1

I found the picture shown below several years ago and as I'm currently studying about DNS and BIND, I wanted to understand and build the setup shown here. I do understand about the (aggregate) caching-only forwarders and it kind of makes sense to do the (internal) resolving yourself instead of just forwarding it on one more time to your ISP. The setup with the hidden masters and zone slaves also makes sense but I do not understand why you would put "external resolvers" in front of these zone slaves. Why not let external clients directly send queries to those zone slaves? What is the added benefit of inserting external resolvers?

I tried searching Google for this image in hopes of finding any document describing this setup but alas, I couldn't even find this image anymore on the web.

Enterprise DNS Design

1 Answer 1

2

External Resolvers

One perspective on having the external resolvers would be to put the External servers in the DMZ. Typically, any internet accessible server should be separated off from the rest of the servers. Then there can be more strict firewall rules on what is allowed in. This also lowers the risk from being compromised. If someone would gain access to the External servers, they would not be directly on your Server LAN, and likely not on a domain joined server.

Another reason would be that if someone started a DDOS attack on your public DNS, it would not bring down your internal business clients, servers, etc.

Master Servers

This would be where your master copy for your company's domains resides. These servers would likely be where you would edit your DNS records also. They wold be protected with higher security to keep your records secure.

Zone Slaves

These would be where all of the other servers would access the internal DNS zones from. They would have much more activity than the Masters.

Internal Resolvers

These would be doing most of the work for your internal users. They would recieve requests from the downstream forwarders, and do all of the recursive lookups to resolve all of the the queries.

Caching-Only Forwarders

These servers would be to reduce the load of the internal resolvers. They would cache all of the requests so that common queries will be answered locally, and would not require lookup again by the Internal Resolvers. They can also increase client side performance, if the Resolvers are located off-site.

3
  • Though I would then call them external forwarders and not resolvers or do I misunderstand something?
    – Tom
    May 2, 2017 at 13:48
  • A forwarder does not "resolve" lookups, which is a bit over simplified. A forwarder receives a query for www.google.com, it would just pass the request as a whole along to the upstream DNS. A "Resolver" would get the query for www.google.com, it would query the root servers for COM, then query the COM TLD servers to resolve google, then it would query google's DNS servers to resolve www, and then responded to the client. Does that make sense? May 2, 2017 at 17:24
  • It does. In the picture shown above, the external resolver should not resolve the DNS names, at least not every query you send to it and certainly not recursively. These external resolvers should only resolve the domain names that we own and for which we have the zone slave servers running internally. That's why it makes more sense to me to have them forward instead of resolve.
    – Tom
    May 2, 2017 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .