On Tue, 6 Apr 2004, Andrew - Supernews wrote:
>
> This can be done in ACLs already - _but_ that currently doesn't work well
> due to the deferral problem with dnsdb; it's very common with helo and
> return-path domains to have problems resolving the nameservers even though
> the domain itself is resolvable.
I don't think you can do it in ACLs already, because zone boundaries don't
always coincide with domain boundaries. E.g. hermes.cam.ac.uk has no
nameservers of its own since it resides in the cam.ac.uk zone. You have
to retry after trimming off a label if the NS lookup fails, and possibly
repeat.
Consider also the amusement that can be had with classless in-addr.arpa
delegation and chasing CNAMEs.
--
Tony Finch <dot@???>
http://dotat.at/
