Guidelines for role separations forwarding vs authoritative

[Bob Harold]

On Fri, Jul 8, 2016 at 4:01 AM, Dave Warren <davew at hireahit.com> wrote:

> On 2016-07-07 23:46, Mik J wrote:
>
>> I have a bind DNS that is authoritative for many zones and that same
>> system is also forwarding.
>> I plan to split these two functions on two different systems.
>>
>> Have some of you done this task ? Do you have any guidelines or advices ?
>>
>> I'm thinking about migrating the forwarding functionality to a new system
>> with a new IP.
>> This will avoid changing the IP of the authoritative server on the DNS at
>> a higher level.
>>
>
> Huh. Oddly, I find changing authoritative servers to be quite trivial in a
> well managed network.
>
> 1) Bring up the new servers.
>
> 2) Update ACLs, firewall rules and scripts/automation as needed, if needed.
>
> 3) Update the zonefiles and upstream zone files. If the primary master
> moved, make the old primary master a temporary slave, such that you can
> update slaves at your convenience.
>
> 4) Update any remaining monitoring systems, or client-facing resolvers
> that forward, stub, or anything else. Consider why you forward, and whether
> it's useful or you're just doing configuration for the sake of
> configuration.
>
> 5) Wait 2-4x the length of the TTL, and/or monitor traffic levels.
>
> 6) Pull down the old servers, clean up after them.
>
> Conversely, changing client facing resolver is a constant pain as there
> are always "things" that are hardcoded and not using DHCP, depending on the
> complexity of your environment, possibly thousands of things. Plus there
> are all the terrible DHCP implementations that renew properly, but fail to
> update their local configuration until they're restarted. And the users?
> Some of them hardcode their resolver settings (see #3 above, it's a thing
> they can configure, therefore some do)
>
> But maybe that's just me -- Plus, my authoritative servers are relatively
> simple, other than the master, but renumbering the master without any other
> changes is also moderately trivial as updating the slaves can (and is)
> scripted.
>
> --
> Dave Warren
> http://www.hireahit.com/
> http://ca.linkedin.com/in/davejwarren
>
>
>
I agree, it is easier to move the authoritative servers to new addresses,
usually.  Just need to update systems that do zone transfers and the ACLs.
Most other things should find the address in the NS record.

-- 
Bob Harold
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20160708/289e2c23/attachment.html>