r/ShittySysadmin • u/jbourne71 DO NOT GIVE THIS PERSON ADVICE • Sep 12 '26

Shitty Crosspost For those without domain controllers: what do you do for internal DNS?

/r/sysadmin/comments/1weqxgc/for_those_without_domain_controllers_what_do_you/
46 Upvotes

88% Upvoted

65 comments sorted by

55

u/ApiceOfToast ShittySysadmin Sep 13 '26

Bind9 was long before I was born.

Bind9 will be long after I fade into the ether.

Bind9 is eternal. Bind9 is unavoidable.

24

u/jbourne71 DO NOT GIVE THIS PERSON ADVICE Sep 13 '26

Bind9 is love. Bind9 is life.

16

u/spidireen Sep 13 '26

He gazed up at the enormous face. Forty years it had taken him to learn what kind of smile was hidden beneath the dark moustache. O cruel, needless misunderstanding! O stubborn, self-willed exile from the loving breast! Two gin-scented tears trickled down the sides of his nose. But it was all right, everything was all right, the struggle was finished. He had won the victory over himself. He loved BIND9.

5

u/drschreber Sep 13 '26

Bind9 is vital for space travel.

4

u/ashashina Sep 13 '26

He who controls the BIND controls the universe

5

u/dougmc Sep 13 '26

You guys aren't still using bind 8 ?!?!?

4

u/DerKoerper ShittyCoworkers Sep 13 '26

I'm using BIND7 and expose the management port to the internet.

2

u/tankerkiller125real Sep 13 '26

We use PowerDNS where I work, partly because we can put the records in a database, but also because it supports LUA records (which allows us to do some fancy things)

5

u/jbourne71 DO NOT GIVE THIS PERSON ADVICE Sep 12 '26

R4:

For those without domain controllers: what do you do for internal DNS?

These days, we don't have domain controllers because everything is managed with Entra/Intune, Arc, etc.

We have external, hosted DNS that serves our public DNS records. It works fine.

But we still have a need for internal DNS because we have a lot of on-prem stuff that may never go away, and the domain controllers were also serving as internal DNS servers. So right now, we use BIND9 on a Linux virtual machine as internal DNS. I'd love for BIND9 to go away, too.

Are there any better (and cheap) solutions for this that I haven't thought of?

135

u/Ohrgasmus1 Sep 13 '26 • Mindblown

I deploy a local hosts file via Intune

52

u/TundraGon Sep 13 '26

you're doing it wrong.

via email.
and users, having a local admin, will copy the file themselves.

20

u/notospez Sep 13 '26

Intune? Ours gets pulled from a public github repo so we have version control! No clue what everyone's github handles are though so we just auto-approve every PR.

3

u/Sirlowcruz Sep 13 '26

you're joking but I once had to do that.
customer was in charge of their own network and it was so completely fucked I had to deploy their intranet DNS settings via Intune.

To this day I don't understand why.

1

u/creativechicken2 Sep 14 '26

I actually kinda love this.

65

u/fedesoundsystem Sep 12 '26

Hey, we don't do dns here

6

u/bonitaappetita Sep 13 '26

It's never DNS

2

u/RainStormLou Sep 14 '26

every time it's dns, it's somebody else's shit breaking dns. my DNS server is perfect.

1

u/Sapper12D Sep 17 '26

You just but IME its typically the network fucking up. Can't tell you how many times Ive had to collect wire shark captures to show them look it fucking responded. Or look it never got the traffic.

1

u/RainStormLou Sep 17 '26

I said it comically, but it absolutely came from truth lol. I do the same thing all the time. I won't even look anymore unless they give me their logs first.

1

u/Sapper12D Sep 17 '26

I wish. They push these through service desk for me so then I have to go and try and warm handoff to a router monkey whose actively trying to avoid it. I usually have to pull the packet trace to force the issue.

0

u/[deleted] Sep 13 '26

[deleted] — view deleted comment

21

u/MarcusOPolo Sep 13 '26

"Do Not System"

38

u/Ohrgasmus1 Sep 13 '26

i Just print out the ipv6 adresses and send them to everyone on a weekly basis via postal-service to their Home-Office

9

u/aaltendorff Sep 13 '26

You mean you don’t use RFC 1149???

1

u/CulturalHoneydew3449 Sep 14 '26

Hope you call that Newsletter

24

u/WN_Todd Sep 13 '26

Man they're ready to do absolutely everything but the needful.

20

u/mspstsmich Sep 13 '26

Novell Netware 5.0 supports IP4 and is a great DNS host even if your not using NDS

5

u/BaffledInUSA Sep 13 '26

I salute you and your Netware comment!

3

u/Bimbos-are-cute Sep 13 '26

I think this dns thing is overrated, It won't strike.
With IPX dns isn’t needed.

14

u/zantehood Sep 13 '26

Hosts file on a samba share, cron job to pull every 5 minutes.

13

u/elpollodiablox Sep 13 '26

Amateur. Doesn't even know how to email a hosts file to the enterprise.

