---
title: "Best Practices for Configuring DNS"
canonical: "https://docs.infoblox.com/space/BloxOneDDI/1613758474/Best%20Practices%20for%20Configuring%20DNS"
format: markdown
---
This section outlines best practices for configuring and managing DNS objects effectively.

**Use DNS Views to Segment Traffic **

- DNS Views provide different DNS responses to clients depending on their source (for example, internal users receive private IPs, while external users receive public IPs). This approach is also known as split-horizon DNS.
- Segment DNS traffic by creating distinct views for internal, external, and partner zones. This separation helps prevent data leakage across environments.
- Apply appropriate Access Control Lists (ACLs) to each DNS view to ensure that only authorized clients can access the corresponding zones.
- For information on DNS view creation, see [Creating DNS Views](https://infoblox-docs.atlassian.net/wiki/spaces/ddiadminguidensdraft/pages/11010465).

**Ensuring Redundancy in NIOS-X Server Deployments**

- To ensure high availability during site-level or global outages, deploy two or more NIOS-X servers per site. Without redundancy, a single host failure could result in the loss of DNS resolution for that site.
- Implement Anycast DNS wherever possible. With Anycast, DNS clients are automatically routed to the nearest available server, reducing latency and ensuring seamless failover.
- For information on deploying hosts, see [Deploying NIOS-X Servers for Universal DDI](https://infoblox-docs.atlassian.net/wiki/spaces/InfrastructureDRAFT/pages/204735601).

**Secure Zone Transfers with TSIG **

- Zone transfers replicate DNS data between primary and secondary servers. If left unsecured, attackers could capture the entire zone data and use it for reconnaissance or attacks.
- Use Transaction Signature (TSIG) keys between primary and secondary servers to authenticate transfers and ensure data integrity.
- Configure DNS servers to allow zone transfers only to explicitly defined secondary servers.
- For more details, see [Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/ddiadminguidensdraft/pages/11012304).

**Configure ACLs and Rate Limiting **

- ACLs and rate limiting help protect DNS services from unauthorized access and abuse. For instance, an open resolver can be exploited in DNS amplification DDoS attacks.
- Define allow, deny, and rate-limit** **rules for DNS queries, recursion, and zone transfers.
- Restrict recursion to internal clients only to reduce the attack surface.
- For information on configuring ACLs, see [Configuring Access Control Lists](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186746202).

**Use Conditional Forwarding **

- Conditional forwarding allows DNS queries for specific domains (for example, *corp.local*) to be sent directly to internal DNS resolvers instead of performing full recursion or sending them to the internet.
- This is particularly useful when integrating with on-premises DNS or Active Directory, as it ensures internal domain names are resolved safely and efficiently.
- To optimize performance and reduce unnecessary lookups, avoid full recursion wherever possible.
- For information on the forward zone, see [Creating a Forward Zone](https://infoblox-docs.atlassian.net/wiki/spaces/ddiadminguidensdraft/pages/11010436).