Enterprise DNS management: how should I do it, and is there a good way to reconstruct zone files?

Question

For the last few years, the most complicated DNS management I've done has been for operations with a handful of domains and relatively simple demands, like running mail through Google Apps, handled by web tools from companies like GoDaddy or NameCheap. Now, though, I've got to take over much more complicated DNS arrangements covering a couple dozen domains, plus a couple dozen subdomains. There are a bunch of different MX records for the domains, TXT records for domainkeys, etc., and there are going to be a couple dozen more over the next year.

I've got two questions:

1. What companies offer very configurable enterprise-level DNS management? I'm not ready to run my own nameservers, I don't think.

2. Since I don't have a high opinion of the attention to detail of the consultants who have been managing our DNS, what's the best way to reconstruct the records completely to make sure they're giving us everything? The (sadly plausible) nightmare scenario would be having them insist we've got everything we need, and then having a fortnight of round-the-clock "mail isn't working for example.com!" and "what happened to messageboard.domain.com?" eruptions.

Answer 1

1.

If this is enterprise level DNS and DNS is critical to your business (i.e. an online trading shop / email ... anything) then you need to be with two independent separate providers.

Amazon outsource their DNS to UltraDNS and I've recommended them previously. They did have a rather large DDos attack which brought them down recently but that's always a risk, and even more of a risk with running your own nameservers.

UltraDNS are excellent though (if a little pricey), I've used them before and you get full control over your zone files.

2. Providing you have the full list of domains your consultants have been managing, DNS is actually quite easy to transfer. The protocol is built in such a way to allow the raw zone format to be transferred around.

You can pull all records by doing a zone transfer, which can be achieved on the commandline by running

$ dig axfr zone.com @ns1.provider.com 

from a Linux command prompt.

You can ask them for the RAW zone files if they've been using a DNS server that stores it's configuration in plain text files (e.g. djbdns / bind). Sometimes these can differ depending on the nameserver software, as the configuration files can be using internal keywords to help manage the DNS (e.g. auto-generating records), so really the best way is to actually use dig axfr.

UltraDNS also has a facility (as should any respectable dedicated DNS provider) to do the dig axfr command for you, if you don't have access to a Linux command line or aren't comfortable with that.

The only thing you will need to talk to your consultants about is making sure that full zone transfers are allowed from the public IP address of the machine you are pulling them from as it is a restricted procedure only allowed from trusted hosts and it's essentially how your secondary (and tertiary if you have one) nameserver(s) pull their information from the master.

Answer 2

I can recommend DNSMadeEasy for their reliability and ease of use. Besides, they have 100% SLA as well as 100% uptime history.