3 ms·
Sure, there are somewhat simpler DNS servers than BIND, of which djbdns is a good example, but realistically speaking, the reasons to avoid BIND are historic an
by SwellJoe 10y ago
Sure, there are somewhat simpler DNS servers than BIND, of which djbdns is a good example, but realistically speaking, the reasons to avoid BIND are historic and no longer relevant. BIND has seen multiple major overhauls since the bad old BIND 4 days, and its security has been fine for more than a decade. In the past I would talk about other DNS servers as reasonable things to spend time on (and have contributed to alternative DNS servers in a variety of ways in the distant past), but these days, I tend to say "just use BIND."
All of the docs you're going to find on the web are about BIND. BIND gets new standards first, because that's the implementation that the standards authors use and work on. BIND gets more real world testing than all other DNS servers combined. In short: It's fast enough, secure enough, and has more features than anything else. The only downside may be that it is somewhat intimidating, but BIND configuration maps more closely to the standards docs than anything else...so, if you understand BIND you understand DNS and vice versa, which is not as true of some of the others that try to be simpler to configure. BIND is DNS in more ways than any other server so clearly is the service it provides.
DJB software is/was great, but there's rarely a reason to go that route for most users most of the time, today.
- contras1970 10y agoBIND has seen multiple major overhauls since the bad old BIND 4 days Yes, thanks for supporting my argument in such a forceful way. As you say, BIND has needed multiple major overhauls over the same period that has seen djbdns simple be there, finished.
- SwellJoe 10y agoI didn't know we were arguing. I'm not trying to dissuade you from using djbdns.
- contras1970 10y agoDJB software is/was great, but there's rarely a reason to go that route for most users most of the time, today. You may very well be right, most people at any period of time are in way above their level of knowledge and consequently have no sense of quality. Let me just say that I never met a BIND person who would have an idea about the distinctions between the delegation tree, the on-the-wire protocol, and the BIND zone file format. (Not that i can blame them.)
- chriscappuccio 10y agoBind is a total disaster. bind 4, of course. Bind 8 was also a major disaster. Bind 9 has security problems as well. It is huge and, due in part to DNSSEC it is way too complicated. It is more sensible to use more compact services like nsd for authoritative dns and unbound for a caching server. Or Dan Bernstein tools, even