On 16/12/2015 14:52, Rich Freeman wrote: > On Wed, Dec 16, 2015 at 4:26 AM, Alan McKinnon <alan.mckin...@gmail.com> > wrote: >> >> Solution: obey best practice. Never run auth and cache on the same >> address. On the same machine is fine, they are different daemons. >> > > Which one listens on port 53?
I think you answered too quickly. The answer in in the phrase "same address" and the following sentence which logically follows on. Also, how do you point the caching > daemon at the authoritative daemon for internal servers/domains/etc? > My authoritative server for doubleclick.net is not the same as the one > you'll find in the .net servers. Also, for the domains I use > internally the DNS server and resolution is different within my LAN > from what you'd see on the internet. I know that at my employer > internal DNS resolution is not the same as what you'd find outside the > organization, so this isn't an issue unique to small setups. > > One of the reasons I run auth and cache on the same host is that it > greatly simplifies dependencies. If I want to run them on separate > containers then they'll either need static addresses, or need to use > DHCP, which means the DHCP server has a potential circular dependency > with the DNS servers. Plus most of my containers are going to need > DNS so these containers need to be running before other containers get > started. > > For a large-scale datacenter the separated approach makes a lot of > sense. If you're running 5000 hosts having two (or likely 10 counting > various backups/etc) that you start first isn't a big deal, and > neither is dedicating a bit of hardware to DNS/DHCP. If you're > running all your services on one host, it can get a bit messy when you > start having multiple DNS servers all running on different IPs on the > same host. It can of course still be done. > > I just use BIND for both. It isn't the best solution, but it is adequate. > -- Alan McKinnon alan.mckin...@gmail.com
