Using Microsoft DNS in the wild

Question

Anyone on here using MSDNS out in the wild? We have a requirement to get a couple of backup DNS servers up in case our provider gets DDoS'd (as happened recently), and my first instinct is to get a couple of BIND boxes up on CentOS, but we have lots of Microsoft expertise in-house so it might be better all around if I use Windows - probably 2008.

I remember reading somewhere that some of the highest-traffic DNS servers out there (Microsoft.com?) use MSDNS, so it seems like it should be OK but I'm putting it out there as a question anyway. There must be people on SF who have taken the step to host their own DNS after years of using a provider exclusively...please post up! :)

Did anyone take any security measures outside of the ones in the MS docs?

Answer 1

Well, our internal DNS servers are MSDNS and they hold up just fine under the stress of a global company, hundreds of locations, 500,000+ client workstations, etc... I don't see where you would have a problem putting one up.

Answer 2

I run 2 external MSDNSs, both on MS server 2003. They're used for web servers, and they require little maintenance. They're high traffic servers, and you won't have any problems if your operating system is patched and security policies are in place.

You could also consider renting a dedicated box offsite, and turn it into a DNS server.

I also use Simple DNS. This application runs in windows as it's own DNS service. There are much more features for configuration, and the web API is worth the price alone, but It may not be worth the transition or cost for a backup system.

Good luck!

Answer 3

I run two External MSDNS servers, they are both deployed on Server 2003 and have been rock solid for as long a they have been live (2 years and 1 year respectively).

We're about to upgrade these servers to Server 2008 and have no security worries.

If you have the MS Experience in house I would advise you make use of it, if you would prefer a *nix based solution then CentOS or Freebsd would both work nicely.

Answer 4

Performance-wise it's no problem, security-wise.. well, I'd trust a FreeBSD (or linux) running BIND more. But thats just personal preference and I can't back it up with facts :)

Answer 5

Have you considered using a secondary or tertiary DNS server other than your provider's? Maybe another large provider in your area or just OpenDNS? Then you can use MSDNS for internal name resolution and continue to point all outbound traffic to an outside server.

Answer 6

I've run MSDNS for years for a half-dozen domains on 2003 Standard and now 2003 Web.