Backup and Restore Features for DNS Zone Files

As part of a larger security profile it is important to protect your DNS infrastructure. I would like to see an IPAM feature that would allow for backup or snapshots of zone files.

Select the source of authority for your DNS
Create snapshots of the forward and reverse zone files.
Allow you keep a number of versions or days back
Set a baseline collection of the zone files
Be able to restore those zone file collections to any DNS server
1. Restoring the all the records or the complete set
2. Restoring select records
The ability to search for records within the saved collections

The objective here is to help protect this critical piece of IP management from corruption either intentional or unintentional, with the ability to restore DNS quickly.

Find more posts tagged with

backup and restore

Security

ip address manager

dns

zone files

Status: None

Comments

damien.solodow

An interesting idea although I can think of a few complications to deal with:

- AD integrated zones; these would be really tricky to deal with (especially for a restore)

- Dynamic entries might be sticky for restore especially maintaining security/ACL on the records.

tomiannelli

damien.solodow on the Dynamic that is way I suggested a selective record option be available. We have AD integrated zones and some allow dynamic entries from DHCP - with an authenticated credentials. Other zones are static only. Of course the service account configured to perform these backups and restores would have to be granted appropriate permissions. Furthermore, in AD when we have done restores we script that to the bridge head in HQ and let it replicate the zones out. Changes in normal operation can be made to any of the DNS servers in the offices, but when we have done restores from scripts we do one server and let AD replicate. That is just the cost of recovery. If you restored to all the DNS servers it would create unnecessary replication traffic as the systems tried to sync all those modifications. At least that is our thinking.

joelgarnick

to me, the most important thing would be to have the backup. we just went through an accidental deletion of a zone, and the only way to get it back was to do an offline restore of a whole domain controller, then export the zone from there...that was way more tricky and time-consuming than it should have been. If there was an easy to manage place to backup and store the files, worst case I could pull that data into a script and manually restore if needed.

tomiannelli

joelgarnick I actually created a SQL query from the IPAM database and was able to import all the records from that into a Zone file. It was a pain, but much faster than retyping everything.