Cisco Cisco Email Security Appliance C160 Mode D'Emploi
33-55
Cisco AsyncOS 9.1 for Email User Guide
Chapter 33 System Administration
Changing Network Settings
AsyncOS supports “splitting” DNS servers when not using the Internet’s DNS servers. If you are using
your own internal server, you can also specify exception domains and associated DNS servers.
your own internal server, you can also specify exception domains and associated DNS servers.
When setting up “split DNS,” you should set up the in-addr.arpa (PTR) entries as well. So, for example,
if you want to redirect “.eng” queries to the nameserver 1.2.3.4 and all the .eng entries are in the 172.16
network, then you should specify “eng,16.172.in-addr.arpa” as the domains in the split DNS
configuration.
if you want to redirect “.eng” queries to the nameserver 1.2.3.4 and all the .eng entries are in the 172.16
network, then you should specify “eng,16.172.in-addr.arpa” as the domains in the split DNS
configuration.
Multiple Entries and Priority
For each DNS server you enter, you can specify a numeric priority. AsyncOS will attempt to use the DNS
server with the priority closest to 0. If that DNS server is not responding AsyncOS will attempt to use
the server at the next priority. If you specify multiple entries for DNS servers with the same priority, the
system randomizes the list of DNS servers at that priority every time it performs a query. The system
then waits a short amount of time for the first query to expire or “time out” and then a slightly longer
amount of time for the second, etc. The amount of time depends on the exact total number of DNS servers
and priorities that have been configured. The timeout length is the same for all IP addresses at any
particular priority. The first priority gets the shortest timeout, each subsequent priority gets a longer
timeout. Further, the timeout period is roughly 60 seconds. If you have one priority, the timeout for each
server at that priority will be 60 seconds. If you have two priorities, the timeout for each server at the
first priority will be 15 seconds, and each server at the second priority will be 45 seconds. For three
priorities, the timeouts are 5, 10, 45.
server with the priority closest to 0. If that DNS server is not responding AsyncOS will attempt to use
the server at the next priority. If you specify multiple entries for DNS servers with the same priority, the
system randomizes the list of DNS servers at that priority every time it performs a query. The system
then waits a short amount of time for the first query to expire or “time out” and then a slightly longer
amount of time for the second, etc. The amount of time depends on the exact total number of DNS servers
and priorities that have been configured. The timeout length is the same for all IP addresses at any
particular priority. The first priority gets the shortest timeout, each subsequent priority gets a longer
timeout. Further, the timeout period is roughly 60 seconds. If you have one priority, the timeout for each
server at that priority will be 60 seconds. If you have two priorities, the timeout for each server at the
first priority will be 15 seconds, and each server at the second priority will be 45 seconds. For three
priorities, the timeouts are 5, 10, 45.
For example, suppose you configure four DNS servers, with two of them at priority 0, one at priority 1,
and one at priority 2:
and one at priority 2:
AsyncOS will randomly choose between the two servers at priority 0. If one of the priority 0 servers is
down, the other will be used. If both of the priority 0 servers are down, the priority 1 server (1.2.3.6) is
used, and then, finally, the priority 2 (1.2.3.7) server.
down, the other will be used. If both of the priority 0 servers are down, the priority 1 server (1.2.3.6) is
used, and then, finally, the priority 2 (1.2.3.7) server.
The timeout period is the same for both priority 0 servers, longer for the priority 1 server, and longer still
for the priority 2 server.
for the priority 2 server.
Using the Internet Root Servers
The AsyncOS DNS resolver is designed to accommodate the large number of simultaneous DNS
connections required for high-performance email delivery.
connections required for high-performance email delivery.
Note
If you choose to set the default DNS server to something other than the Internet root servers, that server
must be able to recursively resolve queries for domains for which it is not an authoritative server.
must be able to recursively resolve queries for domains for which it is not an authoritative server.
Table 33-11
Example of DNS Servers, Priorities, and Timeout Intervals
Priority
Server(s)
Timeout (seconds)
0
1.2.3.4, 1.2.3.5
5, 5
1
1.2.3.6
10
2
1.2.3.7
45