Our environment no longer has domain controllers because identity and device management are handled through cloud services such as Entra and Intune, with some systems managed through Arc. Public DNS is hosted externally and works well, but we still have on-premises equipment and services that need internal name resolution. Domain controllers used to provide that service, so we currently run BIND9 on a small Linux virtual machine. There are only a couple dozen internal records, and I would prefer not to maintain a dedicated server just for DNS. Are there inexpensive, simpler alternatives that are still reliable?
5 Answers
You can also run standalone DNS on Windows Server without Active Directory, or use a managed DNS security or SASE service that supports private records. Those options may provide a nicer management interface, but verify that they support internal-only zones, split-horizon behavior, and reliable resolution when clients are off-site.
For a small internal namespace, Unbound, dnsmasq, or CoreDNS can be a lighter alternative. Unbound is particularly good as a small recursive resolver with local overrides, while dnsmasq is convenient when you also want DHCP integration. They still need a host or container, though, so the maintenance savings may be modest compared with your existing VM.
Avoid distributing hosts files across thousands of managed devices. They become difficult to update and do not handle changing networks or laptops gracefully. A local DNS service can provide split-horizon DNS, where internal clients receive private addresses while external users only see public records.
Honestly, keeping BIND9 may be the best option. It is mature, lightweight, and reliable, and a tiny Linux VM usually requires very little maintenance. Replacing it with something less familiar could create more operational risk than it removes.
Check whether your firewall, router, or network appliance can host local DNS records. Many SMB-focused devices, including common open-source firewall platforms and business routers, support local zones and forwarding. This is probably the simplest approach if you only have one site and a small number of records.
This works especially well when the firewall is already highly available and backed up. With multiple sites, make sure records can be synchronized or centrally managed.