What are the essential Windows Server networking fundamentals for reliable core services?
Windows Server DNS, DHCP, and Active Directory carry enterprise core services reliably at first, then reach their design boundary as estates grow, losing centralized visibility, automation, and audit control. Because Active Directory is DNS-server agnostic, teams can consolidate without breaking replication. For organizations outgrowing native tooling, BlueCat Integrity delivers full DNS, DHCP, and IPAM consolidation across complex multi-platform estates.
- 01 Why is treating Microsoft DNS as "set it and forget it"…
- 02 How does DNS resolution actually work, from root servers to…
- 03 Why is the network team blamed first when DNS problems…
- 04 Does Active Directory actually require AD-integrated…
- 05 How do DNSSEC, DNS over HTTPS, and DNS Flag Day affect…
- 06 What should teams look for in a DNS, DHCP, and IPAM…
- 07 How do teams that have outgrown native Microsoft DNS and…
- 08 Which modernization path is right for a Microsoft-centric…
- 09 Frequently asked questions
- 10 Every source cited in this analysis
Why is treating Microsoft DNS as “set it and forget it” risky for enterprise core services?
Treating Microsoft DNS as set-and-forget is risky because it works only about 90 percent of the time, an unacceptable reliability level for high-availability services, and because Active Directory, authentication, and application-to-application traffic all fail when DNS fails.
Microsoft DNS auto-deploys with Active Directory, encouraging administrators to configure it once and move on. But “’90 percent of the time’ in a high-functioning IT organization is a horrible metric.” Call centers, global load balancing, and authentication cannot tolerate that gap.
DNS is the fundamental backplane of the network; every internal and external resource depends on it, and Active Directory does not function without it. Properly managed DNS also yields visibility: DNS firewalls disrupt malicious queries, and DHCP and IPAM reveal who requests addresses on the network.
Ignore DNS at your Peril
When organizations don't leverage the power of DNS, they're missing out on network security, visibility, etc. How can we convince executives they need DNS?
Root DNS servers sit at the top of the hierarchy, serving the root zone that lists every Top-Level Domain and managed by IANA. “Root DNS servers are the servers that literally run DNS for the entire Internet,” and “without the root DNS servers, the Internet would no longer function.”
There appear to be only 13 root servers, but that reflects an original IPv4 limitation; each of the 13 logical hostnames now sits behind highly available, globally distributed clusters. Understanding this chain and its caching behavior is the baseline for diagnosing any resolution failure.
DNS Root Sever How Root Servers Work
DNS root servers are authoritative servers that direct top level domain queries and list the 13 root hostnames, operators, and IP addresses.
Why is the network team blamed first when DNS problems surface across teams?
Network teams are blamed first because network changes have a disproportionately large blast radius and DNS is foundational to nearly every service. As a result, DNS misunderstandings drive misdiagnosis, blame, and slower incident resolution across IT.
“There’s this concept of Mean Time to Innocence, which is a joke, but it’s true. It’s always the network until you prove that it’s not.” Because a single change can disrupt everyone, network engineers become cautious and defensive, reinforcing organizational silos.
DNS is described as the oxygen of the environment: problems surface as application or authentication failures, such as Active Directory trust issues. Modern dynamic infrastructure makes naming indispensable, raising the need for baseline networking literacy and a shared language across roles.
IT Pros Debate: Guilty Networks, Speaking Up The Stack, and Essential Career Skills
In the spirit of breaking down barriers, IT professionals discuss guilty networks, speaking up the stack, and essential career skills.
Does Active Directory actually require AD-integrated Microsoft DNS?
No. Active Directory does not require AD-integrated DNS; it is DNS-server agnostic and works correctly on any platform that properly supports its DNS update mechanism, SRV records, and secure dynamic updates.
A persistent myth holds that Active Directory only works with AD-integrated DNS. Expert guidance “denounces the myth that Active Directory will only work with AD-integrated DNS” and “shows what Active Directory really needs from a DNS system.”
