DNS forwarders

Hi Guys,
is it good to add ISP's DNS IPs in forwarders?  ive just had a look at my DC and DNS is just using our internal IP DNS no issues but just wanted to know as a best practice shall i add public DNS in forwarders?
jag bAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Khushal Singh NarookaCommented:
Yes, In my opinion you should use ISP provided DNS on DC/DNS server. I would also block direct connection from internet on port TCP/UDP 53 towards DC/DNS server and only allow connection between ISP DNS and DC. This is secure server for external attacks or malformed queries & DDoS attacks.  

Said that, you should do this only if you not hosting any pubic domain/DNS which needs be access/resolve from outside world.
footechCommented:
I'd say it depends on your ISP.  You can use them, other public DNS servers (like Google), or root hints.  Whatever works best for you.  The only way you can really find out is to benchmark them.  Here's a couple tools to check out.
https://www.grc.com/dns/benchmark.htm
http://code.google.com/p/namebench/

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jag bAuthor Commented:
im ISP seems ok, but i havent put no forwarders within my network - have 2 dns servers internally
Virus Depot: Cyber Crime Becomes Big Business

The rising threat of malware-as-a-service is not one to be overlooked. Malware-as-a-service is growing and easily purchased from a full-service cyber-criminal store in a “Virus Depot” fashion. View our webinar recording to learn how to best defend against these attacks!

jag bAuthor Commented:
what you think guys - forget forwarders? see img
Capture.PNG
footechCommented:
You may see a slight improvement by using either of those forwarders, but whether it would be perceptible or not is unknown.  There doesn't appear to be a huge difference, but I can't tell from the image what the scale is.  I think it's normal for your local server's uncached performance to be slightly lower than the next fastest (you're adding another hop to the equation).  I think it's best to run the benchmark tools at least a couple times, trying both during the day (when you're likely to have usage on your network) and after hours (when usage may be light).  I think I would be concerned about the ISP's DNS reliability from the results shown.
jag bAuthor Commented:
footech  - done it again my internal DNS seems to be on top - shall i forget forwarders then and just keep the root hints..
footechCommented:
My last statement stands.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Internet / Email Software

From novice to tech pro — start learning today.