On 5/8/22 5:58 AM, Tony Finch wrote:
Regarding anycast, it isn't necessary for internal authoritative servers unless your organization is really huge (and probably not even then): it is simpler to just use the DNS's standard reliabilty features. All you need to do is have more than one authoritative server for each zone.
I don't know if it's a requirement for the OP or not, but Windows used to reach out to the MName server to perform dynamic updates. So there might be some merit to the name of the MName server to be a pseudo name that resolves to an anycasted address, thus clients try to perform the dynamic update to the closest instance of the anycast / (pseudo) MName server.
Aside: Years ago, BIND secondaries would happily forward such dynamic updates the real primary MName server.
Further aside: The last time I looked, MS-DNS ADI zones would forge the local server's name as the MName to cause this type of client redirection.
On the other hand, anycast is a good way to improve the availability and maintainability of your resolvers, because your users' devices talk directly to them, and if they don't work there might as well not be an Internet connection.
I agree that anycasted service points make administration somewhat simpler. However I do question the /need/ for such flexibility when things like DHCP are likely used for client configuration and can therefor manage most things automatically.
-- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
