you cause should be restricted to that server, and won't impact any other working servers. One of the biggest risks when tinkering with DNS is that records get cached, everywhere, so once you've fixed whatever problem you've caused, you may have to wait days for the fix to have rippled around.		If you are in any doubt, installing a local DNS server on your Zimbra server is the safest way to proceed. Any problems you cause should be restricted to that server, and won't impact any other working servers. One of the biggest risks when tinkering with DNS is that records get cached, everywhere, so once you've fixed whatever problem you've caused, you may have to wait days for the fix to have rippled around.

Sstrutt: Initial creation - content from Zimbra page, plus updates

2012-02-14T11:30:29Z

Initial creation - content from Zimbra page, plus updates

New page

[http://en.wikipedia.org/wiki/Split-horizon_DNS Split DNS] is required for Zimbra where your server is on an internal ([http://www.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces private address range]) network. Zimbra needs to be able to resolve its own Mail Exchanger (MX) DNS record, therefore if your server is known publicly by one IP address, but in fact has a different internal address (and the public IP is NAT'ed to the internal IP) you'll need to use split DNS. This allows your server to be known by one IP address on the internet, and a different address internally, but with the same hostname regardless of where you are. There are two methods described below...
# [[#Localhost DNS Server Setup|Localhost DNS Server Setup]] - DNS server installed locally on the Zimbra server.
# [[#Local Network DNS Server Setup|Local Network DNS Server Setup]] - DNS server on your local network, if you have one available.

Note that Split DNS, Split-Horizon DNS, Split-Brain DNS all refer to the same technique, and the terminology can be used interchangeably.

== DNS Records ==
Firstly, you need to own a public domain name, then get your ISP to create two DNS records...
# '''MX record''' - Mail Exchanger (MX) record
#* EG <code> sandfordit.com [MX] -> mail.sandfordit.com </code>
#* <code> sandfordit.com </code> is the domain you own, and <code> mail.sandfordit.com </code> is hostname of your email server (can be anything you like). Email addressed to <code><anything>@sandfordit.com</code> will be directed to the server in this record.
#* You'll need to give the record a weighting (this allows you to have multiple email servers for the same domain). The lower the number the higher the server's priority, assuming you only have one email server, its common to use <code>10</code>
# '''A record''' - Standard DNS record
#* EG <code> mail.sandfordit.com [A] -> 158.25.34.124 </code>
#* <code> 158.25.34.124 </code> is the static IP address assigned by your ISP. You'll need to set-up a NAT on your router (often oddly called a virtual server in domestic routers) to map incoming mail on TCP 25 to your email server's actual address (EG <code> 158.25.34.124:25 -> 192.168.1.150:25 </code>).

Note, instead of an A record, some people will use a CNAME record instead (though obviously the CNAME record will still need to point to a valid A record.) Using a CNAME might be preferable, if for example you've multiple services running from a single public IP, that you might want to split out in the future to run on separate IP's, at which point you can replace the CNAME records with A records. However, I've seen a number of pages on the internet suggesting you shouldn't do this and may not work. Therefore you're probably best not to.

== Localhost DNS Server Setup ==
In order to get round the fact that your exchange server won't have the same IP (or name even) on the public internet as it will on your internal network, a DNS server is installed on the exchange server to provide MX record resolution. Procedure assumes DNS (Bind) is already installed (use <code>apt-get install bind9</code>.

Terminology...
* '''Private''' = Home or internal network IP address and network name (eg <code>192.168.1.150</code> and <code>mail.home.int</code>)
* '''Public''' = Global internet, ISP assigned IP address and registered domain name (eg <code>158.25.34.124</code> and <code>mail.sandfordit.com</code>)

Firstly, add the IP('s) of the DNS servers you use for resolution on your other machines to your local DNS server's list of forwarders (so that your exchange server forwards DNS resolution requests for unknown names to your normal DNS servers), edit <code>/etc/bind/named.conf.options</code>
<pre>
options {
directory "/var/cache/bind";
query-source address * port 53;

forwarders {
192.168.1.1; 158.25.30.10;
};

auth-nxdomain no; # conform to RFC1035
};
</pre>

Edit <code>/etc/resolv.conf</code> to force the server to use its local DNS server for resolution
nameserver 127.0.0.1

Restart bind using <code> /etc/init.d/bind9 restart </code> and check you can resolve external addresses properly.

Now create the internal zone that will eventually contain the local MX record for your exchange server, append the following to <code> /etc/bind/named.conf.local </code>, using your publicly registered domain name
<pre>
zone "sandfordit.com" {
type master;
file "/etc/bind/db.sandfordit.com";
};
</pre>

Lastly create the database file for you DNS domain <code>/etc/bind/db.sandfordit.com</code>, using your publicly registered domain name and private (internal) IP address for your exchange server...
<pre>
;
; BIND data file for sandfordit.com
;
$TTL 604800
@ IN SOA mail.sandfordit.com. admin.sandfordit.com. (
070725 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS mail
IN MX 10 mail
IN A 192.168.1.150
mail IN A 192.168.1.150
</pre>

== Local Network DNS Server Setup ==
This is most appropriate to use if you have an existing internal DNS server, that internal clients are already using. Note that all clients
of the DNS server will use it to resolve '''all''' addresses for the domain that your Zimbra server is on. So if your domain was <code>sandfordit.com</code>, all name resolution for that zone will be handled by it. So if you have a server on the internet (eg <code> www.sandfordit.com </code>, you will need to have a local record for it your DNS. Otherwise local clients will request a DNS resolution with your local DNS, which will simply respond that there is no such host, and local client will then fail to connect.

So if you have to create a new zone in order to get Split DNS working, you may need to add additional records that replicate existing public DNS records. If you already have a zone in your DNS server (which should already be up to date), or have no other address in that DNS domain, then this shouldn't be a problem.

If you are in any doubt, installing a local DNS server on your Zimbra server is the safest way to proceed. Any problems you cause should be restricted to that server, and won't impact any other working servers. One of the biggest risks when tinkering with DNS is that records get cached, everywhere, so once you've fixed whatever problem you've caused, you may have to wait days for the fix to have rippled around.

# If it doesn't already exist, create a new zone for your domain, eg <code> sandfordit.com </code>
# Within that zone, create an
#* '''A record''' for your server's hostname and internal IP address
#* '''MX record''', pointing to the A record just created

[[Category:Zimbra]]
[[Category:DNS]]