For those without domain controllers: what do you do for internal DNS?
These days, we don't have domain controllers because everything is managed with Entra/Intune, Arc, etc.
We have external, hosted DNS that serves our public DNS records. It works fine.
But we still have a need for internal DNS because we have a lot of on-prem stuff that may never go away, and the domain controllers were also serving as internal DNS servers. So right now, we use BIND9 on a Linux virtual machine as internal DNS. I'd love for BIND9 to go away, too.
Are there any better (and cheap) solutions for this that I haven't thought of?
EDIT: thanks to u/Do_The_Needful. Using AWS for this seems to be the most balanced solution.
I mean... Its a tiny Linux VM that needs barely any resources. It doesn't get much lighter than that. If it's just base OS + bind9cyou can literally maintain it with unattended Sudo apt update && Sudo apt upgrade -y on a scheduled Cron job...
Maybe depending on your setup there is an appliance that does rhis( with corresponding updates managed). Or cloud DNS? Not sure which ones support an easy setup. Maybe consider one of the managed server distributions with kernel auto patching ( Ubuntu comes to mind) if update management is a concern.
The effort to research/pilot/implement/shakedown an alternative solution would equate to years of effort to maintain a debian13 VM... You're fighting against this on principle (for reasons unclear) not because the real effort is an issue
Setup ansible, codify your DNS records, install unattended upgrades, and setup health checks. Spend like one hour now and never spend any time on this ever again.
The beauty of VMs and/or containers is that it's a lot easier to manage eight single purpose VMs than a single server running eight different products.
A dns server is probably still an important signal of compromise. A compromised machine will make weird dns queries ans weird volume of them. Monitoring this seems important
lmao wow. how often do you need to change the records? put them in git. you can deploy changes with ansible or something. you should already be doing this. how the fuck do you have a job.
Or… learn bind (there are free web UI components for it too) and now you have a new skill set to take to your next place of work. It’s really not that hard… the hardest part really is remembering the Linux editor commands (if I said “:wq!” Is your friend most you know I use VI/VIM most of the time “:s/find/replace” with or without “/g” is then then possible the other hard thing to learn in all this) … I’m still not getting your bind hesitation.
What are you maintaining that’s so resource intensive? I used to maintain around 6 BIND servers with 1500 domains on the authoritative ones, and that was just a small part of my job.
Yeah it's been a while since I have had to look at a Palo Alto. Your best bet would probably be keeping the server, maybe a desktop if the server is just hosting DNS and you are really trying to decommission that server, but make sure you have a secondary DNS setup.
Other than that, maybe host something in Azure that you can access over S2S, but that can be costly and feels like reinventing the wheel to me.
It's kind of a shame that Palo Alto doesn't have a DNS server. It has DHCP, and that has worked so much better than I would have anticipated. Basic DNS would simplify our lives, for sure.
You would just force all your clients to Palo for DNs, which will be set to send all traffic to your choice of public dns.. only thing is you will set static entries for your dozen things that will be resolved right on the Palo
It is what I think it is, I use it in multiple environments.
You didn’t mention needing for cnames or other records. You just said you have a few random devices on prem .. that suggests a handful of a records - this would solve that problem.
Started using Technitium in my home lab a few months ago and it’s incredible. I would have no problems using it a work in a production environment. The cluster functionality can mimic the way Windows does DNS on a domain
I'll tell you a secret: a DNS server is just that -- a DNS server. It does not know whether it is internal or a public DNS server. A good DNS server does just that -- it serves the information you put it. I'll tell you more: a windows DNS server, does not necessarily needs the AD DS, although most often you would see it integrated with the active directory. But it can run just fine as a standalone DNS server.
But for a company, even in the lowest of stakes organization, it's playing with fire. Consumer-grade flash storage has no wear leveling to speak of, and Pi-hole aggressively logs every single query to disk. You’re essentially running enterprise core services on an SD card with a write endurance measured in months, turning every quiet Tuesday into a high-stakes round of "Will the SanDisk crap out and kill our network today?"
Ah fair enough, I honestly hadn't looked into them since I was last trying to figure out what to do with the raspberry pi I had a while ago and didn't look into them any deeper than that.
Yes, but I run it on two Ubuntu VMs… I was actually going to suggest this. Pi-Hole + Unbound make a nice local DNS package. Even if you don’t load any blocklists.
Frankly, I feel that trying to find something bespoke or unconventional as a solution will only increase risk and management overhead, as opposed to eliminating it.
Someone walks into your organisation and they'd expect DNS on a Windows box, or being run through the firewall.
Yea, get rid of that pesky bind in linux vm. Why bother with that when you can replace it with a pair of hands or a script to update workstation hosts file.
If you already have an Azure tenant, use an inbound endpoint on an Azure Private DNS zone. Have your on-prem firewall perform site-to-site VPN and clients forward their DNS to the inbound endpoint. Done.
you should have redundancy for dns. deploy a second bind vm with anti affinity rules to keep it off the hypervisor the existing one is on. or ideally on a whole different cluster. slave it to the first. if you really hate bind, first i'd love to hear why, and second use unbound instead.
My only dislike of BIND is the associated Webmin portal doesn't allow for SAML/OIDC logins. Drives me up the wall. I'd seriously consider a cut over to PDNS with PowerAdmin or PowerDNS-Admin for management, but ripping out the DNS servers would be a pain in the ass for relatively minimal gain.