What AD truly needs is correct support for its DNS update mechanism, not a hard coupling to a particular vendor’s integration model. Hosting AD DNS on an alternative platform, following established best practices, delivers operational and architectural benefits without breaking AD functionality.
Webinar: The myth behind Active Directory and DNS
Graham Lockwood, Senior Solution Architect at BlueCat, discusses what Active Directory really needs from a DNS system and denounces AD and DNS myths.
How do DNSSEC, DNS over HTTPS, and DNS Flag Day affect enterprise DNS management?
DNSSEC and DNS over HTTPS solve different problems: DNSSEC authenticates DNS data integrity through a chain of trust, while DoH encrypts DNS transport for privacy. Both introduce operational tradeoffs around complexity, key management, and enterprise visibility.
DNSSEC signs record sets rather than individual records. A zone-signing key produces the signatures in RRSIG records, a key-signing key validates the public key published in DNSKEY, and a DS record in the parent zone links the levels into a chain of trust. When any link fails validation, the resolver returns SERVFAIL rather than passing a forged answer to the client. The security case is strong; the operational case is where teams stall. “DNSSEC provides origin authentication via a chain-of-trust but is hard to configure and maintain.” Every zone change means resigning, keys need scheduled and emergency rollover, and one mistake takes the zone dark.
DoH runs the other way. It encrypts DNS in transit for privacy, but it “hampers traditional enterprise monitoring that relies on plaintext DNS,” concentrating resolution in a handful of public resolvers outside enterprise control. DNS Flag Day sits alongside both as a compliance forcing function: it “was essentially a wake-up call to DNS providers to remove older, or broken, non-compliant systems.”
What is DNSSEC and how does it work?
DNSSEC authenticates DNS queries and responses by using cryptographic digital signatures. Learn more and how BlueCat can help to make implementation easier.
What should teams look for in a DNS, DHCP, and IPAM platform for reliable core services?
Teams should look for a platform that centralizes DNS, DHCP, and IPAM into a single source of truth with a single pane of glass, supports self-service automation, and enforces compliance requirements like DNSSEC, failover, and network segmentation across the entire estate.
“Centralized DNS is necessary because shared services architectures have scale and complexity that make decentralized DNS unwieldy and error-prone.” As the shared-services analysis puts it, keeping multiple “points of truth” for DNS is “just asking for trouble in the form of error-driven network outages which can be time-consuming to solve.” This is the direct inverse of the fragmentation established above.
The platform must provide self-service provisioning for automation and DevOps, unify DNS across hybrid and multi-cloud environments rather than fragmenting into per-cloud instances, and “deliver a compliant network that adheres to standard requirements such as DNSSEC, failover capabilities, and network segmentation.”
DNS as the Foundation of Shared Services
DNS is not only a key foundation of shared IT services, but also delivers the functionality which makes those shared services thrive. 
How do teams that have outgrown native Microsoft DNS and DHCP move to an enterprise DDI platform?
Teams that have outgrown native Microsoft DNS and DHCP consolidate by replacing scattered Windows servers with an enterprise DDI platform, BlueCat Integrity, which brings DNS, DHCP, and IPAM management under enterprise governance. Because Active Directory is DNS-server agnostic, AD zones migrate in phased steps without downtime.
Integrity is BlueCat’s core DDI software suite, combining Address Manager with distributed BlueCat DNS/DHCP Servers to unify fragmented DNS, DHCP, and IPAM into a single source of truth, along with insight into the relationships between devices, users, and IP addresses across the enterprise. The hub-and-spoke architecture makes consolidation practical at scale: one enterprise-grade appliance manages thousands of DNS/DHCP servers without additional infrastructure cost, over 1,000 servers connect to a single Address Manager under N-2 release support, and the model supports phased upgrades rather than a single cutover.
Governance is built into the platform rather than layered on top. Role-based access controls define multiple administrative users at different privilege levels, network templates and IP modeling tools enforce consistency, and a vendor-agnostic RESTful OpenAPI exposes operations to automation so provisioning no longer depends on tickets. DNS and DHCP failover hold uptime across IPv4 and IPv6, backup and recovery options cover both on-premises and cloud deployments, and Prometheus-based real-time metrics surface problems before they become downtime.
