2 related DNS issues: a) advice on setup. b) DNS slows down until I restart it?
Good Morning everyone,
We've had generally slow internet access for ages, which we're sure (following various tests) is a result of something inside school. We do have what I believe to be a strange network/DNS setup (but it may be perfectly normal) so allow me to explain:
Our three DCs are normal DNS servers, each replicates etc etc. These are SCS1, SCS2 and SCS3 for the purposes of this thread. They resolve internal DNS fine. However nothing on our LAN has access to the county WAN/ISP feed other than our Censornet proxy server and mail server - these have two NICS, one on each. Thus no DNS request for an external domain will resolve from a workstation.
Censornet (linux based) has to have an internal DNS as its first DNS otherwise it fails to identify our workstations via reverse lookup. It does have second and third DNS pointing to County, but being Linux it always tries them in order whereas windows has specific DNS servers per NIC. Thus when the internal domain lookups timed out, Censornet then tried looking to county and immediately got a result and displayed the page.
Over christmas, I came up with a plan which seemed logical. I had our server support team install secondary DNS on the mail server (which has LAN and WAN nics). SCS1,2,3 now have a forwarder set so any external domain requests are forwarded immediately to Mail1. Censornet points directly at Mail1, so it can lookup external domains, but also can resolve internal stationnames.
Now, first set of questions:
a1): Does this seem ok as a DNS setup?
a2): Should Mail1 receive updates periodically from SCS1,2,3?
There are a couple of stations which don't have PTR records on Mail1 but do on SCS1,2,3 until I tell Mail1 to reload/transfer the zone from master.
a3): Which should I be doing - Reload or Transfer - in this situation?
a4): Is there something I should check to see why this isn't happening? SCS1,2,3 are set to notify all the NameServers listed, which I understood to mean Mail1 should therefore request an update when it is notified?
Secondly, when I set this up at Christmas our internet speeds soured through the roof (as Censornet no longer had to wait for internal DNS to timeout). However they have dwindled to a snails pace over the last two months. Until yesterday evening - I was reloading the zone from master and managed to crash DNS on Mail1, so I restarted the DNS service. I came in this morning and internet access is back to full steam ahead.
My thoughts go back to our old ISA server which we had to periodically restart to maintain internet speeds.
b1): Why does it appear that I need to restart the DNS service on mail1 periodically to maintain internet access speed?
b2): Is there something I can change to stop this happening?
I'm happy to schedule it every weekend or suchlike if neccessary but it strikes me as odd.
Sorry for the long post - I hope someone can cast some ideas in my direction.