Red Hat

Doesn't forwarding everything mean it does no caching to reduce load on the opendns, and no filtering?

Often, it is good security to have some systems only on the internal DNS, not exposed.

Yes, my mistake. It should look like this so local domains can still be looked up:

Code:

options {
        forwarders {
            <first ip of opendns>;
            <second ip of opendns>;
        };
    };

Filtering is done on the opendns server as that is what the OP wants. Even with forwarding everything the filtering is still done on the opendns server but the problem there is no local domains would be looked up.

As I recall, forwarders makes that DNS do recursion-desired calls, which ensures it does not start talking to Internet DNS independently, but the answers are cached to keep the load on the target down.

Use forwarders , it's good idea.

Either that, or opendns inside as well, so you have the filtering features you feel you need. Having extra DNS servers should either:

No, when the information you are looking for cannot be found locally the requests are then forwarded to the forwarders to resolve.

Yes, forwarding, for the "forwarding DNS" when resolving simple client recursion-desired calls, is making its own, supporting, recusion-desired calls of the "forwarded-to DNS", so the "forwarding DNS" is not burdened with, or motivated toward, contacting outside DNS servers. This is very common behind firewalls.

When the call to the "forwarding DNS" is NOT recursion-desired, meaning it is from another DNS server or other high level functioning client, I am not sure, offhand, if it may direct the caller to the "forwarded-to DNS", but I doubt it, as the routing and firewalls might not allow that, and that is not the spirit of "Forwarding".

Usually, you want DNS traffic with the Internet to happen either on the firewall host DNS (nothing through), or through the firewall between specific internal DNS servers (last internal tier) to specific external DNS servers only (local in DMZ or at the ISP). The firewall is a router to the Internet, so you may have two for redundancy, both for traffic and DNS.