1

I'm thinking about implementing more local stuff for performance, internet usage and also privacy. I like the idea of not having to rely on Google's 8.8.8.8 and 8.8.4.4 for my own DNS services (both for performance and privacy) and I like the idea of having a local mirror for my debian updates for my 40+ machines here instead... Back to the question: Many articles talk about having a Master and Slave server for DNS (BIND9) but I only really want one caching server or forwarding server.

Also trying to figure out my best option, forwarding or caching? Caching seems to make the most sense but they're both so similar...

The setup doesn't seem too difficult, but the choices are a bit confusing. See here and here, they've both left me a bit confused as to whether I need a Master and Slave or simply one independent server. Thanks all.

2

I'm a bit confused as to whether I need a Master and Slave or simply one independent server.

Having just a single name server is a perfectly workable solution and is a fine option in some cases. That said, maintaining two (or more) name servers is a far more common practice.

The primary advantage of having multiple name servers is availability. Particularly, it covers redundancy (i.e. what if a name server is offline?) and potential performance improvements from splitting up the work of handling DNS requests.

Do note, however, that keeping up two nameservers requires zone transfers (DNS database replication). While usually quick and automatic, this does add one more layer to the configuration and management of your servers.

I am also trying to figure out my best option, forwarding or caching?

Forwarding servers are likely quicker (and possibly perform better generally) as they don't resolve (most) requests themselves. But that's their primary weakness as well. They pass along data to a third-party and if their external resolver is unavailable, they can't serve external requests at all.

Caching servers, on the other hand, don't have this issue. They are relatively robust and self-contained. This gives you more privacy and moves you away from third-party DNS e.g. Google (which seems desirable to you). They arguably require slightly more configuration from a security standpoint, but likely not much. They may or may not perform as well as a forwarding server but that would depend greatly on your traffic.

  • THANK YOU for actually answering the question, sometimes a rarity about services nobody knows about but claims to know about. Thanks Anaksunaman, you wouldn't happen to know of any security flaws with DNS Caching servers would you? – Tmanok Feb 14 '18 at 8:22
  • 1
    You're welcome and thank you. =) Regarding security, the basic issue with Caching configurations is that the resolution process can be exploited to cause problems by malicious third parties. This most often takes the form of things such as cache poisoning (which can spread to other DNS servers) or DNS amplification attacks (which are a type of distributed denial of service [DDoS] attack). Many of the security issues of a Caching configuration can be negated with proper access control lists (ACLs) to limit recursion (looking up domains) to local clients only and keeping your software updated. – Anaksunaman Feb 14 '18 at 9:34
  • 1
    That said, there are definitely more topics and more steps to take if you want to be vigilant about your security. If you want an extremely bare-bones overview of some of the security issues involved, you might want to look at this article. It also helps to keep in mind that publicly available servers used for providing DNS services for externally accessible domains (authoritative name servers) probably need a bit more scrutiny than those that perhaps provide only local domain names, regardless of recursion. – Anaksunaman Feb 14 '18 at 9:43
  • 1
    It would depend entirely on the servers you chose, I'd say. Performance wise, it would most likely come down to geographic location (how close are they to you?), infrastructure (is their equipment actually better than yours?) and cache size (how many requests do they serve?). Cache size is the most likely area I see where there might be an advantage. But if they are servicing a bunch of request that aren't cached (you aren't visiting a lot of sites others are), then that advantage is diminished. Equipment is a real tossup and you can never get geographically closer than where you are now. – Anaksunaman Feb 16 '18 at 2:22
  • 1
    From a privacy point of view, its a matter of trust. I would imagine that many of those providers are not Google -- but that's not guaranteed. You might also consider safety concerns -- you are arguably relying on them to keep their servers safe (or safer than you can keep your own), which may or may not be a reasonable expectation. I am not saying any service on that list is "bad" (and being smaller might even prevent some targeted mischief) but it's probably as much of a gamble as using any other third-party provider. – Anaksunaman Feb 16 '18 at 2:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.