3 ms·

A "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way o

A "win" w/ Active Directory-based DNS servers (and storing the DNS records within Active Directory) is that you get replication between the DNS servers by way of AD replication "for free". There's a certain component of "snake eating its own tail" to it, insofar as you have to bootstrap new Domain Controller computers by having them use another DNS server while they pull their initial replica. Active Directory-integrated DNS gets you per-record ACLs to authenticate dynamic updates, too.

jlgaddis 6y ago
Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be made on any DNS server (e.g., "multi-master"), DHCP integration, and probably several others I'm forgetting at the moment. At least some of these are available in other DNS servers as well but I'd certainly agree that AD-integrated DNS is much easier to deploy, manage and maintain.
- aarmenaa 6y ago
  > updates can be made on any DNS server (e.g., "multi-master") This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.
  - swiley 6y ago
    Bind can have multiple master servers. I don’t understand why it wouldn’t continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I’m not great with bind but I’ve been doing a lot with it lately (using it to feed large DNS servers) so you’re welcome to email me if you want help.
  - yrro 6y ago
    BIND has a plugin interface and can load zones from a HA/replicated data store like LDAP. I don't know how commonly this is used in practice. It is used by FreeIPA.

jlgaddis 6y ago

Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be made on any DNS server (e.g., "multi-master"), DHCP integration, and probably several others I'm forgetting at the moment. At least some of these are available in other DNS servers as well but I'd certainly agree that AD-integrated DNS is much easier to deploy, manage and maintain.

aarmenaa 6y ago
> updates can be made on any DNS server (e.g., "multi-master") This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.
- swiley 6y ago
  Bind can have multiple master servers. I don’t understand why it wouldn’t continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I’m not great with bind but I’ve been doing a lot with it lately (using it to feed large DNS servers) so you’re welcome to email me if you want help.
- yrro 6y ago
  BIND has a plugin interface and can load zones from a HA/replicated data store like LDAP. I don't know how commonly this is used in practice. It is used by FreeIPA.