DNS server architecture

[thanhtien19]

Current we are using active directory integrated dns and all dns internal zone in ADDNS. and have two server DNS server using to forwarder to internet . Client -> AD DNS -> DNS Forwarder -> Google DNS.With topology current we some problem when have some client problem then it query more to DNS server to resolve domain internet that do server dns hang , slow response. Please suggest help me how to prevent this and suggest some solution about DNS to can for large request.

[#2]

Operating System, 2012R2/2016/2019/2022? Patches up to date?

[#3]

Current OS is 2012R2 and alway up to date

[#4]

How many clients, do they all use the same DNS server as primary?

[#5]

Current all client (12000 client and 500 server) point to primary is first server , secondary second dns. but current all the same primary dns IP

[#6]

You could change your DHCP settings so that half of the scopes configure the second server as primary? (Load-Balance)

[#7]

yes, but after rebalance then still can not prevent if some client problem then can query more dns ?

[#8]

Preventing? No, but at least you're spreading the load and you can set up DNS logging/auditing (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012) to see what they are querying and if you can somehow lower that.

There is a rate-limiting feature, but that's on Windows Server 2016 (https://docs.microsoft.com/en-us/powershell/module/dnsserver/set-dnsserverresponseratelimiting?view=...) I guess it's more for defending against an attack though...