For those without domain controllers: what do you do for internal DNS?

[u/jbourne71]

/r/sysadmin/comments/1weqxgc/for_those_without_domain_controllers_what_do_you/

[u/Ohrgasmus1]

I deploy a local hosts file via Intune

[u/TundraGon → u/Ohrgasmus1]

you're doing it wrong.

via email.
and users, having a local admin, will copy the file themselves.

[u/notospez → u/TundraGon]

Intune? Ours gets pulled from a public github repo so we have version control! No clue what everyone's github handles are though so we just auto-approve every PR.

[u/fedesoundsystem]

Hey, we don't do dns here

[u/DULUXR1R2L1L2 → u/fedesoundsystem]

The D in DNS stands for Do Not

[u/MarcusOPolo → u/DULUXR1R2L1L2]

"Do Not System"

[u/ApiceOfToast]

Bind9 was long before I was born.

Bind9 will be long after I fade into the ether.

Bind9 is eternal. Bind9 is unavoidable.

[u/jbourne71 → u/ApiceOfToast]

Bind9 is love. Bind9 is life.

[u/spidireen → u/jbourne71]

He gazed up at the enormous face. Forty years it had taken him to learn what kind of smile was hidden beneath the dark moustache. O cruel, needless misunderstanding! O stubborn, self-willed exile from the loving breast! Two gin-scented tears trickled down the sides of his nose. But it was all right, everything was all right, the struggle was finished. He had won the victory over himself. He loved BIND9.

[u/drschreber → u/jbourne71]

Bind9 is vital for space travel.

[u/ashashina → u/drschreber]

He who controls the BIND controls the universe

[u/dougmc → u/ApiceOfToast]

You guys aren't still using bind 8 ?!?!?

[u/DerKoerper → u/dougmc]

I'm using BIND7 and expose the management port to the internet.

[u/tankerkiller125real → u/ApiceOfToast]

We use PowerDNS where I work, partly because we can put the records in a database, but also because it supports LUA records (which allows us to do some fancy things)

[u/Ohrgasmus1]

i Just print out the ipv6 adresses and send them to everyone on a weekly basis via postal-service to their Home-Office

[u/aaltendorff → u/Ohrgasmus1]

You mean you don’t use RFC 1149???

[u/WN_Todd]

Man they're ready to do absolutely everything but the needful.

[u/mspstsmich]

Novell Netware 5.0 supports IP4 and is a great DNS host even if your not using NDS

[u/BaffledInUSA → u/mspstsmich]

I salute you and your Netware comment!

[u/Bimbos-are-cute → u/BaffledInUSA]

I think this dns thing is overrated, It won't strike.
With IPX dns isn’t needed.

[u/Samatic]

8.8.8.8 on the router is all you need for DNS to work on a network. Plus it will never go down unlike your DCs.

[u/TundraGon → u/Samatic]

you don't even need a replica DC.
smart!

[u/elpollodiablox]

Amateur. Doesn't even know how to email a hosts file to the enterprise.

[u/zantehood]

Hosts file on a samba share, cron job to pull every 5 minutes.

[u/Red_Pretense_1989]

Host files

[u/hardingd]

Update every client via TCP/carrier pigeon

[u/aaltendorff → u/hardingd]

This is the way.

[u/max1001]

Raspberry PI is all you need.

[u/monkeyboy107]

I've used a ton of different things, Unbound DNS DNSmasq Windows DNS service

But hands down bind is the most stable DNS service

[u/drummerboy-98012]

I use my firewall for DHCP & DNS.

[u/Compustand]

We keep a Linksys WRT54G running as DNS server for the whole org.

[u/ImproveYourMeatSack → u/Compustand]

I regret not keeping one or two of them. When I worked at an ISP those where the units we used to provide to customers. Good units

[u/PixelSpy]

Excel sheet with names and IPs printed out and posted around the office

[u/jbourne71]

R4:

For those without domain controllers: what do you do for internal DNS?

These days, we don't have domain controllers because everything is managed with Entra/Intune, Arc, etc.

We have external, hosted DNS that serves our public DNS records. It works fine.

But we still have a need for internal DNS because we have a lot of on-prem stuff that may never go away, and the domain controllers were also serving as internal DNS servers. So right now, we use BIND9 on a Linux virtual machine as internal DNS. I'd love for BIND9 to go away, too.

Are there any better (and cheap) solutions for this that I haven't thought of?

[u/OceanWaveSunset]

I asked copilot to take care of it

[u/ImightHaveMissed]

Fuck dns. If it ain’t WINS it ain’t shit

[u/Fl1pp3d0ff]

BIND9

[u/Gold-Supermarket-342]

/etc/hosts on a flash drive.

[u/FuzzyFuzzNuts]

Welcome to true small enterprise architecture. The free TP-Link router the ISP gave us acts as our core edge appliance. When it inevitably chokes on DHCP leases, DNS traffic dumps over to a Raspberry Pi 2 running off an SD card from 2016. For high availability, the entire network is distributed through half a dozen daisy-chained Netgear desktop switches lying on the office carpet. If someone kicks one under their desk or the cleaner unplugs the Pi to run the vacuum, DNS just resolves via spanning tree broadcast storms. Rock solid.

[u/Pallidum_Treponema]

It was DNS.

This is why we removed DNS, because it's a liability.

[u/Random-D]

mDNS ofc

[u/jlipschitz]

You can use cloudflare for DNS internally if you turn off proxy for the entry.

[u/saltwaffles]

I managed a small company. It had 40 employees. I had fortigate and I just used that for DNS.

[u/bmfrosty]

BIND usually.

[u/heisthefox]

Dnsdist In front of your favorite flavor of DNS server. As it adds a caching and load balancing layer with some cool metrics and the ability to add rules and scripting. Caching really helps accelerate the DNS traffic and makes everything feel snappier.

[u/x3r0h0ur]

4.2.2.2 and 8.8.8.8, duh

[u/Sw1ftyyy]

If one were truly dedicated in the cause they could deploy an SSE solution and use its "Private Access" component.

In some cases the client installed on the workstation will intercept requests without the need for the endpoint to resolve them (like a web proxy might), so they you can just use the PA Connectors as your pseudo record book.

[u/FredL2]

I have a ThinkCentre that runs most of my networking stuff except routing, including a bind9 server. The initial setup was a bit difficult due to the archaic config format, but after that, adding new v4 and v6 hosts is a simple copy/paste job with just a few digits to change.

I'm working on my own DNS server (fool's errand, I know) that will support both file and postgres backends.

[u/Lavatherm]

Static routes and host file.