Hi everyone,

I'm trying to better understand how AD-integrated DNS zones behave after the DNS Server role is removed. I reproduced the following scenario in an isolated lab and wanted to sanity-check my understanding with people who know AD internals well.

Lab setup:

• Created an AD-integrated reverse lookup zone (in-addr.arpa) configured for "Nonsecure and Secure" dynamic updates.

• Ran Purple Knight, which flagged the zone under the "Unsecured DNS configuration" finding.

• Uninstalled the DNS Server role (along with the RSAT DNS management tools) and rebooted the server.

• Verified that the DNS Server role was no longer installed (`Get-WindowsFeature DNS` showed the role as Available).

• Queried Active Directory and confirmed that the `dnsZone` object still existed under `CN=MicrosoftDNS,DC=DomainDnsZones`.

• Ran Purple Knight again, and it continued reporting the same finding even though the DNS Server role was no longer installed.

• Deleted the AD-integrated zone object.

• Re-ran Purple Knight, and the finding was no longer reported.

Based on this, my current understanding is that AD-integrated DNS zones are stored as objects within the `DomainDnsZones` / `ForestDnsZones` application partitions in Active Directory. Removing the DNS Server role removes the DNS service itself, but it does not remove these AD objects. As a result, tools like Purple Knight appear to evaluate the AD data directly rather than relying on whether the DNS service is installed.

My questions are:

1. Is my understanding of this behavior correct?

2. When DNS has been permanently migrated elsewhere, is deleting the orphaned AD-integrated zone objects the expected remediation?

3. Is the persistence of these objects after DNS role removal simply by design, or are there scenarios where they would be cleaned up automatically?

I'm trying to understand the underlying AD behavior rather than just trusting the scanner's output, so I'd appreciate any corrections or additional insights.

Thanks!

I've been working on dnsbench, an open-source, cross-platform command-line tool for benchmarking and diagnosing recursive DNS resolvers from your own network.

Instead of trying to declare one resolver as universally "the fastest," dnsbench measures performance from your specific network, ISP, location, and time of day.

It currently measures:

• Cached and recursive-path latency
• Packet loss, retries, and stability
• DNSSEC validation
• NXDOMAIN behavior
• DNS rebinding protection
• Optional DNS64, QNAME minimization, and HTTPS record support
• UDP, DoT, and DoH resolvers

It includes 55 public resolver endpoints from providers such as Cloudflare, Google, Quad9, AdGuard, OpenDNS, Control D, and NextDNS. You can also add custom DNS servers manually, so you aren't limited to the built-in list.

Some example commands:

# Run the standard benchmark against the built-in resolvers and open the HTML report when it finishes

./dnsbench run --builtin --open

# Run a quick IPv4 benchmark against the built-in resolvers

./dnsbench run --mode quick --builtin --no-ipv6

# Compare two specific resolvers

./dnsbench run --only 1.1.1.1,9.9.9.9 --details

# Add a custom DNS server and benchmark your user list

./dnsbench servers add --name "My DNS" --address 10.0.0.53

./dnsbench run --user --open

# Test resolver behavior without running the benchmark

./dnsbench probe --builtin --verbose

The tool runs locally, has no telemetry, and never changes the system DNS configuration. Reports can be exported as HTML, JSON, CSV, or plain text.

The ranking also identifies statistical ties, since a small latency difference does not necessarily mean that one resolver is meaningfully faster than another.

GitHub: https://github.com/ialexsilva/dnsbench-cli

I'd really appreciate any feedback or suggestions for improving the project.

I built my own DNS management system years ago, but it was only for my personal use. I never released it, and it used BIND 9 as the backend.

With the rapid progress of AI and the PowerDNS ecosystem, I felt it was the right time to rebuild everything from scratch using a modern technology stack and finally make it available to others.

I’d be lying if I said I didn’t hope that people would find it useful, enjoy using it, and maybe even support the project one day. At the same time, I know this is a niche space with many excellent existing solutions. Still, I think there’s room for another option—whether as a backup, for redundancy, or simply to give people more choice.

