Home / server / Questions / 341011
Accepted
tacos_tacos_tacos
Asked: 2011-12-15 12:26:48 +0800 CST

Downside of using public DNS in corporate network

  • 772

Is there any downside to using a public DNS service like Google's 8.8.8.8/8.8.4.4 for corporate network DNS service, as in making it the network connection's DNS server for an AD DC? It seems like if there was not a downside everyone would prefer an easy-to-remember and Googlific service instead of the hodgepodge of ISP specific ones.

domain-name-system active-directory google-public-dns

3 Answers

  1. Best Answer

    The big downside is that a lot of corporations run DNS zones that aren't publicly visible.

    A big one for this are AD DNS domains. Such domains are frequently based in TLDs that don't exist (yet) such as .company, the .local DNS domain, and non-public sub-domains like ad.us.example.com. If you have a domained machine, it'll need the ability to resolve these domains in order to work.

    Comapnies also tend to run split-DNS systems, where the inside servers have a different view of example.com than the public DNS servers. Some companies may have all of 9 externally resolvable addresses in a single domain but hundreds internally, which makes it feasable to hand-edit the few external-viewable resources in the internal-only DNS servers. peoplesoft-ha2.example.com may resolve internally, but not externally.

    And finally, many take advantage of sub-domains that aren't published to the Internet at large. Sub-domains like it.us.example.com, where the public example.com would have no glue records for the us. domain, but the internal DNS servers would have it.

    • 13

  2. Personally I like to run my own DNS servers. Mostly this is because of the reasons sysadmin1138 pointed out (we run split-horizon DNS, with lots of internal zones), but also because I like knowing that I'm not subject to any strange behavior that materializes on the internet (Think about your home ISP -- I bet when you go to http:/www.this.domain.doesnt.exist.com/ they try to give you a "helpful" page, which means their DNS is returning something other than NXDOMAIN for non-existent domains).

    If you don't have any cause to run your own DNS server it's really a matter of personal preference:
    Theoretically using the local DNS will offer a shorter round-trip time for queries, and be faster.
    Practically the difference is maybe 1-200msec, and sometimes Google will be faster (like if they already have a record cached and don't have to go asking up the chain).

    This is all personal opinion though -- it comes down to "Do what makes sense for you and your customers".

    • 3

  3. Since you did clarify that you mean using public DNS as the forwarders, and I assume you currently use your ISPs for this, then there are only 2 downsides I can see.

    First, as was mentioned, you may not receive NXDOMAIN records properly for non-existant domains, and instead be directly to helper sites. I don't believe Google does this, and I know OpenDNS does this, but has an option to turn it off, but it's worth a test for whoever you're looking into.

    The other concern is having your search queries logged or otherwise seen externally, which is up to the business to determine if this is an issue or not.

    That said, ISP DNS servers could also have these downsides. The only way around them is to run your own separate DNS server(s), which will be more servers to support, or just leave your AD DNS servers with no forwarders and have them use the root hints. The latter will almost certainly not perform as well, so it's probably not your best option.

    I suspect it will come down to speed for you, in which case you should run some tests with a bunch of DNS lookups against several different options you're looking into to determine what seems fastest from your location.

    • 0