<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof">I am not sure this was clear, but are you talking about DNS/DHCP for internal computers or trying to DNS for both internal and external, DHCP for internal. As mentioned below, your load (QPS) will probably determine may determine
if you can support a single server. A small network supplying internal hosts of < a couple hundred hosts it would be fine. I assume at least a primary and secondary for each service.</div>
<div class="elementToProof"><br>
</div>
<div class="elementToProof">I don't think anyone will recommend servicing external DNS and internal services like DHCP on the same box... That is just an accident waiting to happen.<br>
<br>
Also think about the Confidentiality, Integrity and Availability triad. A large network may also have separation of duties and you may have different admins for each service (they don't want to reboot the other's services). A DNS server may require high uptime,
but a DHCP server should be able to sustain a little downtime. <br>
</div>
<div class="elementToProof"><br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
Good luck,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
RW</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:14pt;font-family:Calibri, Helvetica, sans-serif;color:rgb(0, 0, 0)">
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> on behalf of Fred Morris <m3047@m3047.net><br>
<b>Sent:</b> Wednesday, January 8, 2025 2:11 PM<br>
<b>To:</b> Bind-users <bind-users@lists.isc.org><br>
<b>Subject:</b> Re: Bind and DHCP</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">This email originated from outside of TESLA<br>
<br>
Do not click links or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
Good operational network design calls for network segmentation; proper<br>
segmentation implies the functions of DDI to be technically (as opposed to<br>
organizationally) managed by segment. This would include actual recursing<br>
resolvers and DHCP services, not forwarders, at the segment edge.<br>
<br>
A lot of people are invested in solutionism via centralization so this is<br>
inherently controversial.<br>
<br>
On Wed, 8 Jan 2025, Karol Nowicki via bind-users wrote:<br>
> Does a good practice recommend to split running ISC Bind and DHCP into<br>
> two different machines or make DNS+DHCP running on same server is<br>
> allowed ?<br>
<br>
What allows you do to the best job with logging, according to your<br>
policies on observability?<br>
<br>
--<br>
<br>
Fred Morris<br>
<br>
--<br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font></div>
</body>
</html>