Re: BIND

From: Bennett Todd (bet@rahul.net)
Date: 10/19/01


Date: Thu, 18 Oct 2001 23:28:19 -0400
From: Bennett Todd <bet@rahul.net>
To: focus-sun@anastrophe.com
Subject: Re: BIND
Message-ID: <20011018232819.B19071@rahul.net>


2001-10-18-18:13:01 focus-sun@anastrophe.com:
> Sort of in this vein, is anyone here using djbdns in a large ISP
> environment?

Haven't worked at a large ISP environment, but I've used djbdns in
several settings, very happily.

> I'd like to switch over to it, since I'm sick to death of BIND
> and it's continued bugginess/insecurity, but we host a couple of thousand
> customer domains, and I've not been able to find a real 'cookbook' for
> converting 'en masse'...

Conversion is [relatively] easy, for the most part; you set up new
nameservers, initially running data files produced by using axfr-get
to pull via AXFR from your BIND nameservers. Then you get people to
start testing the new nameservers. Once you're satisfied that the
data they're serving is cool, you shift the delegations and you're
done. Then you can start cleaning up the data.

The one thing that might involve more work is if you're doing huge
numbers of zones slaved off customer nameservers via on-demand
pushes; the notify stuff isn't implemented in djbdns, although other
folks have hacked it up in scripts built around djbdns.

The best is if you can ditch bind altogether, maintain all zone data
in tinydns-data format, replicating with rsync over ssh.

-Bennett






Relevant Pages

  • Re: DNS for machines in office?
    ... > I'm going to designate one machine running fedora as a name server. ... Nameservers are generally not that difficult ... ... BIND: this is the standard. ... wish I had heard of it when I originally set up djbdns! ...
    (comp.os.linux.networking)
  • Re: Bind 8 bug experience
    ... It's called djbdns, and it is ... proven secure, and proven reliable. ... Why worry about timelines for advisories or patches or updates concerning ... aware that there are alternatives to BIND. ...
    (Bugtraq)
  • Re: djbdns
    ... Note that even the BIND developers admitted that it is recommended to ... DJBDNS just forces you to do this:) ... > the caches have to be notified of any dns servers for domains that you host - ...
    (freebsd-isp)
  • Re: BIND: Lookup of CNAME records
    ... > running version 8.3.7-REL of BIND. ... > This setup (actually a replacement for just adding the two nameservers ... > nameservers directly (instead of the local nameserver) solved the ... > CNAME lookup problem. ...
    (freebsd-net)
  • Re: DNS Security (2)
    ... > however, by its design, djbdns looks much more robust from a security ... > future earnings, and while bind has a *much* larger installed base, ... > djbdns has had a *much* better record than any of the flavors of bind. ... it's a pain in the neck to encourage it to install ...
    (comp.os.linux.security)