Our environment no longer uses domain controllers because device and identity management has moved to Entra, Intune, Azure Arc, and similar services. Public DNS is hosted externally and works well, but we still have a significant amount of on-premises equipment that needs internal name resolution. Domain controllers used to provide that service, and we currently run BIND9 on a small Linux virtual machine instead. There are only a couple dozen internal records, so I'd prefer not to maintain a dedicated server if there's a simpler and inexpensive alternative. What are others using in this situation?
5 Answers
Keep the internal and public views separate with split-horizon DNS. Your internal resolver can serve private records and forward everything else, while the public provider only exposes external records. I wouldn’t distribute hosts files across thousands of managed devices; keeping those records synchronized and handling laptops that leave the network would become painful very quickly.
Honestly, I’d probably keep BIND. It’s mature, reliable, lightweight, and already working. Replacing a stable DNS service with something less familiar may create more management and failure risk than it removes. If the concern is maintaining a full VM for a small number of records, a BIND container could reduce the footprint without changing the underlying service.
Unbound, dnsmasq, or CoreDNS are lightweight alternatives. Unbound is especially good if you mainly need local overrides plus recursive resolution, while dnsmasq is convenient when DHCP and DNS can live together. They still require some administration, though, so they may not be a major improvement over a tiny Linux VM.
Check whether your firewall or router can host local DNS records. Many SMB appliances can provide a local zone and static entries, and that’s often the simplest option for a small environment. Some platforms can also synchronize DNS data between sites, which helps if you have multiple locations.
A standalone Windows DNS server is also possible without Active Directory, but it probably doesn’t meet the goal of reducing overhead. Managed DNS security or SASE platforms may support private records too, but check whether they can handle split-horizon cases where the same name needs different answers internally and externally.
This depends heavily on the firewall. Some products provide a usable DNS database, while others only handle DHCP leases or basic forwarding.