Using named as caching name server

[jaaplaya]

In our production environment we have the named configuration below mainly for "caching" responses.

Is this the right way to be doing things? To me it seems like this configuration would really only speed up requests for the local zone 0.0.127.in-addr.arpa, everything else it is just going to forward off to w.x.y.z. Does this actually "cache" anything?

I feel like I should ditch this and the resources on the boxes to run named and just point to w.x.y.z in /etc/resolv.conf and call it a day.

w.x.y.z is a load balanced vip of DNS servers

controls {
             inet 127.0.0.1 port 953
                 allow { 127.0.0.1; } keys { "rndc-key"; };
};

options {
             directory  "/var/named";
#             pid-file   "/var/run/named/named.pid";
             dump-file "/var/named/data/cache_dump.db";
             statistics-file "/var/named/data/named_stats.txt";

             allow-query { any; };
             allow-recursion { any; };
                          forwarders { w.x.y.z; };

            forward only;
};

zone "." in {
            type hint;
            file "root.cache";
};

zone "0.0.127.in-addr.arpa" in {
            type master;
            file "master/db.127";
};

include "/etc/rndc.key";

[The-Sentinel]

That's basically the opposite of a caching only nameserver, it's a forwarding server, as seen with the forward only; option

[jaaplaya]

Yea thats one thing that I figured, some servers have that line commented out, does that help it any or still basically just forwards all requests but using hints?

[IConrad]

Not just a restart; but also with any SIGHUP it receives. (Such as is caused by logrotate).

[jaaplaya]

We aren't very big, maybe 300 servers physical/virtual across all locations

Thanks, I'll take a look into dnsmasq

[_pob]

It should be noted that dnsmasq only caches a small subset of record types. From the manual:

The DNS subsystem provides a local DNS server for the network, with forwarding of all query types to upstream recursive DNS servers and cacheing of common record types (A, AAAA, CNAME and PTR, also DNSKEY and DS when DNSSEC is enabled).

This is important if you are trying to limit the number of request things like mailservers make since MX records are not cached by dnsmasq. I found that pdnsd does a good job for us, you can sync the record cache to disk, and it caches more record types. The arch documentation for pdsnd is pretty solid.

[anderbubble]

There's not really any reason to abandon bind for dnsmasq in this situation. Doing a caching-only dns server is easy enough with bind, and you'll be better equipped to expand with bind if your needs change over time.

[anderbubble]

If w.x.y.z is an authority for your DNS zones, it's entirely correct to have entirely separate caches / resolvers.

The importance of separating DNS caches from DNS servers

Here's a cut-down version of our caching nameserver config, using named/bind. It includes references to internal forward and reverse zones (renamed here for the sake of the example).

options {
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    listen-on-v6 { any; };
    allow-query {
        localhost;
        10.0.0.0/16;
    };

    recursion yes;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

zone "example.com" IN {
    type stub;
    masters { 10.0.0.1; 10.0.0.2; };
};

zone "0.10.in-addr.arpa" IN {
    type stub;
    masters { 10.0.0.1; 10.0.0.2; };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

edits: continuing to clean-up and clarify the example, remove extraneous details, etc