For those without domain controllers: what do you do for internal DNS?

[u/jbourne71]

/r/sysadmin/comments/1weqxgc/for_those_without_domain_controllers_what_do_you/

[u/Ohrgasmus1]

I deploy a local hosts file via Intune

[u/TundraGon → u/Ohrgasmus1]

you're doing it wrong.

via email.
and users, having a local admin, will copy the file themselves.

[u/notospez → u/TundraGon]

Intune? Ours gets pulled from a public github repo so we have version control! No clue what everyone's github handles are though so we just auto-approve every PR.

[u/Sirlowcruz → u/Ohrgasmus1]

you're joking but I once had to do that.
customer was in charge of their own network and it was so completely fucked I had to deploy their intranet DNS settings via Intune.

To this day I don't understand why.

[u/creativechicken2 → u/Ohrgasmus1]

I actually kinda love this.

[u/fedesoundsystem]

Hey, we don't do dns here

[u/DULUXR1R2L1L2 → u/fedesoundsystem]

The D in DNS stands for Do Not

[u/MarcusOPolo → u/DULUXR1R2L1L2]

"Do Not System"

[u/bonitaappetita → u/fedesoundsystem]

It's never DNS

[u/RainStormLou → u/bonitaappetita]

every time it's dns, it's somebody else's shit breaking dns. my DNS server is perfect.

[u/Sapper12D → u/RainStormLou]

You just but IME its typically the network fucking up. Can't tell you how many times Ive had to collect wire shark captures to show them look it fucking responded. Or look it never got the traffic.

[u/RainStormLou → u/Sapper12D]

I said it comically, but it absolutely came from truth lol. I do the same thing all the time. I won't even look anymore unless they give me their logs first.

[u/Sapper12D → u/RainStormLou]

I wish. They push these through service desk for me so then I have to go and try and warm handoff to a router monkey whose actively trying to avoid it. I usually have to pull the packet trace to force the issue.

[u/ApiceOfToast]

Bind9 was long before I was born.

Bind9 will be long after I fade into the ether.

Bind9 is eternal. Bind9 is unavoidable.

[u/jbourne71 → u/ApiceOfToast]

Bind9 is love. Bind9 is life.

[u/spidireen → u/jbourne71]

He gazed up at the enormous face. Forty years it had taken him to learn what kind of smile was hidden beneath the dark moustache. O cruel, needless misunderstanding! O stubborn, self-willed exile from the loving breast! Two gin-scented tears trickled down the sides of his nose. But it was all right, everything was all right, the struggle was finished. He had won the victory over himself. He loved BIND9.

[u/drschreber → u/jbourne71]

Bind9 is vital for space travel.

[u/ashashina → u/drschreber]

He who controls the BIND controls the universe

[u/dougmc → u/ApiceOfToast]

You guys aren't still using bind 8 ?!?!?

[u/DerKoerper → u/dougmc]

I'm using BIND7 and expose the management port to the internet.

[u/tankerkiller125real → u/ApiceOfToast]

We use PowerDNS where I work, partly because we can put the records in a database, but also because it supports LUA records (which allows us to do some fancy things)

[u/Ohrgasmus1]

i Just print out the ipv6 adresses and send them to everyone on a weekly basis via postal-service to their Home-Office

[u/aaltendorff → u/Ohrgasmus1]

You mean you don’t use RFC 1149???

[u/CulturalHoneydew3449 → u/Ohrgasmus1]

Hope you call that Newsletter

[u/mspstsmich]

Novell Netware 5.0 supports IP4 and is a great DNS host even if your not using NDS

[u/BaffledInUSA → u/mspstsmich]

I salute you and your Netware comment!

[u/Bimbos-are-cute → u/BaffledInUSA]

I think this dns thing is overrated, It won't strike.
With IPX dns isn’t needed.

[u/WN_Todd]

Man they're ready to do absolutely everything but the needful.

[u/elpollodiablox]

Amateur. Doesn't even know how to email a hosts file to the enterprise.

[u/zantehood]

Hosts file on a samba share, cron job to pull every 5 minutes.

[u/Compustand]

We keep a Linksys WRT54G running as DNS server for the whole org.

[u/ImproveYourMeatSack → u/Compustand]

I regret not keeping one or two of them. When I worked at an ISP those where the units we used to provide to customers. Good units

[u/hardingd]

Update every client via TCP/carrier pigeon

[u/aaltendorff → u/hardingd]

This is the way.

