Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background: I have a relatively small Active Directory domain (Windows 2003 Functional level) with two domain controllers, both running DNS servers. They are the primary and secondary DNS servers for the LAN. No other local DNS. I do not have any subdomains or recursion going on.

My Question: In the DNS Manager, under server Properties, Forwarders tab. Should I have my ISP's DNS servers listed here (or the Google ones)? Or should I leave the Forwarders tab blank and rely on the Root Hints servers?

My Forwarders Tab

I Googled before posting. About half the advice I read said the use the ISP DNS as forwarders, and half said to just use the Root Hints. So, I have no idea which is "best" for my setup (which I imagine is pretty typical for a small shop).

share|improve this question
add comment

3 Answers 3

Unless you have some reason to directly recurse from the root, I'd recommend using a forwarder; Google or your ISP is much more likely to have something in cache for a query, so it'll provide better performance for name resolution within your network.

As far as Google vs ISP, there are two reasons that you might want to use Google over your ISP:

  • Performance. Google's systems are anycasted and do some interesting stuff with cache; test and see if they're generally faster than your ISP.
  • Badly behaved ISP. Some ISPs fiddle with queries, doing dirty stuff like NXDomain hijacking.
share|improve this answer
    
I agree with the badly behaved ISP part. I've had more trouble with ISPs who didn't truly have the knowledge/manpower to run a good operation and always blamed things on our side of the equipment rather than theirs. –  Brad Bouchard May 9 at 15:52
add comment

What I have come to in my experience is that it's good (and doesn't hurt to have more than 2) to use a big name (Google, Microsoft, Verizon) set of DNS forwards, and your local ISPs. in conjunction. The reason I like this approach is that local ISPs usually don't have the infrastructure or man-power that the larger named companies do; meaning if they go down, I want to be able to have another set of DNS forwarders to rely on, and vice versa. If for some unknown reason Google or Verizon's DNS servers are down, then my local ISP can take over and work.

Also, I've had issues with local ISPs and their caching times; they do vary throughout regions, but Google and Verizon always had the best TTL refreshes for me and my clients. There isn't a "best practice" per se, just different approaches like I've described.

share|improve this answer
add comment

What is "best" depends on your situation. A person who is in child domain might want to set his or her forwarders to their parent domain's DNS servers.

Or you might want to set your forwarders to a set of DNS servers that are authoritative for a particular domain that's internal to your organization.

Or you might not have internet access and so root hints won't help you.

Or you might prefer a particular forwarder to root hints for performance reasons.

Or if you don't really care about any of the above, then root hints work fine.

share|improve this answer
    
Very good point on the part where you talked about not having Internet access; if this were the case then root hints wouldn't even matter. Good stuff. –  Brad Bouchard May 9 at 15:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.