TABLE OF CONTENTS The design of your DNS namespace will have an effect on the security of your DNS infrastructure and the amount of effort required to administer it. At a minimum, the internal DNS namespace should either be registered or based on a registered name you own.
The internal DNS namespace mirrors the AD domain tree. However, DNS and AD are separate from one another.
The number of child domains or subdomains should be limited to five or fewer.
Secondary zones can increase fault tolerance and availability, but zone transfer traffic can consume unacceptable amounts of bandwidth in some circumstances.
Lame delegations are one of the most common sources of name resolution problems with a DNS infrastructure. As an alternative to using NS and glue address records to delegate authority, consider using stub zones or conditional forwarding.
Conditional forwarding can reduce the amount of DNS referral traffic on the network.
Conditional forwarding is a good alternative to using secondary or stub zones in many circumstances.
DNS servers used for internal name resolution should never be accessible to Internet clients.
Public DNS servers that are used to resolve name mappings for your Web and mail servers should not be able to perform recursion.
Primary DNS servers should be configured to replicate only with a configured list of IP address or servers listed on the Name Servers tab.
Cache pollution protection should be enabled on all DNS servers to protect against attacks.
Publicly available DNS...
