Network & Infrastructure / DNS, DNSSEC & Service Discovery
Conditional forwarding loops and recursive query amplification
Two enterprise resolvers forward a namespace to each other after a reorganization. Clients see timeouts while both resolvers consume work on queries that never reach an authority.
Environment and inputs: Authoritative and recursive DNS infrastructure; BIND examples are conceptual and require release-matched configuration. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Trace forwarding rules, authoritative ownership and query logs for one failing name. Map suffix matching and fallback behavior through every resolver rather than inspecting only the closest server.
Explain the result
Forwarding is a dependency graph. A cycle can multiply retries and exhaust recursive capacity even when each server is individually reachable and its local configuration parses successfully.
Plan the fix
Assign clear authority and an acyclic forwarding path for each namespace. Remove obsolete reciprocal rules and verify whether forward-only or fallback behavior matches the intended trust boundary.
Check the result and rollback
Query representative existing and nonexistent names while watching upstream request counts. Revert if the correction leaks private names externally or removes the only authorized path to a child namespace.