<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Paul,<div><br></div><div>Thanks for the response. While you didn’t address the specific question you did point me to the right solution. :)</div><div><br></div><div>One clarification to not besmirch the good folks at Tailscale. They are not using the whole 100.0.0.0/8 address space. They are only using the 100.64.0.0/10 space from RFC6598. And as it is only used internally to their network it won’t in most normal configs conflict with ISP usage of the range. </div><div><br></div><div>That said, since DNS has no awareness of CIDR, I was trying to “cheat” by being overly broad in my query forwarding by using the larger /8. </div><div><br></div><div>The proper solution, which you led me to, was to define forward-zones for all 64 “class B” spaces inside the /10 CIDR range. Tedious, but doable. </div><div><br></div><div>I’m still curious why a /8 didn’t work, but my immediate problem is solved.</div><div><br><div dir="ltr"><div><span style="background-color: rgba(255, 255, 255, 0);">-Jeremy</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br class="webkit-block-placeholder"></span></div><span style="background-color: rgba(255, 255, 255, 0);">----</span><div><span style="background-color: rgba(255, 255, 255, 0);">Jeremy Beker - <a href="mailto:gothmog@confusticate.com">gothmog@confusticate.com</a></span></div><div><a href="http://www.confusticate.com/" style="caret-color: rgb(0, 0, 0); background-color: rgba(255, 255, 255, 0);"><font color="#000000">http://www.confusticate.com</font></a></div><div><span style="background-color: rgba(255, 255, 255, 0);">Condensing fact from the vapor of nuance.</span></div></div><div dir="ltr"><br><blockquote type="cite">On Mar 23, 2025, at 02:00, Paul Wouters <paul@nohats.ca> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>On Sat, 22 Mar 2025, Jeremy Beker via Unbound-users wrote:</span><br><span></span><br><blockquote type="cite"><span>I have successfully set up a forward-zone for my `ts.net` domain to tailscale’s DNS and it works great. I</span><br></blockquote><blockquote type="cite"><span>want to do the same for reverse lookups. All tailscale addresses are in the 100.0.0.0/8 range. So I added</span><br></blockquote><blockquote type="cite"><span>the following to my config (via the GUI, but verified in the config file):</span><br></blockquote><span></span><br><span>While not addressing your question, whoever is squatting on 100/8 has</span><br><span>picked a pretty bad range. This is in production all over the internet,</span><br><span>with the first chunk going to Verisign Business and AWS. Perhaps what</span><br><span>was/is intended is to re-use the range 100.64.0.0/10 which is reserved</span><br><span>by RFC6598 for CGNAT and should not appear in the public internet?</span><br><span></span><br><blockquote type="cite"><span># Forward zones</span><br></blockquote><blockquote type="cite"><span>forward-zone:</span><br></blockquote><blockquote type="cite"><span> name: "100.in-addr.arpa"</span><br></blockquote><blockquote type="cite"><span> forward-addr: 100.100.100.100</span><br></blockquote><span></span><br><span>As 100.100.100.100 is part of 100.64.0.0/10.</span><br><span></span><br><blockquote type="cite"><span>This does not seem to work. Any request to look up an address (like 100.94.184.34) returns:</span><br></blockquote><span></span><br><span>Who is 100.94.184.34 ? That must be one of your own or part of the</span><br><span>tailscale re-use of 100.64.0.0/10 ?</span><br><span></span><br><span>Perhaps limiting your range to 100.64.0.0/10 will prevent you mixing up</span><br><span>this tailscale universe with the public DNS universe?</span><br><span></span><br><span>Paul</span><br></div></blockquote></div></body></html>