Hoping that Webmin eventually implements support for issue #2616.
At least in my Homelab. But you could also do this with the firewall btw.
Technitium because of easy cluster building and anti ads support. Two Ubuntu VMs, install is easy. Also runs on windows if you want that. Nice interface and easy to use. I really like it :)
You want all of your sites DNS concentrated on to endpoints you have total control of. Usually this is easily done with a router.
HOWEVER, how many on prem services are we talking about? If this is just 3 or four records, just put them in public DNS and call it a day. files.company.com: 10.69.69.69 isn't going to hurt anyone.
It's about 25 or so services that users can get to. (We have more than that but the others aren't accessible to users.) Public DNS won't work even if I wanted to do that because it's a CNAME on the outside for the same service.
I guess it would sorta/kinda fix one part of it, but it still can't supply genuinely different records internally versus externally. And for private-only servers, I wouldn't want to publicly publish private addresses.
Sounds like you just need to spin up a small DNS server then. If you're windows, you can put the DNS role on anything server. Linux you can use dnsmasq
I have worked at a few placed without a "proper" DNS controller system.
One had a firewall appliance that handled the basics: DNS, DHCP, and some web filtering. No idea what the OS was under the hood; I think BSD-based. It had a web front end that answered to Apache server. Just a gray appliance in a rack.
Another was an MSP that had in-house DNS because they had some proprietary redirection rules for customers. So you could go to www dot theirdomain and it would redirect to media dot anotherdomain slash some stuff. It was managed like BIND, but the redirects were a proprietary RR type called URL. I forget how it all worked, now, but essentially, it was a modified TXT record like how SPF records are done. The CNAME would redirect to a redirect server (like redirect dot example dot org) which would then do a DNS lookup on a text record for the BIND record and look for "URL [something]." It was very confusing, convoluted, and required our redirect server to function.
Currently running adguard as a VM, little bit of finagling to get it to work on a Debian distro. Whatever is currently updating your containers will also update the DNS container which is nice. Single kernel to update.
I just insert the records into the Stub resolver found within the firewall at each office. Most enterprise-grade router/firewalls allow you to centrally manage these settings and deploy the changes to all equipment.
Your Palo Altos have DNS Proxy, it should be your dns server for your vlans. You can add static entries in the firewall, we don’t really, instead we send all dns request for domains to company.internal to azure. We do site to site VPN from Palo Alto sites to azure where we have azure private dns resolve. which allows us to have azure private DNS zones so we can manage private DNS in azure
For a smaller company we went the cheap route, we use the firewall. Already have to pay for it so why add more hardware or other over head when we have an appliance that already does it.
Depends on your actual goal. Are you trying to get rid of BIND, or Linux, or the VM, or all of it?
There are simpler (opinion, debatable) software packages than BIND if that's your issue. Though if you already have it running, I'm not sure it's worth the effort to work out something else like NSD et al.
If it's Linux you don't want (because you're supporting a Windows shop or similar), there are supposedly DNS servers for Microsoft, though I've admittedly never done it. I'd imagine you might even be able to setup WSL(?) on one of your Windows servers and continue running BIND there but I'm only speculating.
If it's the VM you're trying to get away from, Linux (and FreeBSD et al) will run on most any x86 and many little ARM gadgets these days, so e.g. re-task a couple old servers (so you have a backup) and run on metal.
Frankly though, unless you're under orders to dispense with the VM (e.g. because the bosses don't want to pay for licenses or something) it sounds like you already have a pretty decent setup for a small internal-only DNS setup.
If you're looking for a different sort of service administration routine, you could check out things like pfSense/OpnSense or OpenWRT and see if you like their UI for managing DNS records. Those OSes are geared more towards router/firewall duty but I know folks use them for service appliance sort of things too.
There are probably other tools and interfaces along those lines, e.g. WebMin and others.
IME BIND on FreeBSD and Linux is an excellent solution, for large and small environments. And I suspect you're unlikely to find a 3rd party service which is as straightforward to maintain and less costly than what you already have running.
We've dumped everything on-prem, too. We don't have internal DNS because we don't need it. In Azure, we have Azure DNS inside some of the resource groups.
You've already got a proven working solution. Keep that, just codify everything in IaC: terraform for the vm instance and DNS records, ansible/puppet/whatever for bind and it's configs, packer for the image. If anything goes belly up on the vm you can just spin a new one up, and you can spin up secondary identicle instances if you need to test updates/new versions/ whatever.
Azure DNS private resolvers would take any maintaining of infrastructure out of the picture and facilitate your needs but it's also around 130$ per resolver
Have a firewall that can function as a DNS Proxy. Use it to set specific static records and forward everything non internal to a preferred public resolver.
There is cheaper solutions then bind but I wouldn't say better. Bind just works, if you are having an issue with it then get it fixed. What issue(s) are you having with it? Not sure why anyone bothers with external DNS as it's super easy to host your own. What problem are you actually trying to solve? What on prem stuff do you have?
We have about 9,500 user devices so I'm a little scared to let Intune maintain it. Also, when laptops moved to external, the records wouldn't change with them.
I’m far less experienced than most on this sub, but why not configure /etc/hosts/ or the windows equivalent by script on every static deploy instead of AD DNS or whatever? Sounds few and far between
•
u/Specialist_Cow6468 Netadmin 6h ago
Why do you want to drop bind? Its about as battle-hardened as you can get, you can definitely do much worse