Information Systems:Migration to externally-hosted DNS service

This page will either remain a project page (in which case it should be marked to be archived), or will become a meta page for DNS configuration. 

Overview

Project date: Mar. 2017

It has been decided that DNS hosting will be migrated from on-site hosting using Infoblox appliances to third-party DNS hosting providers. This configuration will be tried for a year, after which the solution will be reassessed.

DNS Configuration

Providers

There will be two hosting providers:

• Primary: DNS Made Easy (username/password found here)
• Secondary: Dyn.com (DynDNS) (username/password found here)
• Tertiary: On-site Infoblox devices (uni3sys.unipharm.com, uni4sys.unipharm.com)

It is important to note that service with Dyn.com is purely secondary DNS, and thus records cannot be managed there. Rather, Dyn servers will pull from DNS Made Easy servers through AXFR (an automated, background mechanism requiring configuration at both providers). Any changes made to DNS Made Easy servers will eventually be mirrored onto Dyn servers through periodic NOTIFY syncs, after which those records will begin to also be served by Dyn servers.

Also of importance is the fact that with regards to DNS queries, there is no plausible way to influence name server priority i.e. which server gets queried first. Thus, DNS Made Easy is primary only in the sense that records are managed there. With regards to answering queries, all advertised servers (all NS record entries) have an equal chance of being queried and for the majority of the time are queried in round-robin fashion. They are all serving the same records, so this shouldn't matter, but it is important to keep in mind for the administrator. Also, for this reason, there should not be an entry for a server that is non-responsive (i.e. how uni4sys was configured with a Terago IP before), as it leads to a delay in DNS response time.

Other details:

• The plan at DNS Made Easy to which we are subscribed is Business Membership, allowing for 25 domains, 3 failover records, and 10 million queries per month (for all domains).
• With Dyn.com, the service is Secondary DNS, where only a master IP is configured (the AXFR server at DNS Made Easy).
• Secondary service is only enabled for unipharm.com and medicinecentre.com. Though we serve other domains, they are not as important as to justify a second level of redundancy through Dyn (the service cost is per domain).

Domains

The following are domains for which uniPHARM is authoritative:

• unipharm.com
• medicinecentre.com
• umccharity.ca

(I guess that's actually it. Wow I thought there were more, but the other ones look defunct. -norwizzle (talk))

Technical notes

• Setup of DNS Made Easy was simply through copying records on the Infoblox. A reassessment of the current records is recommended (e.g. orders.unipharm.com as a CNAME for bart.unipharm.com - why? -norwizzle)
• Configuration TTL time is currently 1800 seconds (1 hour for all A records).
• Failover records will not be added until multipath or active redundancy for the WAN is enabled.