Home / server / Questions / 785236
Accepted
lightxx
Asked: 2016-06-22 01:23:58 +0800 CST

Use one $INCLUDE for the SOA record for several zone files / Bad Practice?

  • 772

So, we're self hosting our DNS forward and reverse zones, and are using our upstream - ISP as slaves.

Now, we've got a bunch of zones that have an identical SOA record.

I want to use an $INCLUDE for this SOA record, because it is completely redundant information, except for the serial.

Now the problem is, the serial would be identical for all zones, and whenever I change a single zone, I would increment the serial for all zones, thus triggering an unnecessary retransfer of all zones to the slaves.

Now, this is not much data, some KiB at most. Still, the question is, is this considered bad practice, given that the retransfer is unnecessary?

Any opinions on that? Should I just go for it?

domain-name-system bind dns-hosting soa-record

1 Answers

  1. Best Answer

    While this ventures very close to being an opinion based question, I'm going to go ahead and say that this is objectively a bad idea. You're falling into the classic trap of over-engineering something that doesn't need to be over-engineered.

    • Most reputable DNS administrators (i.e. known names) would criticize this as a bad practice. I don't have to ask them. You don't want me to ask them, because they won't be nearly as polite in their phrasing.
    • It would not only trigger a wave of unnecessary zone transfers, but also a wave of unnecessary NOTIFY packets. It's fairly common for DNS slaves to pass notifies on to other slaves identified via NS records, magnifying the number of notifies that get generated from a single update.
    • $INCLUDE does not survive a zone transfer. While you probably knew that already, it is worth restating that breaking this out into an include file only serves a purpose on the master server.

    Don't just visualize this in terms of bytes on the wire. You are proposing a multi-directional packet storm every time you touch one of those zone files for the convenience of centralizing how one DNS record is managed per zone. While it's easy to dismiss this effect by emphasizing the "trivial" bandwidth involved, many veterans are not going to walk away from this environment with a favorable impression of the parties responsible for engineering it. Maybe your current shop is small enough to where you don't have to be concerned with the perception of future managers, but that's a really bad habit to start getting yourself into.

    In short, if you have read all of that and are relatively unphased, by all means go ahead and do it. Just make sure you're never put in a position where someone's professional opinion of you might be influenced by this environment.

    • 3