Re: DNS Best Practices Question

Richard-

> When a DNS request comes in we have it forward from internal interface to 
> external interface. The external DNS servers then sends the request to one 
> of three main DNS servers at our ISP

I would allow your external DNS to perform root DNS queries.  This could 
significantly speed up the process, (depending on the load of your ISP) and 
allow you more control over your networks' reliability.  DNS queries are 
not intensive tasks and any box you place on the "outside" of your network 
would be able to do this on a large scale without performance issues for up 
to 3000 nodes.  I would make this a caching only server and obviously would 
not host your company's DNS records outside of the firewall, but a 
caching-only server would work great in this config as long as it is 
hardened.  If you wanted more reliability, you could place another server 
next to the existing one or tier a caching server "inside" each protected 
network.

I would recommend finding a way to move this external box behind a firewall 
of some kind if possible... from a security best practices perspective...

Just a few thoughts...


Dan Swanson
dan@as.net

A consultant is a person who borrows your watch, tells you what time it is, 
pockets the watch, and sends you a bill for it. - Unknown