Suggested Solaris configurations for large DNS 
implementations spanning multiple geographic regions


     The following is a suggested configuration to 
get DNS BIND 8 or BIND 9 working in a very large site 
spanning multiple geographic regions running a 
centralized administration/staging server.  This 
configuration should be tested in a non-production 
environment first before it is put into a production
environment.

How to set up a DNS Boss Staging / Multiple Primary 
Configuration




"X" User Interface   Web User Interface
  Administration   Administration
       \            /
        \          /
         \        /
          \      /      
  DNS Boss Staging DNS Primary (Sender)
         \         \                         DNS Client
          \         \                      /
           \         \                    /
            \         Production         /
             \        DNS Boss Primary 1 --- DNS Client
              \       (Receiver)
               \
                \
                 \                           DNS Client
                  \                        /
                   \                      /
                    \                    /
                      Production        /
                      DNS Boss Primary 2 --- DNS Client
                      (Receiver)





     So why run multiple DNS primary servers and a 
separate Staging/Administration Server?  Lets ask a 
few very important questions:


QUESTION: Should the site DNS go down if somebody 
makes a mistake on their DNS maintenance?

ANSWER:  With the DNS Boss Staging Server setup, if 
somebody accidently tries to push bad data to all the 
DNS servers, it should only take down the the DNS 
Boss Staging Server DNS, but not the Production DNS 
Boss Primary DNS Servers.  DNS Boss does a huge 
amount of checking and simplification to verify the
correct creation of all DNS data.  If however, 
something slips through that causes a fatal error in 
the restart of BIND, then the DNS Boss Staging Server
will not push the DNS data to the Production DNS 
Boss Servers.  DNS Boss looks at the return status 
code for the restart of your version of BIND and 
will only push data to the Production DNS Servers 
if it sees a successful restart of BIND.  The DNS 
Boss staging server also automatically pings the 
Production DNS Servers before it attempts to 
replicate to verify that they are up to prevent 
pushes from hanging.


QUESTION:  Should the different DNS servers for the 
same DNS domain be out of sync?

ANSWER:  The DNS Boss Staging Server synchronizes 
the data on all Production DNS servers by pushing 
the exact data from the Staging Server to the 
Production Servers.


QUESTION:  What if there is a power blackout at the 
site where the main DNS Primary is located?  
Shouldn't the Production DNS servers located at 
other geographic locations still be able to do 
updates and modifications?

ANSWER:  With the DNS Boss Staging Server setup, if 
there were an extended power blackout where the main
DNS primary was located, a remote DNS Boss Production
DNS Primary located on the other side of the world 
could still do updates, or even take over as the 
DNS Boss Staging DNS Server.


     To install the DNS Boss DNS primary sender (Staging
DNS Server):
# /opt/DNSBoss/bin/dnsboss
Click on the Advanced menu and select:  
DNS Boss Replication Sender and fill in the information.

     To install the DNS Boss DNS primary receiver:
# /opt/DNSBoss/bin/dnsboss
Click on the Advanced menu and select:  
DNS Boss Replication Receiver and fill in the information.

     Then go to the DNS Boss DNS primary sender and
click "Update this domain" for any DNS domain.  On the
DNS Boss DNS primary receiver you should see the updates
come across on the receiver GUI.



     Simulated disaster and recovery.
Here is a suggested test to simulate a
disaster that should be performed so you know
what to do when a real disaster hits.
Shutdown your master DNS Boss primary, and
one of your Production DNS Boss Primary DNS
servers.  Example
stagingdns# init 0
ns1# init 0
and turn them both off.  This will simulate
a catastrophic disaster in 1 or more
geographic regions.  Go to your your surviving
Production DNS Primary, and add or delete
some hosts, and:  'Update this domain'.
This should work, and the fact that 2 out of
your 3 DNS primarys are down should not be
significantly noticed by the DNS clients.
The real advantage of doing this is that you
can carry on your business by adding or
deleting new DNS hosts, even while the other
DNS primarys servers are being maintained.
This would not be true if you were running a
Primary to Secondary configuration.  You
would not be able to make updates.