4 ms·

Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be m

Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be made on any DNS server (e.g., "multi-master"), DHCP integration, and probably several others I'm forgetting at the moment. At least some of these are available in other DNS servers as well but I'd certainly agree that AD-integrated DNS is much easier to deploy, manage and maintain.

aarmenaa 6y ago
> updates can be made on any DNS server (e.g., "multi-master") This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.
- swiley 6y ago
  Bind can have multiple master servers. I don’t understand why it wouldn’t continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I’m not great with bind but I’ve been doing a lot with it lately (using it to feed large DNS servers) so you’re welcome to email me if you want help.
- yrro 6y ago
  BIND has a plugin interface and can load zones from a HA/replicated data store like LDAP. I don't know how commonly this is used in practice. It is used by FreeIPA.

4 ms·

Yeah, there are certainly numerous benefits of AD-integrated DNS, such as built-in zone replication via AD replication, secure dynamic updates, updates can be m

by jlgaddis 6y ago

aarmenaa 6y ago
> updates can be made on any DNS server (e.g., "multi-master") This cannot be overstated. I'm currently in the process of trying to rehabilitate an existing DNS infrastructure based on BIND, and it is a complete disaster. All the "high availability" stuff is focused around replicating zone databases from a single master to many slaves, which will indeed continue answering queries even if the master is down. It appears there is basically zero concern for ensuring that updates will continue to be accepted and distributed to slaves if the master fails. The documentation doesn't address it, and none of the many conversations I found through Google had good answers. I have no idea how large DNS installations are built on this software.
- swiley 6y ago
  Bind can have multiple master servers. I don’t understand why it wouldn’t continue answering queries when the master is down either, you only need the master to answer IXFR/AXFR. Maybe your SOA has some really short times in it? I’m not great with bind but I’ve been doing a lot with it lately (using it to feed large DNS servers) so you’re welcome to email me if you want help.
- yrro 6y ago
  BIND has a plugin interface and can load zones from a HA/replicated data store like LDAP. I don't know how commonly this is used in practice. It is used by FreeIPA.