Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite
3

Can anyone recommend a lightweight Linux DNS server, which would be suitable for the data center?

EDIT: We speak about data-center typically within 10 - 20 servers, up to 100 at maximum. For larger amount there is a sense to use BIND indeed.

I'm looking for something more lightweight the BIND (if anything like this exist).

If it's included in the common YUM repos, the better.

Thanks.

share|improve this question
1  
"Common yum repos" is insufficiently specific; running an RPM from CentOS 4 really won't work so well on, say, SuSE. What distribution are you actually using? – womble Jan 6 '10 at 0:07
CentOS 5.4, with Base/Epel enabled. – SyRenity Jan 6 '10 at 11:33

5 Answers

up vote 5 down vote accepted

What sort of DNS do you need? Do you need a recursive resolver for clients in the datacenter? An authoritative server for some domains you're hosting? Do you want to remove a dependency (external recursive DNS lookups) from your own servers?

The short answer (and this is something of a religious issue, so take it with a lump of salt):

  • run recursive resolvers on each server's localhost, each server uses itself for recursive DNS. PowerDNS makes a resolver that works on windows and unix; DJB's dnscache, part of the tinydns package, is also 100% bullet proof but you may need to adjust it so it can follow really long cname chains (akamai, I'm looking at you).

  • run a separate DNS server for addresses you own. Again, PowerDNS is a choice, used by Wikipedia. It's got all sorts of nice back-ends from bind zone files to postgresql databases. Tinydns is great as well, though a little bit odd if you're coming from bind land. Run these DNS servers on your "non-localhost" interfaces, and publish those addresses with your registrar. Be master of your own domain!

  • if you're providing recursive service to other hosts in the data center, run dnscache or pdns-recursor on a machine that isn't otherwise providing DNS services, and set the ACLs for the resolver to only service requests from inside the data center. Random hosts on the internet can conduct wacky cache poisoning attacks against DNS servers, so they shouldn't be trusted if you've got a choice.

PowerDNS is likely easiest to install from a package; in the distant past, DJB was extra super paranoid about third parties messing up his babies so he had weird license restrictions on binary distributions; these have since been removed but the ill feelings towards the DJB suite of DNS utilities remains.

share|improve this answer
I'm looking to maintain host-names for small amount of data centers (up to 100 per data-center), and looking for solution to be as lightweight and taking as lower resources as possible. Another requirement, is for the solution to be HA, meaning the DNS servers will sync the data between themselves. And last (preferred but not a must), is to have some simple web front-end for the whole stuff. – SyRenity Jan 6 '10 at 11:45
Are these DNS names that are to be published for the global IPv4 network, or are you offering split-horizon DNS, or are you offering DNS for a "private" domain such as datacenter1.local? – chris Jan 6 '10 at 12:59
Private domain - with .local names. – SyRenity Jan 10 '10 at 9:16
up vote 7 down vote

Have a look at DJB's DNS (djbdns and tinydns) from http://cr.yp.to/djbdns.html? It's even possible to use BIND's zone files.

share|improve this answer
3  
As much as I hate it, tinydns and dnscache are more lightweight than bind, although they do require daemontools and sacrificing a goat to DJB – Matt Simmons Jan 5 '10 at 20:18
Totally agree with you, DJB is kinda strange (mathematician) but his software is very carefully written and designed. – pfo Jan 5 '10 at 20:27
1  
If one of the goals is "easy to install using yum" that may not be a slam-dunk with tinydns because of the historical ire towards DJB and his "don't distribute my binaries" license. That's history now, but there still don't seem to be many binary packages of qmail/daemontools/tinydns. Also, if the goal is a "don't have to think about it" recursor, dnscache isn't ideal because it has issues with really long cname chains. – chris Jan 5 '10 at 21:24
@chris: Debian has awesome packages for tinydns/daemontools. – womble Jan 5 '10 at 22:00
@Matt: You don't have to run djbdns or dnscache under daemontools, although I'm not sure why you wouldn't. It is an awesome way to run daemons. – womble Jan 5 '10 at 22:02
show 2 more comments
up vote 6 down vote

dnsmasq may be a good option. It can do both dns and dhcp. Just uses the host file and has simple configuration. And it should be in the default repositories for your distribution.

Edit: Let me clarify my answer since it's getting some down votes and comments. The question isn't clear as to the entire use case and scale. So while you may not agree dnsmasq is a completely valid solution under the correct circumstances. The OP is going to have to figure out what fits their particular case since their question was a bit lacking in details.

