A forwarder is essentially a name server to which all other name servers first send queries that they cannot resolve locally. The forwarder then sends these queries to DNS servers that are external to the network, avoiding the need for the other name servers in your network to send queries off-site. A forwarder eventually builds up a cache of information, which it uses to resolve queries. This reduces Internet traffic over the network and decreases the response time to DNS clients. This is useful in organizations that need to minimize off-site traffic, such as a remote office with a slow connection to a company's network.

You can select any Grid member to function as a forwarder. You must configure your firewall to allow that Grid member to communicate with external DNS servers. You can also configure NIOS to send queries to one or more forwarders. You can define a list of forwarders for the entire Grid, for each Grid member, or for each DNS view.

If your network configuration includes Infoblox BloxOne Threat Defense, you can configure NIOS Grid members (physical or virtual appliance) to forward recursive queries to BloxOne Threat Defense. For more information about BloxOne Threat Defense, see BloxOne Threat Defense. For information about how to configure NIOS members as DNS forwarding proxies, see the Forwarding Recursive Queries to BloxOne Threat Defense section.

Selecting Forwarders

When there is more than one forwarder in the Grid, the NIOS resolver uses a smoothed metric derived from RTT (Round Trip Time) to select the name server to send queries to. RTT is the length of time between when a query was sent and when its  response was received.

...

1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
   Member: From the Data Management tab, select the DNS tab -> Members tab -> member checkbox -> Edit icon.
   DNS View: From the Data Management tab, select the DNS tab -> Zones tab -> dns_view checkbox -> Edit icon. Note that if there is only one DNS view— for example, the predefined default view—you can just click the Edit icon beside it.
   To override an inherited property, select Override next to it and complete the appropriate fields.
2. Click the Forwarders tab.
3. Click the Add icon.
4. Enter an IP address in the text field. The field supports entry for both IPv4 and IPv6 values.
   1. To remove a forwarder, select the IP address from the Forwarders list, and then click the Delete icon.
   2. To move a forwarder up or down on the list, select it and click the Up or Down arrow.
5. To use only forwarders on your network (and not root servers), select the Use Forwarders Only checkbox.
6. Select the Add client IP, MAC addresses, and DNS View name to outgoing recursive queries checkbox to include the client IP address, MAC address, and DNS view name of the client from which the DNS query was initiated, to outgoing recursive queries. For information on recursive queries, see Enabling Recursive Queries. Selecting this option includes EDNS0 custom options.
7. Select the Copy client IP, MAC addresses, and DNS View name to outgoing recursive queries checkbox to copy and validate the client IP address, MAC address, DNS view name from incoming queries to outgoing queries. If this checkbox is selected and:
   • Only one custom option is present, the IP address or MAC address or DNS view name is copied to the outgoing query without adding the missing option. An incoming query can contain only one IP address or MAC address or DNS view name.
   • No custom option is present, if the Add client IP, MAC addresses, and DNS View name to outgoing recursive queries checkbox is selected, valid IP address, MAC address, and DNS view name EDNS0 options are copied from incoming queries to outgoing recursive queries without any change. If the Add client IP, MAC addresses, and DNS View name to outgoing recursive queries checkbox is not selected, no options are added to outgoing recursive queries.      
     For more information about EDNS0 options, see Configuring DNS Traffic Control Properties and Using Extension Mechanisms for DNS (EDNS0).
8. Save the configuration and click Restart if it appears at the top of the screen.

...

Note the following when you enable recursive query forwarding on a Grid member:

• Make sure that you enable recursion on the member that you wish to use as a forwarding proxy to BloxOne Threat Defense. For information about how to enable recursion on a Grid member, see Enabling Recursive Queries.
• DNS forwarding proxy does not work on systems configured in the IPv6-only mode.
• DNS forwarding proxy is not supported on the IB-100, IB-810, IB-820, IB-V810, and IB-V820 appliances. Infoblox recommends that you do not configure DNS forwarding proxy on these appliances.
  
• DNS forwarding proxy is not supported on any appliance that is running on a memory lower than 4 GB.
• Grid Manager ignores global forwarders and all recursive queries are send to BloxOne Threat Defense.
• Unbound is not supported on a Grid member when it uses Bind to send recursive queries to BloxOne Threat Defense. For information about Unbound, refer to the Infoblox DNS Cache Acceleration Application Guide.
• There might be a significant performance impact on your appliance and network during the DNS forwarding proxy installation process depending on the network connectivity between NIOS and BloxOne Threat Defense. Every node will have to install the DNS forwarding proxy before serving DNS recursive queries, which includes the HA nodes.
• When you enable DNS forwarding to BloxOne Threat Defense, the QPS (query per second) throughout might vary, depending on your appliance models and the cache hit ratios. You might see a bigger performance impact when the cache hit ratio is lower.
• DNS forwarding proxy does not work with DNSSEC in case a request was redirected by BloxOne Threat Defense. If you are running DNS forwarding proxy on NIOS, you must disable DNSSEC validation. Even if you disable DNSSEC validation, validation still takes place through BloxOne Threat Defense. To enable DNS forwarding proxy to work with DNSSEC in case a request was redirected by BloxOne Threat Defense, see the Enabling DNS Forwarding Proxy to Work with DNSSEC section.
• To bypass recursive query forwarding to BloxOne Threat Defense, you must disable the DNS forwarding proxy service.
• By adding the join token you obtained from the Cloud Services Portal, and specifying the IP address of the Cloud Services Portal in the CSP Resolver field, you can establish connectivity between NIOS and Cloud Services Portal. Thereafter, you can enable the NIOS Grid Connector service in the Cloud Services Portal. This capability provides you with a single interface for viewing comprehensive network data such as global IP space, subnets, IP addresses, and DHCP lease data for your BloxOne Cloud infrastructure and NIOS. For more information, see Configuring NIOS Grid Connector in the BloxOne Threat Defense documentation.

...

Enabling DNS Forwarding Proxy to Work with DNSSEC

DNS forwarding proxy does not work with DNSSEC in case a request was redirected by BloxOne Threat Defense. To enable DNS forwarding proxy to work with DNSSEC, perform the following steps:

1. Enable DNS Forwarding Proxy on NIOS by clicking Manage -> On-Prem Hosts in the Cloud Services Portal.
2. On Grid Manager, Disable the Fall back to the default resolution process if BloxOne Threat Defense Cloud does not respond option. 
3. Enable DNSSEC validation as described in Enabling DNSSEC Validation.
4. Remove trust anchors if any. To configure trust anchors, see Enabling DNSSEC Validation.