SCHIZOSCHIZOSCHIZO
  • WORK
  • ABOUT
  • BRAIN DUMP
  • TOOLS
  • CONTACT
2026-06-05

F5 DNS Resolution Flow

f5bigipDNSzone transferBIND

Decision flow

We configure a listener on BigIP where the query arrives (e.g. 10.1.20.20).

  1. >Is there any Wide IP / FQDN configured against the query?
  2. >Is the name in the DNS Express Zone? (AD DNS is configured as primary DNS server and F5 is configured as secondary, where every entry is replicated to.)
  3. >Checks the F5 DNS cache.
  4. >Checks the master DNS cache which we assign in F5 DNS. Here, F5 will work as a recursive resolver. But if the resolving cache is not configured...
  5. >Is there any pool attached to the listener?
    • >Pool: we do not set up any secondary servers; rather, when a DNS query is received at F5, we configure F5 to direct it to the AD DNS.
    • >But if the pool is not configured, then...
  6. >In F5 DNS, a local BIND DNS can be configured, where it is checked next.
  7. >Checks if the listener is a Self-IP. If it is, then the query fails; if not, then the query is sent to that IP and the answer is cached.

Zone transfer

Verify if a DNS zone transfer has occurred. To make F5 DNS make a DNS zone transfer request to the already-present primary DNS server, we can simply change the DNS Express zone state to DISABLE and re-ENABLE again.

  • >dnsxdump
  • >tail -f "/var/log/ltm"
Resolution order check1/3

After the Wide IP and DNS Express zone checks, what does BIG-IP consult next?

Read next

  • 2026-06-17 · ChecklistsConfiguring DNSSEC on F5 BIG-IP DNS
  • 2026-06-25 · CheatsheetsSSL Offloading on F5 BIG-IP
  • 2026-06-25 · Byte-SizedLocking Down Ports on F5 BIG-IP
  • 2026-06-06 · CheatsheetsF5 Local Traffic Policies

← All PostsSCHIZO Brain Dump
SCHIZO

Suhesh Kasti — AppSec & Offensive Security

Navigate

  • ▸ Projects
  • ▸ Brain Dump
  • ▸ Cyber Tools
  • ▸ About
  • ▸ Contact
  • Download CV

Connect

  • ◆ GitHub
  • ◆ LinkedIn
  • ◆ Twitter
  • ◆ YouTube
  • ◆ Telegram
© 2026 SCHIZO

Press / to search