A global manufacturer replaced Microsoft DHCP and brought roughly 15,000 IP addresses across 27 production sites under a single management console.
Integrity Data Sheet
BlueCat Integrity X is a software suite that centralizes and automates mission-critical DNS, DHCP, and IP address management (DDI) services across…
Integrity
Tame network complexity with Integrity's full-stack DDI management platform and get visibility and control over your DNS, DHCP, and IPAM.
Which modernization path is right for a Microsoft-centric team outgrowing native DNS and DHCP?
The right path depends on estate scale and governance requirements. It ranges from quantifying the reliability gap, to decoupling Active Directory from integrated DNS, to full enterprise consolidation onto a governed DDI platform.
Decouple Active Directory from integrated DNS
Consolidate onto an enterprise DDI platform
Frequently asked questions
Common questions from teams evaluating Windows Server networking fundamentals and enterprise DDI consolidation.
Still have questions?
Get real answers from a BlueCat representative.
How do you detect and repair misconfigurations across DNS, DHCP, and IPAM before they cause outages?
Most DNS and DHCP outages trace back to preventable misconfigurations: stale serials, missing secondaries, orphaned zones, and spreadsheet IPAM drift. Native Microsoft tooling and manual processes cannot surface these issues at scale. Centralized visibility, response-data logging, and API-driven automation turn DDI from a blind spot into a controlled, self-correcting layer. For lean teams modernizing a Microsoft-centric estate without a rip and replace, Micetro provides that overlay.
- 01 What are the most common DNS misconfigurations?
- 02 How do you detect and remediate misconfigurations across…
- 03 Why does logging DNS response data expose misconfigurations…
- 04 How can DDI help identify rogue DHCP servers and DNS-layer…
- 05 How can network teams implement policy-as-code and…
- 06 What should teams look for in a DDI platform to detect and…
- 07 How do lean teams modernize a Microsoft DNS estate without…
- 08 Which approach to DDI misconfiguration control is right for…
- 09 Frequently asked questions
- 10 Every source cited in this analysis
What are the most common DNS misconfigurations?
The most common DNS misconfigurations are accidental zone overwrites, hidden-primary SOA serial skew that breaks DNSSEC, missing secondary server configurations, provider-side zone disappearance, and spreadsheet-based IPAM overwrites. Each stems from human error compounded by fragile architecture and the absence of a single source of truth.
Real incidents show the pattern plainly. A single mistyped record overwrote and deployed a company’s top-level domain, taking down internal and external resolution for an hour. On a hidden primary that could not support full SOA serial dynamic updates, serial skew caused secondaries to stop pulling the zone, aging out DNSSEC and breaking the public-facing zone until operators manually re-added updates to compensate.
Other failures came from ownership gaps rather than syntax. A zone hosted at an ISP simply vanished after an undocumented server upgrade, and DNS and IPAM tracked across shared spreadsheets meant one person’s edit silently overwrote another’s. In one incident a team replaced a primary DNS server only to find secondaries were never configured across the farm and recovery meant waking fifteen people for physical access.
6 DNS Horror Stories that will Spook Your IT Team this Halloween
Working with DNS can be spooky. Here are 6 DNS horror stories to enjoy this Halloween, coming from IT teams just like yours.
How do you detect and remediate misconfigurations across DNS and DHCP?
Detection begins with centralized visibility across DNS, DHCP, and IPAM. If you cannot see an asset, service, or configuration, you cannot control it and without control you cannot secure or remediate it. Surfacing the full estate in one view is the precondition for catching misconfigurations before they cause outages.
Blind spots are where misconfigurations hide. When organizations centralize DNS, DHCP, and IPAM data, they routinely discover unknown assets, unmanaged services, and misconfigurations they did not know existed. The principle is blunt: if you can’t see it, you can’t control it; if you can’t control it, you can’t secure it.
That visibility translates directly into faster troubleshooting, clearer operational context, and more consistent policy enforcement. