DNS Resolver

Configure > Networking > DNS Resolver > Resolver


Local Domain Expansion	Enables or disables local domain expansion so that Content Gateway can attempt to resolve unqualified hostnames by expanding to the local domain. For example, if a client makes a request to an unqualified host named hostx, and if the WCG local domain is y.com, Content Gateway expands the hostname to hostx.y.com.
DNS Preference	Specifies the IP version preference when IPv6 support is enabled in Content Gateway and a web server supports both IPv4 and IPv6. Select IPv4 to cause the proxy to prefer IPv4. Select IPv6 to cause the proxy to prefer IPv6.
DNS Preference Exceptions	List IPv4 / IPv6 preference rules for specific origin servers.
Refresh	Updates the table to display the most up-to-date rules. Click this button after you have added or modified rules with the configuration file editor.
Edit File	Opens the configuration file editor.
	dns_prefer_exception.config File Editor
rule display box	Displays an ordered list of the dns_prefer_exception.config file rules. Select a rule to edit it. The buttons on the left of the box allow you to delete or move the selected rule up or down in the list.
Add	Adds a new rule to the rule display box. Enter information in the fields provided before clicking this button.
Set	Updates the selected rule with the values in the entry fields.
Name	Specify a unique name to aid in administering rules.
Destination Host	Specify the destination hostname.
Preferred Format	Specify the preferred IP version, IPv4 or IPv6.
Apply	Applies the configuration changes.
Close	Exits the configuration file editor. Click Apply before you click Close; otherwise, all configuration changes are lost.

Configure > Networking > DNS Resolver > Host Database

These setting pertain to all DNS name resolution performed by Content Gateway, including DNS Proxy.

DNS Lookup Timeout

Specifies the maximum number of seconds the proxy can wait for a lookup response from the DNS server.

Specifies how long, in seconds, the proxy will wait before making a second DNS request if there is no response to the first request. The value is stored in "proxy.config.hostdb.lookup_timeout". The default value is 120 seconds.

Important: This setting is not used. Instead the records.config entry "proxy.config.dns.lookup_timeout" is used. The default value is 20 seconds. proxy.config.dns.lookup_timeout specifies how long the proxy will wait for the DNS response after sending the request.

Foreground Timeout

Specifies how long DNS entries remain in the host database before they are flagged as stale. This setting is used only when "proxy.config.hostdb.ttl_mode" is not zero (the default value is 0, which means use the time-to-live (ttl) value set by the DNS server. See HostDB.

For example, if this timeout is 24 hours and a client requests an entry that has been in the database for 24 hours or longer, the proxy refreshes the entry before serving it.

The default is 86400 seconds (144 minutes).

Caution: Setting the foreground timeout too low might slow response time. Setting it too high risks accumulation of incorrect information.

Failed DNS Timeout

Specifies how long, in seconds, that a hostname is retained in the failed DNS lookup cache (default = 60). When the timeout expires, the hostname is removed from the cache and the next request for that hostname is sent to the DNS server.

A DNS lookup failure is considered to have occurred when:

There is no DNS response

There is a DNS response error code, including NXDOMAIN

There is an error parsing the DNS response code (there is a malformed response).

Zero (0) is not a legal value.

Configure > Networking > DNS Resolver > Split DNS


Split DNS	Enables or disables the Split DNS option. When enabled, Content Gateway can use multiple DNS servers, depending on your security requirements. For example, you can configure the proxy to look to one set of DNS servers to resolve hostnames on your internal network, while allowing DNS servers outside the firewall to resolve hosts on the Internet. For information about using Split DNS, see Using the Split DNS option.
Default Domain	Specifies the default domain used for split DNS requests. If a hostname does not include a domain, Content Gateway appends the default domain name to the hostname before choosing which DNS server to use.
DNS Servers Specification	Displays a table listing the rules in the splitdns.config file that control which DNS server the proxy uses for resolving hosts under specific conditions.
Refresh	Updates the table to display the most up-to-date rules in the splitdns.config file. Click this button after you have added or modified rules with the configuration file editor.
Edit File	Opens the configuration file editor so that you can edit and add rules to the splitdns.config file. The configuration file editor page is described below.
	splitdns.config Configuration File Editor
rule display box	Lists the splitdns.config file rules. Select a rule to edit it. The buttons on the left of the box allow you to delete or move the selected rule up or down in the list.
Add	Adds a new rule to the rule display box at the top of the configuration file editor page. Enter information in the fields provided before you click this button.
Set	Updates the rule display box at the top of the configuration file editor page. Select a rule and change its properties before you click this button.
Primary Destination Type	Specifies that DNS server selection is based on the destination domain (dest_domain), destination host (dest_host), or on a regular expression (url_regex).
Primary Destination Value	Specifies the value of the primary destination. Place the symbol "!" at the beginning of the value to specify the NOT logical operator.
DNS Server IP	Specifies the DNS server to use with the primary destination specifier. You can specify a port using a colon (:). If you do not specify a port, 53 is used. You can specify multiple DNS servers separated by spaces or by semicolons (;).
Default Domain Name (Optional)	Specifies the default domain name to use for resolving hosts. Only one entry is allowed. If you do not provide the default domain, the system determines its value from /etc/resolv.conf.
Domain Search List (Optional)	Specifies the domain search order. You can specify multiple domains separated by spaces or by semicolons (;). If you do not provide the search list, the system determines the value from /etc/resolv.conf.
Apply	Applies the configuration changes.
Close	Exits the configuration file editor. Click Apply before you click Close; otherwise, all configuration changes are lost.