0

We have an Active Directory network, with a mixture of Windows DNS, linux BIND servers, and want to use OpenDNS as our external DNS provider.

I am wondering What is the best way to set up these servers (regarding forwarders, recursion, etc.)?

Active Directory is our main internal DNS for our domain, and has 3 redundant servers. DHCP and all our servers use these as their DNS servers. Then we have a legacy AD server from an old network that is still authoritative for a bunch of domains. My mail filters run a cacheing instance of BIND, and finally, we have a couple of Linux Bind servers that are authoritative for a bunch of websites we host.

Should our main AD servers point to our legacy AD server, which points to one of our BIND servers, which points to the other BIND server, which finally points out to openDNS? Or should our main AD servers point to all of these directly? - or is there a better option?

  1. What happens if a domain is listed in 2 places? Does DNS process the forwarders in order?

  2. What about root servers - if I want to use OpenDNS for "everything else", do I just list them as the last forwarders, and delete the root servers from all my DNS servers?

  3. How does recursion work - in this scenario, should I be using recursion or not?

2 Answers 2

1

Internet-facing DNS servers that host zones should have recursion disabled and should be used only for hosting zones.

  1. If a DNS server has a zone on it, it considers itself authoritative for that zone so when a request is sent to it for a record in a zone it hosts, it answers definitively (including saying 'no such record' if doesn't exist locally - it won't forward that request). You don't want to have the same zone on multiple servers for this reason. Of course you could have the zone on multiple servers if one was a primary and the other a secondary that receives zone transfers from the primary but the way you worded your question it sounds like you either have or are thinking about having more than one server configured as primary for the same zone which you don't want.

  2. Yes you would list OpenDNS as the last forwarder. You don't actually have to delete the root servers - as long as the forward is in place your DNS server will honor that config.

  3. Kinda hard to answer this one because you have a DNS config that sounds slightly more complex than necessary. I guess I'd suggest simplifying things a bit and have the AD servers forward to OpenDNS directly and then you can put in other forwarders for locally-hosted zones if it is necessary. I'm not sure you're gaining anything with all that forwarding.

In general, you really should separate out servers that host internet facing zones (and disable recursion on those servers) from servers that provide internal recursion. It would make things much simpler.

1
  • There are no internet-facing DNS servers in this scenario - those are handled by a 3rd party DNS provider.
    – Brent
    Apr 21, 2010 at 22:28
1

Assuming everything is internal…

Ideally, you’ll have some designated as just resolvers (for example, a couple of the BIND servers) and the rest just as authoritative for your internal zones. The ones which are forwarders will be:

  • configured to recurse
  • configured with OpenDNS as forwarders
  • configured as either slaves or stubs for all of your internal domains (stubs is probably better)
  • given out to clients in response to DHCP requests/in their static configurations

When it comes to DNS, consistency is key! Try to avoid having a million different setups with different people using different sets of servers configured in different ways. I would avoid the authoritative internal servers (i.e., the AD servers) being resolvers as well, and not hand their IPs to clients directly if I could help it. If you have to, just set them to forward up to the resolvers.

Don’t get designated masters and slaves forwarding between one another: if a client sends a query which isn’t cached at all internally, it would pass through every single server in the forwarding chain, which would be far from ideal.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .