Redundant and smart BIND topography

[kc5deb]

I'm an admin for an ISP with about 30,000+ customers. At the moment we just run 2 DNS server; primary and secondary, both running FreeBSD and bind8.

I've been told that my setup isn't excatly the best suited for redundancy, and was told that using cache servers to hand DNS out to my dialup, and only use my primary and secondary DNS for authoritative queries only.

What is an excepted way to put into place more redundancy with more more than just 2 DNS servers?

Also, it's getting to the point to where adding domains to the servers is a daily issue, and it's becoming a pain to put it into the primary, then turn around and load it into the secondary's named.conf. Is there anything out there yet reliable that if the change is made in the named.conf on the primary, the secondary will pick up the change without user intervention?

 

[jouell]

http://www.tldp.org/HOWTO/DNS-HOWTO.html

is a good read!

http://www.acmebw.com/askmrdns/archive.php

is written by the authors of DNS/BIND Oreilley book -tons of info.

HTH
-john

 

[thedaver]

Yes, as an ISP (smaller!) we would recommend you consider the model you describe.

Dial/DSL/ISDN customers get Resolver DNS boxes as their primary DNS entries.

Create Authoritative (non-resolving) out of your existing DNS boxes. Consider a terciary Authoritative box on an external service for $99 a month, such as

http://www.serverbeach.com

As for zone management, yes, zone creation is a PITA. I might suggest that you consider either 1) a GUI management tool (such as webmin with DNS extensions), or 2) a brief perl script with SSH calls to insert/append the new zone(s) into the Master and Slave(s) server's named.conf and to restart the named service(s). I presume that you have zone transfers enabled for the zone detail itself.

The O-Reilly BIND book and everything that Bernstein (

http://cr.yp.to)

have ever written encourages the separation of resolving (cache) DNS servers from the authoritative ones. This is justified by 1) cache poisoning and cache DoS attacks, and 2) resource usage.

Yes, its more money and more boxes to babysit, but you'll reduce your single points of failure.

Good luck.


Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/