mjhjmtu

Need clarification on the documentation on this topic somewhat and wanted to get more info on the following but just can't put my finger on it.

Below is a snippet from a DNS BIND 9.9 configuration. For the most part, reading on forwarding it's all clear except for one thing. This DNS is authoritative for a particular domain, say a.b.c where b.c are handled by 1.2.3.4 and 1.2.3.4.5. If I have the forwarder set as is below, based on reading, it should go out to the above two DNS for any resolution and cache locally however everything locally on this DNS is resolved as well for a.b.c since this NS is authoritative for this domain.

So if I'm reading right, why does this resolve entries locally on this NS if it's supposed to go out to resolve when 'forward only' is used? Is the fact that this NS is authoritative for a.b.c change behavior how forwarding works?

Assume DNS Host IP 1.1.1.1 where this file resides:

options 
 listen-on port 53 any; ;
.
.
.
.
 allow-query any; ;
 allow-transfer 1.1.1.11; 1.1.1.22; ;
 notify yes;

 recursion yes;

 dnssec-enable yes;
 dnssec-validation yes;
 dnssec-lookaside auto;
 forwarders 
 1.2.3.4; # External DNS
 1.2.3.5; # External DNS
 ;
 forward only;

.
.
.
.
;
.
.
.
<Forward and Reverse Zones etc>
.
.
.
.
.
.

The forward only option might not be the most intuitive name for its function. Essentially, this option prevents the name server from even attempting to contact another remote name server if the defined forwarders are down or not responding. When forward only has been specified, the name server still answers from its authoritative and cached data, but it relies entirely on its defined forwarders without ever trying any other name servers. The option does not mean that the name server should refuse to provide answers for its authoritative zones.

Or, stated differently, if the option is not specified and a query is not for one of the server's authoritative zones and the query result is not already in cache, then the server first asks one of the forwarders. If the forwarders cannot be reached, then the server begins the name resolution process beginning at the root servers as usual.