[Noumenon]

If MS DNS is implemented properly, it’s as secure as BIND. Most admins deploy MS DNS with secure updates turned off and zone transfers enabled from all sources, which is just a nightmare for administration and security overall.

This. Lazy admins take the shotgun approach. Not smart.

[rarestia]

When it comes to high-level domain infrastructure, implementation should be surgical.

MS infrastructure is my expertise. My last few jobs I’ve been hired to “clean up” implementations, esp. post-Novell migrations, and I’ve yet to come across a company that does it correctly.

Engineers don’t like to document and scope everything, so the installation usually goes full-default and it’s just a mess. DNS is no exception.