Guidelines for role separations forwarding vs authoritative

Dave Warren davew at hireahit.com
Fri Jul 8 08:01:35 UTC 2016


On 2016-07-07 23:46, Mik J wrote:
> I have a bind DNS that is authoritative for many zones and that same 
> system is also forwarding.
> I plan to split these two functions on two different systems.
>
> Have some of you done this task ? Do you have any guidelines or advices ?
>
> I'm thinking about migrating the forwarding functionality to a new 
> system with a new IP.
> This will avoid changing the IP of the authoritative server on the DNS 
> at a higher level.

Huh. Oddly, I find changing authoritative servers to be quite trivial in 
a well managed network.

1) Bring up the new servers.

2) Update ACLs, firewall rules and scripts/automation as needed, if needed.

3) Update the zonefiles and upstream zone files. If the primary master 
moved, make the old primary master a temporary slave, such that you can 
update slaves at your convenience.

4) Update any remaining monitoring systems, or client-facing resolvers 
that forward, stub, or anything else. Consider why you forward, and 
whether it's useful or you're just doing configuration for the sake of 
configuration.

5) Wait 2-4x the length of the TTL, and/or monitor traffic levels.

6) Pull down the old servers, clean up after them.

Conversely, changing client facing resolver is a constant pain as there 
are always "things" that are hardcoded and not using DHCP, depending on 
the complexity of your environment, possibly thousands of things. Plus 
there are all the terrible DHCP implementations that renew properly, but 
fail to update their local configuration until they're restarted. And 
the users? Some of them hardcode their resolver settings (see #3 above, 
it's a thing they can configure, therefore some do)

But maybe that's just me -- Plus, my authoritative servers are 
relatively simple, other than the master, but renumbering the master 
without any other changes is also moderately trivial as updating the 
slaves can (and is) scripted.

-- 
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren




More information about the bind-users mailing list