Ron Nutter helps a reader who wants to know if he can avoid running DNS servers on his network
I was reading your article about the number of DNS servers you need when handling mail and Web hosting. My question goes the other way: We don’t allow (or want to allow) any outside access to anything on our network. Do I need to run DNS on my network at all? Currently the users are set to point to our ISP’s DNS servers for Internet access. Our only server on the network is Windows 2003 SBS. Can I disable DNS? I feel that it is causing me more problems than it should. I get errors filling my logs telling me that the DNS server is having issues with the MX and A records (we aren’t hosting any mail here, so the MX record error makes sense) Can you make sense of all of this? I would appreciate any feedback you could send me.
Eric Murphy
While it would be ideal to not have local DNS servers on your network, with Windows 2003, you really don’t have a choice. With the way Microsoft has integrated DNS into its network communications with a few extensions, you need to have DNS running on at least one server for things to run correctly. Think of DNS for a Microsoft network being like a telephone book for your local phone company. You need the DNS server in order for everyone on your network to be able to find the services and or systems they are looking for. So while you don’t need it for outside systems to be able to find resources on your network, you need it for users on your network.
Here is another reason why you want DNS services running on your network: Anything you do that involves finding a Web site or mail server not on your network means each workstation has to potentially make its own inquiry to a DNS server off your network to find what it is looking for. With everyone making inquiries on their own, this means duplicate traffic potentially looking for the same information. By allowing your “internal” DNS server to cache or retain the information gathered by previous attempts to find the same information means repeated attempts will be accomplished sooner and leave more of your bandwidth available for other uses. The easy way to this is to configure the DNS service on your Windows 2003 server to forward requests it can’t resolve to specific DNS servers, most likely those operated by the ISP you are using to connect to the Internet.
As to the MX and A record errors, go ahead and put entries for your mail server in the local DNS setup. It won’t hurt for it to be there. Putting the records there should stop those errors. Depending on what other services you may end up running, this could end up being needed by a future service that is integrated with DNS for some of its functionality.