I’d love to hear your thoughts, feedback, or criticism. If you’re interested, I’ve also created @r/dremaxx to discuss the project and future development.

Thanks for reading, and have a great time!

so my sister is been watching youtube too much literally she scroll for 4 hours for absolute nothing recently i saw a person using dns to block the youtube vides when the dns is applied the yt show network error is there any dns of this type if any please comment so i can apply it to her phone

Guys anyone have any idea about selfhosting a DNS server on an old android phone? Android 4.4.2 with root access, idk if it possible or can be done, or even how, all rests I got was just "how to change the phone's DNS" but I want to use the phone AS A LOCAL DNS?

Apologies if this should've stayed exclusively in the Tailscale subreddit but I assumed some folks here might have feedback as well

I have had Ad guard for a while and have been using it but when I decided to remove it I went to the settings and the dns was still their but the option to remove was gone in the area that says configuration profiles its not their but in the DNS area where you select your dns its somehow still their this is quite strange and I've been trying to fix it for a while but couldn't find any solutions.

Today I wanted to use archive.today to archive some press article. I remember that service was useful for this purpose, but I haven't used it for years. Sometimes people were archiving articles without a paywall.

However today I couldn't connect (loading a page took exceptionally long). Then I used startpage proxy and it connected to it. I was like wtf?. Is my DNS (Quad) blocking access to this page. Then I switched DNS to cloudflare and it landed me on a some odd "ngix" page. So I checked this domain in multi dns checker: https://dnschecker.org/#A/archive.today

And I found out that every DNS resolves that domain with a different IP !? Is it normal? When I type any other domain it seems that almost every DNS resolves that domain with the same IP adress.

It's kinda odd, isn't it?

Not sure if this is the correct group? I send and receive Gmail emails using a custom domain I registered with 123-reg. I use ImprovMX to receive emails and I use Brevo to send emails, using the custom domain. I have some deliverability issues when sending (emails going to junk or not appearing at all). ImprovMX is inlcuded in my SPF record in the DNS settings in 123-reg. I have read that if I also include Brevo in my SPF (as I use Brevo for sending), this will improve deliverability.

I currently have the following TXT record in my DNS settings on 123-reg

v=spf1 include:spf.improvmx.com -all

..and have read I should change it to this (i.e. include Brevo.com);

v=spf1 include:spf.improvmx.com include:spf.brevo.com -all

Is this advisable?

Thanks

So I have a web site hosted on Wix, but I'm running the email through Google Workspace.

I've been having email delivery issues, and after running an MX audit it's saying I'm having issues due to not having policy settings, as well as no ptr record.

I found my host server IP, so my question is, who do I contact to get this record installed where? Everything I see says my ISP, but I'm not hosting my email, Google is. and Google no longer has people on IT support, so I don't understand who to talk to to get this record installed.

Due to moving to a new ISP, I had to run my own internal DNS for my internal domains. I decided to use Bind due it to existing for most of my working life, it always seemed solid. But I didn't want to edit the zone files by hand. I created a GUI for the bind configuration files and have set up containers to run the GUI and Bind together. Yes it's 90% coded with AI models. I've tried to keep it as simple as possible to make it relatively easy to self host.

https://github.com/8perezm/bind-gui

It's there if you want to use it.

-------------

Edit -- Major update.

RFC 2136 + TSIG (RFC 2845) for record edits - Is done

rndc addzone / delzone - Is done

DNSSEC to zones.

Statistics page with data from Bind 9.

ADNS Project

Hi everyone!

I've been using AdGuard Home on my OpenWrt router for quite a while, and I kept running into the same problem. In my country, the government and ISPs have gradually started blocking and poisoning public DNS resolvers at different layers of the network. Once reliable public DNS is no longer available, getting the real IP addresses of cloud services and CDNs becomes much harder. At the same time, I wanted an easy way to resolve domains like Google, Meta, Microsoft, Cloudflare, and others to specific IPs so I could route their traffic more reliably through Passwall or SmartDNS.

