Configuring Custom DNS Zones - Jamf Security Cloud Portal Setup Guide

Jamf Security Cloud Portal Setup Guide
Solution
Application
Jamf Connect
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Custom DNS Zones are used to resolve hostnames belonging to a specific set of domains via one or more authoritative name servers within your network.

Requirements

  • IP addresses of authoritative name servers

  • Configured Interconnect Gateways through which those servers are available
    Important:

    Misconfiguring a zone may result in lost connectivity to some or all of your private applications and workloads for your end users.

    Make sure that all defined domains are resolvable by the authoritative name servers defined within each zone. Ensure that all authoritative name servers are available via the defined interconnect gateways.

  1. In Jamf Security Cloud, navigate to Integrations > DNS zones.
  2. Click Add zone.
  3. Enter a Zone name.
  4. For each domain, type the domain name and click Add new domain.
    Note:

    • Jamf Security Cloud supports domains of any length, including just a wildcard *. This would match any DNS query, but would significantly increase the load on your internal DNS name servers.

    • Reverse DNS lookups are supported by specifying the domains with .in-addr.arpa and .ipv6.arpa suffixes.

  5. Define one or more Authoritative Name Servers:
    1. Enter a server IP Address.
    2. Select the Interconnect Gateway that will be used to reach that server.
    3. Click Add.
    Note:

    • A name server IP Address can only be defined once per DNS Zone.

    • If the Nearest Data Center egress Gateway is selected, the IP address of the Authoritative Name Server must be publicly reachable and not fall into any reserved private IP ranges for security reasons; for example, RFC1918.

  6. Click Save.
  7. Repeat these steps for other zones as required.

Each DNS query matching the list of domains in the Custom DNS Zone will be routed to one of the configured Authoritative Name Servers using a pseudo-random load-balancing algorithm.

Note:

If your internal infrastructure changes, you must edit and reconfigure your Custom DNS Zones as well. Changes that may require you to reconfigure your zones include:

  • Adding a new Authoritative Name Server into your infrastructure

  • Changing the IP Address of the existing Authoritative DNS Server

  • Adding a new application with a domain name that doesn't match the domains of the Custom DNS Zone

  • Changing a domain name of one of your applications, if the new name doesn't match the domains of the Custom DNS Zone

You can now proceed to configure your access policy.