Looking for some input on a best practices approach.
- Currently have an AD domain w/ secure dynamic DNS updates disabled (e.g. any client can update a DNS record). Would like to move away from this.
- 50+ remote sites (connected w/ MPLS and each has an Internet circuit too) -- some with local DHCP servers (Windows) and many with DHCP running off of Cisco switches. only about 30-40% of sites have local IT staff.
- Some clients point to AD for DNS (but most sites don't have an AD server), others to BIND resolvers. Moving more to BIND resolvers at local sites to handle Internet resolution out of the site's Internet circuit for best geolocation and performance for SaaS apps as well as for RPZ. We slave the AD zones to the BIND servers for performance and resiliency. If clients point to BIND, however, obviously Dynamic DNS updates won't work.
We are trying to standardize and keep things as secure as possible. Looking at options:
- Enable Secure DNS updates in AD and have DHCP servers handle update of DNS names on behalf of clients. Seems like this doesn't add any security value as anyone can send a DHCP Request with an Option 81 header. Also, not sure Cisco devices can update dynamic DNS securely (e.g. w/ Kerberos). Guessing not.
- Similar to #1, but use MS DHCP only for the updates (DHCP would not necessarily be local to the office in this case if site doesn't have server infrastructure).
- Get AD server at every site which can be used for primary DNS (and DHCP) by clients (and handle secure DNS updates directly from clients). Also have BIND server for Internet lookups.
- Same as #3 but have AD do both internal and Internet. However, we make pretty heavy use of BIND views so not sure this is possible unless we moved Server 2016 (on 2012 now).
What do those of you out there in mid-size to large orgs do?