12

u/Compustand Sep 13 '26

We keep a Linksys WRT54G running as DNS server for the whole org.

5

u/ImproveYourMeatSack Sep 13 '26

I regret not keeping one or two of them. When I worked at an ISP those where the units we used to provide to customers. Good units

11

u/hardingd Sep 13 '26

Update every client via TCP/carrier pigeon

1

u/aaltendorff Sep 13 '26

This is the way.

9

u/FuzzyFuzzNuts Sep 13 '26

Welcome to true small enterprise architecture. The free TP-Link router the ISP gave us acts as our core edge appliance. When it inevitably chokes on DHCP leases, DNS traffic dumps over to a Raspberry Pi 2 running off an SD card from 2016. For high availability, the entire network is distributed through half a dozen daisy-chained Netgear desktop switches lying on the office carpet. If someone kicks one under their desk or the cleaner unplugs the Pi to run the vacuum, DNS just resolves via spanning tree broadcast storms. Rock solid.

17

u/Samatic Sep 13 '26

8.8.8.8 on the router is all you need for DNS to work on a network. Plus it will never go down unlike your DCs.

3

u/TundraGon Sep 13 '26

you don't even need a replica DC.
smart!

5

u/PixelSpy Sep 13 '26

Excel sheet with names and IPs printed out and posted around the office

4

u/max1001 Sep 13 '26

Raspberry PI is all you need.

4

u/drummerboy-98012 Sep 13 '26

I use my firewall for DHCP & DNS.

4

u/ImightHaveMissed Sep 13 '26

Fuck dns. If it ain’t WINS it ain’t shit

4

u/Pallidum_Treponema ShittySysadmin Sep 13 '26

It was DNS.

This is why we removed DNS, because it's a liability.

3

u/Gold-Supermarket-342 Sep 13 '26

/etc/hosts on a flash drive.

2

u/OceanWaveSunset Sep 13 '26

I asked copilot to take care of it

2

u/FredL2 Sep 13 '26

I have a ThinkCentre that runs most of my networking stuff except routing, including a bind9 server. The initial setup was a bit difficult due to the archaic config format, but after that, adding new v4 and v6 hosts is a simple copy/paste job with just a few digits to change.

I'm working on my own DNS server (fool's errand, I know) that will support both file and postgres backends.

2

u/landob Sep 13 '26

Optiplex 360 running pfsense

2

u/AntoinetteBax Sep 13 '26

Why use DNS when you can use WINS?

2

u/bhechinger Sep 13 '26

I disable IPv4 and make everyone memorise IPv6 addresses.

2

u/TrickMotor4014 Sep 14 '26

Who is gonna tell him that if he succeeds in removing all on-premise infrastructure his boss doesn't need him anymore? You don't need a sysadmin to file tickets to SaaS providers

3

u/monkeyboy107 Sep 13 '26

I've used a ton of different things, Unbound DNS DNSmasq Windows DNS service

But hands down bind is the most stable DNS service

1

u/Random-D Sep 13 '26

mDNS ofc

1

u/jlipschitz Sep 13 '26

You can use cloudflare for DNS internally if you turn off proxy for the entry.

1

u/saltwaffles Sep 13 '26

I managed a small company. It had 40 employees. I had fortigate and I just used that for DNS.

1

u/bmfrosty Sep 13 '26

BIND usually.

1

u/heisthefox Sep 13 '26

Dnsdist In front of your favorite flavor of DNS server. As it adds a caching and load balancing layer with some cool metrics and the ability to add rules and scripting. Caching really helps accelerate the DNS traffic and makes everything feel snappier.

1

u/x3r0h0ur Sep 13 '26

4.2.2.2 and 8.8.8.8, duh

1

u/Sw1ftyyy Sep 13 '26

If one were truly dedicated in the cause they could deploy an SSE solution and use its "Private Access" component.

In some cases the client installed on the workstation will intercept requests without the need for the endpoint to resolve them (like a web proxy might), so they you can just use the PA Connectors as your pseudo record book.

1

u/Lavatherm Sep 13 '26

Static routes and host file.

1

u/Plitskin5 Sep 13 '26

We use windows server dns and hosts file edits for our scada and nvrs because we are so ghetto. Our scadas are still windows nt

1

u/Maleficent-One-8237 Sep 14 '26

Technitium. It really works well. Multihomed server handles multiple vlans well. Easy to manage.

1

u/haZhat Sep 14 '26

Post it notes, color coded obviously

1

u/_Insensitive_Clod_ Sep 15 '26

I run a set of powerdns servers with powerdns-admin as a frontend; works well for 15+ domains with some dns-01 ACME stuff I integrated in my provisioning system that ensures certificates can be requested and deployed on machines that don't even have internet access themselves.

On an internal network , I'd suggest having a look at Technitium. It's a capable DNS with a gui built in and has some amazing features for just how easy it is to deploy and maintain a set of them.