Act now »

Managing open-source DNS and DHCP at scale: what goes wrong without centralised control

BIND is the most widely used DNS server software in the world. ISC DHCP and its successor, Kea, are used in networks of all sizes. Both are open source, well documented and widely deployed. The problem lies not in the software itself, but in what happens when you manage ten, twenty or a hundred instances of it without centralised control.

What can go wrong with distributed DNS/DHCP management?

Maintaining a BIND installation on a single server is manageable. A text file for the configuration, a reload, and you’re done. But in an environment with multiple sites, failover pairs or segmented networks, that
manual approach quickly becomes unmanageable.

Typical problems we encounter: configuration files that are out of sync across servers, a change that has been made on the primary server but has never been synchronised to the secondary, and zone transfers that fail silently. DHCP scopes that are manually maintained in a spreadsheet that nobody trusts anymore.

The result is not always an immediate outage. More often than not, it is a creeping problem: addresses being assigned twice, DNS records that do not match the actual infrastructure, and IPAM management that lags behind reality.

What BlueCat brings to an open-source DNS/DHCP environment

BlueCat is not a replacement for BIND or ISC DHCP/Kea. The platform adds a management layer on top of existing open-source infrastructure.

At its heart is BlueCat Address Manager (BAM): a central interface that allows you to manage DNS zones, DHCP scopes and IP address space as a single administrative entity. Changes are rolled out from BAM to the underlying servers, regardless of whether these are BIND instances, Kea servers or BlueCat’s own DNS/DHCP Server (BDDS).

In practical terms, this means you retain the flexibility of open source, whilst adding centralised configuration control, audit logging and a REST API. This makes automation via Ansible, Terraform or your own orchestration layer
possible directly.

DDI: DNS, DHCP and IPAM as a single integrated solution

DDI stands for the combination of DNS, DHCP and IP address management. In many environments, these three are managed separately: DNS in BIND, DHCP in Kea, and IP addresses in a spreadsheet or a separate IPAM package. Coordinating these three then involves manual work.

BlueCat treats DDI as a single data model. Creating a new subnet automatically generates the corresponding DNS zones and DHCP scopes. A host record in IPAM is immediately visible in the DNS management interface. This reduces the risk of inconsistencies and makes it easier to track changes.

In which contexts is this relevant?

BlueCat is used in environments where DNS and DHCP are critical infrastructure and manual management is no longer scalable. Examples include larger enterprise networks, service providers with multiple customer environments, and organisations looking to expand their network automation.

The combination of a central management layer on top of existing open-source servers makes the transition less disruptive than a complete replacement. Existing BIND or Kea installations can be integrated into the BlueCat platform in stages.

Would you like to know how BlueCat fits into your DNS/DHCP infrastructure? We’d be happy to help you work it out.

See also.

Monitoring dark fibre before problems arise: active monitoring with the Adtran ALM

By definition, dark fibre is dark. No signal travels through it, there is no traffic to measure, and a traditional monitoring system detects nothing. Yet fibre-optic cables do degrade: connectors wear out, cables become damaged, and connections weaken due to temperature fluctuations or mechanical stress. If you don’t monitor this, you won’t notice it until the service goes down.
Read article

Dark fibre runs through car parks: why Layer 1 encryption is not a luxury

Organisations that lease or own dark fibre often regard that connection as private infrastructure. Their own fibre, their own data, their own management. What is often underestimated, however, is that the physical cable runs through infrastructure that you do not manage, beneath streets, through building service rooms, via multi-storey car parks and cable ducts in the public domain. And anyone with physical access to the fibre has access to the data travelling over it.
Read article

After VMware: what alternatives are there for edge and remote site infrastructure?

Broadcom’s acquisition of VMware in 2023 was accompanied by significant changes to licensing. Perpetual licenses were discontinued, the product portfolio was reorganized into bundles, and for many organizations, costs rose significantly. This has accelerated the search for alternatives, particularly for environments where VMware has historically been widely used: edge locations and remote sites.
Read article