Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've inherited a LAN where there is really no name resolution being done for local resources... i.e. all users enter IP addresses manually to access printers and network shares. There are no LDAP servers or domains either....workstations simply connect to the network without authentication. DHCP is handled via a core switch... And DNS settings are also handed out by this same core switch. Currently, the DNS assignments are as such, and in this order:

10.1.1.50     / old Pentium III Windows 2003 box running DNS service- 128 MB RAM
169.200.x.x   / ISP
4.2.2.2.      / the well known public one

There a couple thousand clients on the LAN....and most of the activity is web browsing ( this is an educational setting ).

First of all, the server seems woefully underpowered for this task...yet there is virtually no slowness when web surfing by clients....

How much horsepower should a heavily used DNS server have ?

I have also heard using 4.2.2.2 is a bad idea .... since it has been so overused...

Finally, wouldn't it make sense to have a robust external DNS server listed first? ( Google's 8.8.8.8 would seem to be a logical candidate )

share|improve this question
add comment

8 Answers

up vote 6 down vote accepted

As that server is clearly not being stressed I'm inclined to think that there is no reason to change anything. The network you have described really doesn't need internal DNS and not having it may even slow (briefly?) down the hacking attempts by the students, as it will not be immediately obvious what machine does what.

As you have given no indication at all that the present system isn't working perfectly there isn't an actual need to change anything.

In regard to

Google's 8.8.8.8 would seem to be a logical candidate

Why is that logical? Why not just use the ISP's DNS, or some other unfiltered source?

I would go even further and remove 4.2.2.2, as the likelyhood of it ever being hit by the clients is slim to none. After all, both the 2003 machine and the ISP's DNS would have to be down for that to happen. If you really feel a need for a third DNS source add the ISP's secondary instead.

share|improve this answer
    
All good points thanks... Especially if the ISP's DNS is not responding..it's probably an indication of an outage, and Google's DNS ( or 4.2.2.2 ) wouldn't be reachable anyway –  CaseyIT Apr 16 '10 at 1:58
1  
I just got a downvote for this. While I really couldn't care less about the loss of a couple of points I would be extremely interested in why someone thinks this is a bad enough answer to downvote. Is there a technical error? Is it bad to use common sense? –  John Gardeniers Apr 21 '10 at 22:32
2  
I didn't downvote, but I'd rather use Google's DNS than my ISP. ISPs have something of a track record of intercepting NXDOMAIN responses, and mine goes down far more frequently than 8.8.8.8 does. –  ceejayoz Nov 28 '11 at 22:04
add comment

When you outsource to another company, especially one that is doing it for free, you might consider what they are getting out of it. Google is in the information business, and they are getting another aspect of your (or your user's) traffic pattern.

If I were at a university that used google's name service, I would be raising privacy issues pretty darned fast.

Some things are best kept in house, and DNS resolution seems to be one of them. If you are unable or unwilling to run a stable server like BIND then purchase an appliance to do local DNS resolution.

DNS for a small site can run on a very small machine, but I'd not enable DNSSEC. :)

share|improve this answer
3  
+1 for privacy concerns. You cannot overlook such an aspect. –  Antoine Benkemoun Apr 15 '10 at 21:41
3  
All your DNS are belong to Google. –  Wesley Apr 16 '10 at 0:32
add comment

I work for a university and we use internal DNS server for internal-only entries, other than that, all lookups are forwarded to Google's 8.8.8.8/8.8.4.4 without any issues.

share|improve this answer
    
i agree with this. –  djangofan Apr 15 '10 at 21:00
add comment

You'll get faster response for web surfing and reduce your network traffic if you set up a local DNS server, even if you only use it as a proxy DNS server (e.g. all your client machines do their lookups to your local DNS server, which then does the lookups on the public/ISP DNS of your choice, and then caches the answers). Why will you get faster response? Ping a host on your 10/100/1000 Mbit network, and compare the result to pinging a public DNS server over your 1/2/8/10 Mbit internet connection. My guess is that you will benefit immediately from a local DNS infrastructure which won't cost you all that much.

If you also use it for local hostname resolution, then you'll benefit from easier to remember, meaningful hostnames for the hosts on your network.

share|improve this answer
add comment

Reasons to use an internal DNS server:

  • You have internal domains that aren't public, or are different than what is available publically.
  • You'd like to fiddle with caching and other performance stuff.
  • You'd like to log the DNS queries to monitor who goes where.
  • You'd like to block certain things (note that people will circumvent this by changing their DNS server to 8.8.8.8 or something else, so you'll have to block DNS to anything other than your server at your firewall)
  • You'd like to redirect certain domains (e.g. redirect facebook.com to Terms of Employment policy)(of course, you'll have the same problems as if you block domains)
  • You'd like to really understand how DNS works.
  • You are a control freak.
  • You are a snoop.
share|improve this answer
add comment

I have barely heard of 4.2.2.2, but this is what I heard.

I would recommend you use at least two DNS servers for a large network of thousands of clients. I wouldn't want to be you if (or rather when) the ONE DNS goes down...

If you are looking for the same kind of simplicity and don't want to host your own, then I recommend you check out OpenDNS where you can even set up some filtering (porn etc) which you might want on an educational network. Especially on an educational network.

Of course, I would most definitively use Google's 8.8.8.8 AND 8.8.4.4 instead of 4.2.2.2.

share|improve this answer
    
I hear the filtering concern...but the ISP has a fairly good filter -- I say fairly good since students regularly skirt around it with proxies like hidemyass.com and the like –  CaseyIT Apr 16 '10 at 1:49
    
That is true, and DNS filtering is not really doing anything but stop the less technically inclined anyways. –  Gomibushi Apr 16 '10 at 6:20
add comment

Is that Win2003 server used for anything else? I'd nuke it, toss on your Linux/BSD distro of choice and install DNSMasq on it.

share|improve this answer
    
No it's not, and that's gonna happen I can assure you! Haven't heard of DNSMasq but will look into it. –  CaseyIT Apr 16 '10 at 1:53
1  
DNSMasq does DNS forwarding/caching (and DHCP, but you don't need that and it's not enabled by default). Another option (and may be more robust) would be BIND. –  gravyface Apr 16 '10 at 2:07
    
I would nuke it and get totally rid of it - uses lots of electricity for nothing. As in: Get ONE server that is modern, more powerfull, virtualize all the old crap away. I run windows based DNS on 256MB machines with a very tight CPU slice successfully. –  TomTom Apr 16 '10 at 5:52
add comment

Well setting up a dns server with a bit more horsepower might make sense. You can use dns debug logging on Windows 2003 DNS properties to log DNS requests to see what volume of DNS traffic you are getting. For internal requests you can set the TTL on local records to a high value to reduce the number of requests. 3600 seconds perhaps?

External requests will get cached on the internal server if it is the first DNS server listed for clients to ask. I believe that depending on the DNS server settings, if it isn't found on the internal server, that server will refer the client to one that can answer, or it will recurse the request--get the answer, then pass it the client.

It is worth reading up on, as your network usability and stability will probably increase by being able to use hostnames instead of IP's for internal resources, but to be useful it does need to be carefully configured.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.