DNS on Windows Server 2003, 3rd Edition

Internal Roots

If you want to avoid the scalability problems of forwarding and don’t want to deal with stub zones, you can set up your own root name servers. These internal roots serve only the name servers in your organization. They’ll know about only the portions of the namespace relevant to your organization.

What good are they? By using an architecture based on root name servers, you gain the scalability of the Internet namespace (which should be good enough for most companies), plus redundancy, distributed load, and efficient resolution. You can have as many internal roots as the Internet has roots—13 or so—whereas having that many forwarders may be an undue security exposure and a configuration burden. Most of all, the internal roots don’t get used frivolously. Name servers need to consult an internal root only when they time out the NS records for your top-level zones. Using forwarders, name servers may have to query a forwarder once per resolution.

The moral of our story is that if you have, or intend to have, a large namespace and lots of internal name servers, internal root name servers scale better than any other solution.

Where to put internal root name servers

Since name servers “lock on” to the closest root name server by favoring the one with the lowest roundtrip time, it pays to pepper your network with internal root name servers. If your organization’s network spans the U.S., Europe, and the Pacific Rim, consider locating at least one internal root name server on ...