FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What is the DNS Forwarder; what happens to queries GTM is not authoritative for? ​

Short answer

GTM's DNS Service gives authoritative answers only for its own domains; if no DNS Forwarder profile is assigned to the service, queries for other names are not resolved and are seen in the Unauthorized series of the DNS Errors panel on the service dashboard. When a profile defined on the DNS Forwarder Profiles screen is assigned to the service, these queries are forwarded to upstream DNS servers: names that match a Domain Based Forwarding rule go to the servers of that rule, and the others go to the servers in the Forwarding Address list. The service's own domains are still answered by the service itself. If DIRECT is marked on a Frontend IP row, queries coming to that address do not pass through the forwarder, and only the service's domains are answered.

How Does It Work? ​

On a service with a forwarder assigned, for every query coming to the addresses not marked DIRECT, the entry that matches the queried name with the longest suffix is selected:

  1. If the name belongs to one of the service's domains, the answer comes from the service's own records.
  2. If the name matches a Domain Based Forwarding rule (e.g. corp.local and its subnames), the query is forwarded to the servers of that rule.
  3. If neither matches, the query is forwarded to the Forwarding Address servers, and the answer that returns is passed to the client.

The row order does not determine priority; a rule that is more specific (longer) than the service's domain routes those subnames to the servers of the rule instead of the service itself.

In TR7 ​

WhatWhere
ProfileConfiguration Menu → GTM → DNS Forwarder Profiles: Forwarding Address (one IPv4/IPv6 address per line, optional port), Domain Based Forwarding, Meta Data
Assignment to the serviceThe DNS Forwarder switch and the profile selection in the Service Management form; when the switch is turned on, the DIRECT box appears on every Frontend IP row
MonitoringThe Forwarder tab of the service dashboard (query rate, bandwidth, cache, latency)
StatusForwarder error if the service is working and the forwarder is not, Forwarder absent if the forwarder has not been created at all

Common Misconceptions ​

  • "When a forwarder is assigned, the service's own domains also go to the upstream servers." The service's domains are answered by the service itself; only the other names are forwarded.
  • "Domain Based Forwarding rules are applied in row order." A rule is selected according to its longest-suffix match with the queried name.
  • "DIRECT shows that the address is a forwarder server." DIRECT makes the queries coming to that Frontend IP be answered only with the service's domains, without passing through the forwarder.

How it is done in the documentation

Related questions