default local DNS caching name server

[Paul Wouters]

On Sat, 12 Apr 2014, William Brown wrote:

> I should clarify. I cache the record foo.work.com from the office, and
> it resolves differently externally. When I go home, it no longer
> resolves to the external IP as I'm using the internally acquired record
> from cache.

This currently works for the VPN scenario. When you connect the VPN,
and the VPN gives you a domain/nameservers, unbound is reconfigured on
the fly with those nameservers as forwards. A cache flush is done on
connecting/disconnecting from the VPN for the specified domain. Part of
the new proposal for dealing with your scenario consists of two parts.

- LAN and secured WIFI that return a search domain and nameserver IPs
   will be installed as forwaders in unbound. The current content and
   request_list will be flushed using unbound-control.
- open WIFI will do the same only after the user has told NM this
   network is to be "trusted". The current content and
   request_list will be flushed using unbound-control.

That should deal with flushing internal-only records when not internal
and flushing external records when not external.

If the internal domain is using DNSSEC, further configuration of a trust
anchor override might be needed. This can be done in /etc/unbound/*.d/
directories (commented out examples are present). Possible, this
directory structure can be replaced by integrated NM support that
reconfigured unbound (or dnsmasq) based on the same information.

Paul