[Kul]

I believe by end of this year RIM will be changing the use of static IP address of srp.eu.blackberry.net and will be based to Country, so UK will be srp.gb.blackberry.net (KB04359) and Instead of using a Static IP address, they will be using a range (KB16738/KB03735)

The problem I have is, the DNS servers used are internal on my server and hence will not be able to resolve srp.gb.blackberry.net. How can I get this to work ?

The only option I can think of is using a 2nd NIC card and point that to teh external DNS servers for resolution, but other than that, is there another way ?

how is everyone else addressing this change ?

[knottyrope]

Originally Posted by Kul

The problem I have is, the DNS servers used are internal on my server and hence will not be able to resolve srp.gb.blackberry.net. How can I get this to work ?

How does anyone surf the internet there?

[Kul]

We have a proxy server that we go through

[knottyrope]

can you allow external lookups with your DNS servers?

[Kul]

No. I have done a nslookup and cant get a response to say bbc.co.uk but any internal domains respond back. I believe that is correct because we point to our internal DNS servers

[knottyrope]

open MMC and choose DNS
the right click and choose properties on your DNS server
look at forwarders tab, on bottom add your ISP DNS server IP.

My example
dns.JPG

[Kul]

ok - will try and hopefully it works.

Thanks for your quick responses

[knottyrope]

If it does not work look at your firewall to see if port 53 is open outbound for your DNS servers IP.

[Kul]

I cant see this working here, we have all other DNS domains pointing to our internal DNS addresses. Unless what you are saying is create a DNS domain for RIM and add their addresses in there ?

Another point, our firewall is pure IP and not hostname which is another issue.

[DavidAdams]

How does your internal DNS resolve something new? Surely at some point something must go out to an ISP level DNS server?

[Kul]

Originally Posted by knottyrope

If it does not work look at your firewall to see if port 53 is open outbound for your DNS servers IP.

Yes Port 53 is open outbound, but because our primary DNS server is internal dns, it never gets to resolve the srp address. And if we change the primary address to external then it works but then have issues resolving internal addresses and hence BES would stop working as the BESAdmin account exchange server would not be resolved I guess.

[Kul]

Originally Posted by DavidAdams

How does your internal DNS resolve something new? Surely at some point something must go out to an ISP level DNS server?

it goes through the proxy server and the proxy server then queries the External DNS server, but on the BES we dont use the proxy server, we go straight out

[CanuckBB]

Originally Posted by Kul

it goes through the proxy server and the proxy server then queries the External DNS server, but on the BES we dont use the proxy server, we go straight out

So your interal DNS server's forwaders is the proxy who then queries the public DNS?

That a strange setup. Usually the internal DNS are set to forward to publics.

How about pointing your BES to your ISP's DNS server. Make one of your internal DNS primary and the ISP secondary.

[penguin3107]

Originally Posted by Kul

it goes through the proxy server and the proxy server then queries the External DNS server, but on the BES we dont use the proxy server, we go straight out

This is one of the strangest setups I've ever heard of.
Why would you proxy DNS queries? It just doesn't make any sense.

I can understand proxying HTTP and/or HTTPS ...but proxying a DNS lookup is sillyness.

You should just do as the above posts state... add a forwarder to your internal DNS server which refers queries to an external DNS server for external domains. That's the proper way.

[TargetIT]

In fact, you don't even need a forwarder - if the server can't resolve a name internally, it will go to the roots to resolve it. That's the default way to setup a DNS server. The server will have to access the lookups via the firewall so it could very well be blocked there but a standalone server with DNS installed will go looking to roots by default and return values, barring no firewall getting in its way.