Sam Drinkard wrote:
At the suggestion of some notes on DNSReport.com, I tried turning recursion off and when I did, it broke sendmail. All of my upstream DNS' have recursion turned on, and from what I gather about the mess there is a chance of dns poisoning with recursion on.
You can turn recursion off only on name servers that will answer queries from other name servers. You can not turn recursion off on name servers that answer queries from clients.
The resolver library is not supposed to perform recursion itself. That's the job of name server. That's why it broke your Sendmail. The resolver libraries are usually too dumb to perform recursive lookups them self, and might be even prevented to do so by firewalls. Also, it would be waste of your network bandwidth since you'd loose effects of caching that name servers are performing.
Said that, on name servers that are supposed to answer queries from clients, you should be able to allow recursion only for specific clients. If you have a valid reason to do so. That basically means name server will not be particularly useful to clients not on the list. This might be a good idea if you have only one name server, serving both internal network and Internet (not such a good idea, IMO).
Question for OP, what's the content of /etc/resolv.conf? Do you have "nameserver 127.0.0.1" inthere by any chance? That would explain why it hasn't worked, since 127.0.0.1 was not on the list of hosts allowed to do recursive lookups.