Q: Why pay for DNS?

Hold on!

I am confused. Is the hooverup scenario described really a DNS problem? It sounds like a routing problem to me, really?

Incorrect route announcements != DNS

I'm sorry, but what does a dodgy Chinese ISP incorrectly announcing IP ranges have to do with DNS?

It's all fine and dandy if your DNS resolves correctly, but if someone else has announced that IP block and the routers between your users and your servers route the customer's traffic the wrong way based on that announcement, DNS isn't going to help you there, no matter how much you might be paying for "premium" DNS services.

Is outsourcing really so good?

While I understand that ideally we should specialize in one field and let others specialize in other fields, I have seen so many problems in outsourcing that I don't think it's always a good idea.

In an ideal world with tons of money and reliable outsourcing companies, with reliable, honest and competent employees, I should outsource every aspect of my IT structure to the best consultants (or contractors, or outsourcers) for that aspect. Firewall, DNS, backups, and so on.

Realistically, I don't have enough money to pay for the best, and outsourcing companies employ underpaid and incompetent people just to maximize profit. And screw the customer's needs.

A customer of mine (I am a freelance sysadmin) had outsourced the interconnection between its offices to the telecom company (they bought managed firewall, vpn, and inter-office routing, plus internet access, obviously) and it was a disaster. Ask for a change, file a request via fax, wait for 3 days, get the WRONG config, repeat, get the right config but they damaged something else in the process. Also, we didn't really know how secure the setup was.

After some years of moaning, I convinced them to do it internally. We now have a much faster network, easily and immediately deployable configuration changes, we know exactly how secure (or insecure) is our setup, and when we don't need changes, the cost is also lower (that is, near zero). Obviously when we need big changes they have to pay for my services, but I still think it will cost less than the previous setup. And it works properly, too.

Not a DNS problem

The REAL problem is that the internet was never designed to let 'everyone' onto it.

It was never supposed to be open.

We need a complete redesign of EVERYTHING!

From how addresses are allocated, how traffic is routed and to naming technology and conventions.

Oh, and fix email at the same time...

DNS is easy

Get yourself as many different DNS hosts as you can fit in a UDP record and go with that. If someone is routing your traffic, you need to to be aware of that and talk to your upstream ISPs.

IT services...

This is why DNS isn’t just another service that the IT department takes care of"

Oh yeah! I love this one... so, what does the IT department take care of?

Those services we haven't figure yet an easy way to milk from those corporate idiots who think an IT admin should be like an electrical contractor?

The Best Solution Is Often The Opposite

Rather than making things more complex, lets make them less complex.

Lets just reduce the dynamic aspect. Imagine how the postal service would fail if someone was rearranging the street signs every day? All we need is for people to start frowning on domains that hop all over the address space minute to minute. The more stuff jumps around the more chances there are for things to go wrong. If DNS expiration was measured in hours or days think how much less infrastructure would be needed, how much less traffic there would be and how much latency could be removed. Use the address you got yesterday. IFF that fails then query the DNS.

We've reached the point where the technology is demanding more technology only to support the technology. Its time to get back to basics. Yeah, I know, we need the IPv6 address space to make it work. Then people could actually keep the same address on a box for more than a few minutes.

It just depends on your size and expertiese

Having worked on the outsourcing end for quite a while, (my team and I managed around 750k active IP addresses worldwide) I dare to say I know and understand a thing or two about DNS/DHCP (most of the times those two services go hand in hand).

The biggest problem, that I found, is the fact, that the IT infrastructure of companies grows exponentially in comparison, to the company itself.

this means, that an admin, who initially is in charge of everything, very quickly looses the capability to continue to administer the infrastructure by himself. that does not necessarily mean, that he lacks the skill, but just the physical resources.

when you then leave everything on default settings and just make the odd little change here and there, and not document the mods (after all I am on my own, and I just don't have the time!), then there is a massive problem, when the company decides to make policy changes.

It is not unheard of that a DNS/DHCP migration takes 1-2 years, due to the complexity of existing systems, and lack of downtime windows.

I can only encourage all technical managers:

make sure that everything is documented properly!!! That is the MOST IMPORTANT RULE!!!

If you don't it is going to come back and haunt you.

If the documentation is poor or non-existent it is going to cost a multitude in the long run, rather than to employ a contractor to ensure this documentation is up to scratch!!!

I know what I am talking about!!!

And yes DNS is business critical!

Imagine all the web applications within the corporation not being able to function anymore, starting with salesforce.com, intranet, printing (unless printing by IP address).....

Oh and finally......

Windows DNS/DHCP may be nice and easy to set up, but in terms of scalability and maintenance (the term IPAM or IP Address Management springs to mind) a night mare. And to migrate to something proper like QIP, Infoblox, OpenNetAdmin, or openIPAM, seems to have been made deliberately difficult, as data-sources are in various different formats and due to that, difficult to parse. (its not impossible, but it certainly takes quite some experience).

And and for those who know it better: I am not talking of ten or twenty different networks within a tiny little organisation, but two or three thousand within a medium sized enterprise.

You've obviously never used UltraDNS

I have.