How to Mitigate the Risks of DIY Authoritative DNS

While many network administrators outsource the management of their authoritative Domain Name System (DNS) infrastructure to third parties, such as IBM® NS1 Connect®, there is also a significant community of network operators who prefer to research and build something themselves.

These Do It Yourself (DIY) authoritative DNS architectures can be put together through a variety of tools. BIND is most often used as an open source tool for internal DNS management, but some people also extend BIND to external authoritative DNS. Other companies build on top of the Microsoft DNS infrastructure using their own scripts and other tools.

The main reason to use a DIY system for authoritative DNS is control. Or, even if a third party provides authoritative DNS, you may have a funky and unusual network setup that naturally requires a number of customizations.

DIY Authoritative DNS Challenges

Although everyone has their reasons for adopting a DIY system for authoritative DNS, there are some distinct drawbacks to consider.

• DIY systems are fragile.: If your authoritative DNS infrastructure is built on BIND or Microsoft, you’ve probably put together a Rube Goldberg script system to make it work. Over time, the complexity of those scripts can become difficult to maintain as new features and operational requirements are taken into account. One wrong move (a single coding error) can easily bring down your entire authoritative DNS infrastructure and take customer-facing sites offline.
• It takes a lot of work to build and maintain.: It takes time to get up to speed on basic tools like BIND. You need to create and deploy a system. Then you ~ have to Maintaining this is no small task. This is especially true when dealing with mission-critical systems.
• The problem of getting hit by a bus: DIY construction only works as long as the person who built it stays with the company. When that person leaves the company, they are left with institutional knowledge of how the DIY architecture was built. Some companies reach a point where they are afraid to change anything because it could very easily lead to downtime incidents that are difficult to recover from.
• No automation support: DIY systems generally do not work with any form of automation. DIY architectures are typically not built to support standard automation platforms like Ansible or Terraform. It is nearly impossible to tweak DIY architecture using third-party tools. If you have a DIY authoritative DNS, you may need to change it manually.

All of these factors typically result in authoritative DNS management taking more time, energy, and resources than most network teams are willing to spend. DIY systems are often perceived as “free,” but they can end up costing you quite a bit of money. When these maintenance issues cause downtime, the impact on your business is much greater.

DIY System Backup

Using a DIY system for authoritative DNS without resilient, redundant backups is problematic. Finding the source of an error can be a nightmare, especially if you have a complex tangle of overlapping and interdependent scripts. may take few days Finding the source of the problem and getting the site back online is something most operations teams don’t have the luxury of doing, especially for eCommerce and SaaS sites that have a direct impact on revenue generation.

None of this means you should give up on DIY systems entirely. It just means you have to have a plan B if (or indeed when) things go wrong. Ideally, you would have a redundant solution that can make up the slack without impacting site performance. What should a redundant system include? We thought you’d never ask.

• separate infrastructure: Any redundant authoritative DNS systems should be completely separate from the existing infrastructure to reduce work on the primary system while finding the cause of technical failures.
• Real-time performance data: Metrics are also important in DIY backups to ensure everything fails over correctly and traffic is not interrupted. This is especially useful in the case of DDoS attacks to identify the source of the problem and rule out architectural causes.
• Health screenings: How do I know if the site is working the way I want it to? Should you fail over your site to a redundant architecture because performance will be compromised in some way? Health checks and alerts are needed to quickly detect and address service outages.

IBM NS1 Connect as DIY backup

No one should operate an authoritative DNS without a safety net. This is especially important if your website is your main revenue generator. That’s why NS1 Connect provides physically and logically separate systems for redundant authoritative DNS. We started offering Dedicated DNS as an add-on to our Managed DNS service, and now we’re offering it to customers who want to add an extra layer of redundancy to their existing architecture.

• separate infrastructure: NS1’s Dedicated DNS uses the same powerful architecture as its flagship managed DNS service, but is set up on a separate infrastructure unique to a single company. The highest level of downtime protection.
• Compatible with all basic products: Our dedicated DNS service can be used as a backup or secondary system for any kind of primary architecture. It is suitable for BIND-compatible authoritative name servers and DIY architectures. You can easily add a dedicated DNS service as a secondary service in your DIY setup. If disaster strikes, it’s up and running, ready to go at a moment’s notice.
• Real-time performance data: Our innovative DNS Insights feature can collect important data from any dedicated DNS setup. If the underlying system experiences an outage, this data can help you quickly pinpoint the cause of an external issue (such as a DDoS attack) that could have taken the system down. This can help you get back to your default system as quickly as possible.
• Health screenings: DNS can tell you a lot about the performance of your applications, services, and websites. NS1 Connect automatically delivers alerts when site performance is deprecated or returns no results at all. NS1 also uses health check data to trigger and route failover logic, helping prevent downtime. This kind of automation is not available in DIY systems.
• easy migration: NS1 Connect makes it simple to add a dedicated DNS as a secondary DNS for any system. The NS1 Connect user interface allows you to easily import zones and records into secondary systems using files from BIND and other architectures.

Critical infrastructure requires redundant layers

External authoritative DNS is one of the most important pieces of infrastructure in your network. This is so important that it requires the highest level of protection and assurance. DIY authoritative DNS gives administrators a lot of control before the complexity of overlapping scripts and tools becomes too much to support.

Even the most sophisticated and reliable authoritative DNS systems sometimes run into problems. Dedicated DNS for NS1 gives you the peace of mind you need to keep the lights on even when all your dashboard lights are blinking red.

Learn more about NS1-only DNS