bsdperimeter/pfsense — pull request #463 by phil-davis (2013-03-06 12:22:10+00:00)
Title: Add DNS Forwarder option to not forward private reverse lookups

Currently, reverse lookups of private IP addresses that are not resolved on the pfSense box itself (e.g. like 192.168.42.43) are forwarded to the default DNS servers. For most use cases, those PTR queries go out to the real internet, when they actually have no chance of a successful answer. This loads up the real internet DNS servers with rubbish requests and also causes a round-trip delay before dnsmasq can reply with a "not found".
This change gives the option to tell dnsmasq not to forward these requests.
Note that users can add specific domain overrides, which are implemented before this option. So a user can forward "1.168.192.in-addr.arpa" to an internal DNS server that knows about 192.168.1.0/24 - and then turn on this new option and all other requests for private reverse lookups will not be forwarded.
Users could also add all the various private "10.in-addr.arpa" entries manually to domain overrides, specifying that they go nowhere. But that is a rather tedious solution for a routine issue.
After enabling this, PTR queries for IP addresses in my LAN that do not have names return in about 1ms. Without the setting, they go for a round-trip to the real internet, about 100-200ms delay for me.
Do others think this is worthwhile as a DNS Forwarder specific on/off option?