When redesigning an organizations DNS infrastructure, the question of using Forwarders instead of Root Hints comes up. What kinds of issues should I be aware of when the admins and designers start asking for my input? Are there any particular gotchas that I need to make sure they address?
It's an interesting question and one I've been looking at recently too.
I've opted for adding delegation in the internal root zone rather than using forwarders. It simplifies configuration on the DNS servers as they all look at the root zone, but forwarders must be manually configured on each DNS server.
I would only use forwarders if you need to direct queries for a zone to IP addresses that are different from those in the root (i.e. when communicating to/from a DMZ).
Having proper delegation also allows you to run commands like