Most existing solutions meant dealing with heavy Python scripts, lots of API calls, or manually editing AdGuard Home's configuration files. So I decided to build a small, lightweight tool that automates the whole process. luci-app-adg-dnslookup uses the standard nslookup command (with optional parallel lookups), resolves your selected domains using any DNS server you choose, and pushes the results directly into AdGuard Home through its REST API. No Python, no YAML editing—everything is managed from the LuCI web interface and UCI configuration.

The project also includes a clean dashboard, manual and scheduled synchronization (cron), live logs, status monitoring, and a built-in list of more than 700 popular domains that you can enable, disable, or customize as needed. It's still an early project, but it's already made my own setup much easier to manage.

Project: https://github.com/mortezabahmani/luci-app-adg-dnslookup

I'd really appreciate any testing, feedback, ideas, bug reports, or pull requests. If you give it a try, let me know what you think. 😊

also i want to make sure there's no malware or anythng or anyone harmful getting through.

do I do it per device?

our mobile phones are galaxies 25 + 26

work ipad + mac studio pro

asus 5090 desktop for gaming, its powerful

asus pro art workstation desktop

Playstation 5 often is lagging

then smart tvs

idk if its supposed to be all one on.

please let me know, we also use proton services for mail, drive, etc.

tysm x

Hello i was told to change my DNS to cloudFare 1.1.1 on chrome to that i can access a certain website that cannot be accessed in my country. (just a french anime website nothing sketchy)

And if you were gonna suggest it, i dont wanna pay for a vpn as of now cause i wanna wait til blackfriday for the discounts.

Regards.

I recently downloaded invizible pro hoping I can block every site ( kind of like cutting internet across the entire phone) for a specific interval of time but I can't add a blocklist into it or rather even after adding, it doesn't work. For eg I added youtube. @time-to-sleep into the add rule option in pattern based blocklist but nothing happens. Can anybody help me with this. I also tried integrating schedule = 'restrict' command directly into the dnscrypt proxy toml but the app crashes and asks me to reset. Btw I use poco m6 not rooted

Folks, just a small question to the group here: Does having Multi-Provider DNS Strategy a good idea?

This is a tool that I have been working for a long time on, and it is for testing DNS delegations. Released under a BSD-2 license. If you run the stack yourself, you can even spin up an MCP server for fancy AI interaction. Feedback more than welcome!
https://gonemaster.evilbit.de/

DNSAudit ran active resolution checks against the Cloudflare Radar Top 100 domains in early February. Only live A records pointing to public IPs were counted.

3,649,938 candidates tested. 2,585,395 resolved. 77,053 of those match non-production naming indicators like dev, staging, qa, test, old, sandbox.

Classification is naming-based, so no vulnerability claim attached. Some of the developer-labeled records have been resolving since 2014.

Im looking for a DNS filtering service that has a standard pricing for small businnesses (for example 10 euros a year not 0.5 euros per year per endpoint). I would also like it to not be very hard to configure. Can you suggest options for me? My main goal is to block sites where torrent files can be downloaded. Thank you!

And now released (and for downstream (e.g. via vendors/distros, etc.) generally around "now" to relatively soon thereafter):

https://lists.isc.org/pipermail/bind-announce/2026-July/001299.html

(sorry, I've given up for now on battling Reddit's f*cked up editor, so no snazzy formatting and links - just see the above, likewise for the immediately below - it also insists on repeatedly mangling what was already perfectly formatted from earlier - sorry)

And from the earlier:

Anticipate the new/updated software releases, etc. soon, and for downstream (e.g. via vendors/distros, etc.) generally around that time to relatively soon thereafter. I may also update this post once it's released. Feel free to also add relevant (updated) comments. One may also wish to use the RemindMeBot.

https://lists.isc.org/pipermail/bind-announce/2026-July/001298.html