Monitoring DNS
This article describes why DNS monitoring requires a different approach to the way IT systems are normally monitored. To fully describe this, we need to explain some basics about how DNS infrastructures are typically implemented in most organisations.
DNS infrastructures are typically designed and built using DNS views. DNS views are used to create independent domain name spaces, where the originating IP address of the query decides which view/name space the name server will respond from.
The most common way DNS views are used is to set up a view for the internal networks (internal view) and a view for the rest of the world, i.e. the Internet (external view).
The reason for using views is usually security related, given the long history of DNS security issues. By using views, the risk of DNS information leaking from the internal network is reduced to a minimum if handled correctly. The diagram below illustrates the basics.
The main advantage of using views is that the same DNS zones can be present in both views, each zone with its own unique content. In this way, an internal zone can hold the bulk of the internal names, while the external zone provides only the names required for Publicly available services. This is illustrated in the zone file extracts below.
There are two major drawbacks to running multiple views: administration and troubleshooting.
Administration increases with the number of zones that exist in more than one view, as adding, modifying and removing content may or may not be performed in multiple locations.
Troubleshooting DNS-related misbehaviour in a multi-view environment can be challenging. The main difference from normal troubleshooting is determining whether the problem is isolated to a particular view, or whether it is reproducible in the other views, which can take valuable time.
Monitoring DNS servers
There is actually a third disadvantage to running multiple views. Since most of the work is done from inside the network, running two or more DNS views leaves you pretty much blind to what is happening in all the other views. Especially what is going on in the DNS servers.
Because the internal systems only use the DNS servers defined in the internal view, there are virtually no lookup requests to the external name servers coming from the inside. What this means in practice is that the organisation is virtually blind to events on the external/public name servers.
This is where Internet-based monitoring services come in. Because web-based monitoring systems live in your “External” view, they see what your customers see.
DNSmonitor focuses on monitoring your public DNS servers for availability and their domain content for integrity. We send DNS queries to all your DNS servers, bypassing resolvers to obtain authoritative data, to ensure that Internet resolvers are able to resolve the domains on your DNS servers.