<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:Calibri;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">To give this a little more context, I've tried this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">[root@ipa ~]# ipa dnsforwardzone-add example2.com. --forwarder=10.55.10.151 --forward-policy=only<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Server will check DNS forwarder(s).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">This may take some time, please wait ...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ipa: WARNING: DNSSEC validation failed: record 'example2.com. SOA' failed DNSSEC validation on server 10.55.10.31.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Please verify your DNSSEC configuration or disable DNSSEC validation on all IPA servers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Zone name: example2.com.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Active zone: TRUE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Zone forwarders: 10.55.10.151<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Forward policy: only<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">We don't care about DNSSEC validation on the forwarded zone, but we do on the zones that IPA is authoritative for.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.high5games.com/"><span style="font-size:18.0pt;font-family:"Times New Roman";color:blue;text-decoration:none"><img border="0" width="220" height="50" id="_x0000_i1026" src="cid:image001.jpg@01D1DE91.EE28CAD0"></span></a><span style="font-size:15.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b>Daniel Alex Finkelstein</b>| Lead Dev Ops Engineer<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="color:blue"><a href="mailto:Dan.Finkelstein@h5g.com"><span style="color:blue">Dan.Finkelstein@h5g.com</span></a></span></u> | 212.604.3447<span style="font-size:15.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">One World Trade Center, New York, NY 10007<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt"><a href="http://www.high5games.com/"><span style="color:blue">www.high5games.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Play
<a href="https://apps.facebook.com/highfivecasino/"><span style="color:blue">High 5 Casino</span></a> and
<a href="https://apps.facebook.com/shakethesky/"><span style="color:blue">Shake the Sky</span></a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Follow us on: <a href="http://www.facebook.com/high5games"><span style="color:blue">Facebook</span></a>, <a href="https://twitter.com/High5Games"><span style="color:blue">Twitter</span></a>, <a href="http://www.youtube.com/High5Games"><span style="color:blue">YouTube</span></a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah"><span style="color:blue">Linkedin</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt"><o:p> </o:p></span></i></p>
</div>
<p class="MsoNormal"><i><span style="font-size:10.0pt">This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient, please notify
the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.</span></i><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black"><freeipa-users-bounces@redhat.com> on behalf of Daniel Finkestein <Dan.Finkelstein@high5games.com><br>
<b>Date: </b>Friday, July 15, 2016 at 11:20<br>
<b>To: </b>"freeipa-users@redhat.com" <freeipa-users@redhat.com><br>
<b>Subject: </b>[Freeipa-users] FreeIPA 4.2.0 CentOS 7: DNS zone forwarding<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Times New Roman""><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hi all,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I'm trying to follow the directions (and cautions) from here:
<a href="http://www.freeipa.org/page/V4/Forward_zones">http://www.freeipa.org/page/V4/Forward_zones</a>, but when I add a new zone (example2.com) and a forwarding address and set the zone to forward-only, no records are returned for hosts like, say, testhost.example2.com.
The NS record for the domain is the authoritative nameserver for the example2.com domain (which belongs to someone else), so we don't know why it doesn't return records whereas direct queries against the remote nameserver work fine.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Any help with the configuration would be appreciated.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Dan</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.high5games.com/"><span style="font-size:18.0pt;font-family:"Times New Roman";color:blue;text-decoration:none"><img border="0" width="220" height="50" id="_x0000_i1025" src="cid:image002.jpg@01D1DE91.EE28CAD0"></span></a><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b>Daniel Alex Finkelstein</b>| Lead Dev Ops Engineer<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="color:blue"><a href="mailto:Dan.Finkelstein@h5g.com"><span style="color:blue">Dan.Finkelstein@h5g.com</span></a></span></u> | 212.604.3447<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">One World Trade Center, New York, NY 10007</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt"><a href="http://www.high5games.com/"><span style="color:blue">www.high5games.com</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Play
<a href="https://apps.facebook.com/highfivecasino/"><span style="color:blue">High 5 Casino</span></a> and
<a href="https://apps.facebook.com/shakethesky/"><span style="color:blue">Shake the Sky</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt">Follow us on: <a href="http://www.facebook.com/high5games"><span style="color:blue">Facebook</span></a>, <a href="https://twitter.com/High5Games"><span style="color:blue">Twitter</span></a>, <a href="http://www.youtube.com/High5Games"><span style="color:blue">YouTube</span></a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah"><span style="color:blue">Linkedin</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt"> </span></i><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt">This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient, please notify
the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.</span></i><o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>