Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
2

When redesigning an organizations DNS infrastructure, the question of using Forwarders instead of Root Hints comes up. What kinds of issues should I be aware of when the admins and designers start asking for my input? Are there any particular gotchas that I need to make sure they address?

share|improve this question

1 Answer

up vote 2 down vote

It's an interesting question and one I've been looking at recently too.

I've opted for adding delegation in the internal root zone rather than using forwarders. It simplifies configuration on the DNS servers as they all look at the root zone, but forwarders must be manually configured on each DNS server.

I would only use forwarders if you need to direct queries for a zone to IP addresses that are different from those in the root (i.e. when communicating to/from a DMZ).

Having proper delegation also allows you to run commands like dig +trace to debug issues. I don't think you can do this with only forward zones.

share|improve this answer
While I do like your answer, I'm having trouble determining how it answers the question as asked. – Scott Pack Oct 27 '11 at 19:32
OK, design issues: Using forwarders means that any change in forwarders has to be replicated around all DNS servers. Adding delegation should be automatic as it is (probably) slaved. Gotchas: dig +trace makes it really easy to see when a DNS server isn't responding properly, but this only works if there is correct delegation in place. Forwarders can be a little more tricky to diagnose on a server-by-server basis. – James O'Gorman Oct 28 '11 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.