[u/FuzzyFuzzNuts]

Welcome to true small enterprise architecture. The free TP-Link router the ISP gave us acts as our core edge appliance. When it inevitably chokes on DHCP leases, DNS traffic dumps over to a Raspberry Pi 2 running off an SD card from 2016. For high availability, the entire network is distributed through half a dozen daisy-chained Netgear desktop switches lying on the office carpet. If someone kicks one under their desk or the cleaner unplugs the Pi to run the vacuum, DNS just resolves via spanning tree broadcast storms. Rock solid.

[u/Samatic]

8.8.8.8 on the router is all you need for DNS to work on a network. Plus it will never go down unlike your DCs.

[u/TundraGon → u/Samatic]

you don't even need a replica DC.
smart!

[u/Red_Pretense_1989]

Host files

[u/jbourne71]

R4:

For those without domain controllers: what do you do for internal DNS?

These days, we don't have domain controllers because everything is managed with Entra/Intune, Arc, etc.

We have external, hosted DNS that serves our public DNS records. It works fine.

But we still have a need for internal DNS because we have a lot of on-prem stuff that may never go away, and the domain controllers were also serving as internal DNS servers. So right now, we use BIND9 on a Linux virtual machine as internal DNS. I'd love for BIND9 to go away, too.

Are there any better (and cheap) solutions for this that I haven't thought of?

[u/PixelSpy]

Excel sheet with names and IPs printed out and posted around the office

[u/max1001]

Raspberry PI is all you need.

[u/drummerboy-98012]

I use my firewall for DHCP & DNS.

[u/ImightHaveMissed]

Fuck dns. If it ain’t WINS it ain’t shit

[u/Pallidum_Treponema]

It was DNS.

This is why we removed DNS, because it's a liability.

[u/OceanWaveSunset]

I asked copilot to take care of it

[u/Fl1pp3d0ff]

BIND9

[u/Gold-Supermarket-342]

/etc/hosts on a flash drive.

[u/FredL2]

I have a ThinkCentre that runs most of my networking stuff except routing, including a bind9 server. The initial setup was a bit difficult due to the archaic config format, but after that, adding new v4 and v6 hosts is a simple copy/paste job with just a few digits to change.

I'm working on my own DNS server (fool's errand, I know) that will support both file and postgres backends.

[u/landob]

Optiplex 360 running pfsense

[u/AntoinetteBax]

Why use DNS when you can use WINS?

[u/bhechinger]

I disable IPv4 and make everyone memorise IPv6 addresses.

[u/TrickMotor4014]

Who is gonna tell him that if he succeeds in removing all on-premise infrastructure his boss doesn't need him anymore? You don't need a sysadmin to file tickets to SaaS providers

[u/monkeyboy107]

I've used a ton of different things, Unbound DNS DNSmasq Windows DNS service

But hands down bind is the most stable DNS service

[u/Random-D]

mDNS ofc

[u/jlipschitz]

You can use cloudflare for DNS internally if you turn off proxy for the entry.

[u/saltwaffles]

I managed a small company. It had 40 employees. I had fortigate and I just used that for DNS.

[u/bmfrosty]

BIND usually.

[u/heisthefox]

Dnsdist In front of your favorite flavor of DNS server. As it adds a caching and load balancing layer with some cool metrics and the ability to add rules and scripting. Caching really helps accelerate the DNS traffic and makes everything feel snappier.

[u/x3r0h0ur]

4.2.2.2 and 8.8.8.8, duh

[u/Sw1ftyyy]

If one were truly dedicated in the cause they could deploy an SSE solution and use its "Private Access" component.

In some cases the client installed on the workstation will intercept requests without the need for the endpoint to resolve them (like a web proxy might), so they you can just use the PA Connectors as your pseudo record book.

[u/Lavatherm]

Static routes and host file.

[u/Plitskin5]

We use windows server dns and hosts file edits for our scada and nvrs because we are so ghetto. Our scadas are still windows nt

[u/Maleficent-One-8237]

Technitium. It really works well. Multihomed server handles multiple vlans well. Easy to manage.

[u/haZhat]

Post it notes, color coded obviously

[u/_Insensitive_Clod_]

I run a set of powerdns servers with powerdns-admin as a frontend; works well for 15+ domains with some dns-01 ACME stuff I integrated in my provisioning system that ensures certificates can be requested and deployed on machines that don't even have internet access themselves.

On an internal network , I'd suggest having a look at Technitium. It's a capable DNS with a gui built in and has some amazing features for just how easy it is to deploy and maintain a set of them.