I would only recommend this as a viable solution if it's for the internal dns resolution on the data center private LAN segment. Assuming that we aren't talking about 100's of servers. If you looking to run your own public DNS then you better be prepared to run a grown up DNS solution in at least 2 geo diverse datacenters.

share|improve this answer
2  
"For the datacentre"... really? – womble Jan 6 '10 at 0:08
Well in certain use cases I would say yes why not. If it's your primary or secondary public DNS server then hell no. But if it's just so that the servers in the data center can resolve each other's ip address on the local subnet then assuming we aren't talking 100's of server then I think it's a viable option. The question isn't super clear on the entire use or scale. – 3dinfluence Jan 6 '10 at 0:21
"But if it's just so that the servers in the data center can resolve each other's ip address on the local subnet" This exactly what I wanted to say - I just clarified the question a bit. In summary, dnsmasq can provide me with such functionality? I do see it's mostly a forwarder solution, so how the DNS entries gets managed? Is there any web front for this? Also, can 2+ dnsmasq server reference each one as the master, and support zone sync, for HA environment? Thanks again. – SyRenity Jan 6 '10 at 11:39
Dnsmasq just like Bind in that it will forward and cache dns requests for zones where it's not the authoritive dns server. With dnsmasq there are no zone files you just add the entry's to the server's host file. However if you're looking for something with HA then you'll likely need a more robust dns solution. Personally I use Bind in all but the simple small networks or where any more advanced features are needed. You can have a primary and 2ndary dns server defined each running dnsmasq but you'd have to keep the host files in sync yourself somehow. – 3dinfluence Jan 6 '10 at 14:47
up vote 5 down vote

I use nsd for authoritative name servers I admin. Keep in mind that all nsd does is act as an authoritative name server, so I use "unbound" (from the same developers) internally for the recursive queries from the servers themselves.

For a (somewhat meaningless) reference, one primary name server, serving a half-dozen zones with maybe 20 records each, has a resident memory footprint of about 1.1MB.

I have found nsd to be very stable. The only issue is zone transfers between servers can be tricky, certainly not as plug-and-play as between 2 BIND servers. I ended up using an rsync script to update/rebuild/reload my secondary name server's records.

Another option I've tried is MaraDNS, which is a good performer, but not much lighter than BIND.

share|improve this answer
So just to understand: * you use NSD for maintaining and providing DNS records * you use unbound as a "proxy" between DNS servers and clients. Unbound is located on same machine as NSD You have active-passive DNS structure, where your passive servers get the zone update from the master server, via rsync. And it's all only takes 1.1 MB of RAM. Is this correct? – SyRenity Jan 6 '10 at 11:48
NSD runs on our public (hosted) name servers, the ones that provide the internet with our host names. Unbound runs both on other hosted public servers to cache recursive queries, as well as running on an internal server to handle queries of office PCs. As they both bind to port 53, you can't run them on the same machine unless it has multiple interfaces (or multiple IP aliases). Unbound, since it caches queries, takes up a lot more memory, though it is tunable. For example, on one server, Unbound is taking about 72MB in resident memory, but it caches lookups for the mail server. – Geoff Fritz Jan 6 '10 at 17:15
up vote 4 down vote

IMHO the "weight" of DNS service is not the software itself, but the traffic it handles and the workd it has to do in order to resolve an address. You can deploy multiple DNS in your data centre in order to minimize load and decrease the possible single point of failure. But keep in mind that a low performance DNS could lower the performance of other services.

share|improve this answer
1  
I take it you've never compared the resource usage of a several-hundred-thousand-zone bind server with a several-hundred-thousand-zone djbdns server? – womble Jan 6 '10 at 0:08
1  
I haven't, nor am every likely to, but I am curious about the results. Any published figures you can point us to? – John Gardeniers Jan 6 '10 at 3:21
@JohnGardeniers: I'm not sure if your being serious, or just being pedantic. Regardless I've found a PDF, its a thorough comparison of Bind vs djbdns. link – TechZilla Aug 28 '12 at 17:33
@TechZilla, I can't imagine why you might have thought that I wasn't being serious and the word pedantic doesn't even fit the context. Anyway, thanks for the link but the microscopic size of the text and the inability to print or download it without registration makes it quite useless to me. – John Gardeniers Aug 28 '12 at 20:10
@JohnGardeniers: I apologize, for not realizing download/print is limited to registered users. However you can read the PDF in normal size, by clicking on 'Full Screen'. – TechZilla Aug 28 '12 at 20:32
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.