3 ms·
You do understand that the corporate world runs on Microsoft Windows and Active Directory, right? DNS is an absolutely critical component of Active Directory
by jlgaddis 6y ago
You do understand that the corporate world runs on Microsoft Windows and Active Directory, right?
DNS is an absolutely critical component of Active Directory (there's even an old joke that, when dealing with Active Directory issues, "it's always DNS").
In an AD environment, clients are almost always configured to use Windows DNS servers as their DNS servers, with the Windows DNS servers then performing forwarding (of any unanswerable queries) on their behalf. This way is, by far, a helluva lot easier.
You could have non-Microsoft DNS servers that slave the zones from the Windows DNS servers and point the clients at those.
You can even go a step further and avoid using Microsoft DNS entirely. Despite what some people (even some here, apparently), you absolutely CAN run Active Directory without using Microsoft DNS at all (although there are several advantages to using Microsoft DNS)! BIND, for instance, can be used instead of Microsoft DNS. It completely supports all the features that are needed for Active Directory -- in fact, it provides a number of additional features that are often "nice to have" as well.
Because it is a PITA to set up and support, though, these type of deployments are fairly uncommon. In most cases, it's much "easier" to just use Microsoft DNS (which can be installed and set up for you automatically when first deploying Active Directory) -- especially when the folks managing Active Directory don't really have a great understanding of DNS itself. For example, I imagine the average Windows administrator would be completely dumbfounded if you asked them to hand-edit a BIND zone file! Instead, with Microsoft DNS, they can just point and click their way around.
This, of course, leaves out all discussion of DHCP which (in a corporate Windows environment) is pretty much always required as well. Running all of this on Windows means you don't have to deal with integrating all of the various pieces yourself.
- EvanAnderson 6y agoA "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way of AD replication "for free". There's a certain component of "snake eating its own tail" to it, insofar as you have to bootstrap new Domain Controller computers by having them use another DNS server while they pull their initial replica. Active Directory-integrated DNS gets you per-record ACLs to authenticate dynamic updates, too.
- jlgaddis 6y agoYeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be made on any DNS server (e.g., "multi-master"), DHCP integration, and probably several others I'm forgetting at the moment. At least some of these are available in other DNS servers as well but I'd certainly agree that AD-integrated DNS is much easier to deploy, manage and maintain.
- aarmenaa 6y ago> updates can be made on any DNS server (e.g., "multi-master") This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.
- swiley 6y agoBind can have multiple master servers. I don’t understand why it wouldn’t continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I’m not great with bind but I’ve been doing a lot with it lately (using it to feed large DNS servers) so you’re welcome to email me if you want help.
- yrro 6y agoBIND has a plugin interface and can load zones from a HA/replicated data store like LDAP. I don't know how commonly this is used in practice. It is used by FreeIPA.
- lethoso 6y agoAs someone who inherited a half broken half-arsed hybrid BIND-Windows environment - now that I've decommissioned the BIND side, our DNS is a lot simpler to operate and understand, and we have far fewer 'glitches'. This is not a knock on BIND - it is good software, but in the average Wintel environment you're probably just adding unnecessary complexity for marginal gains.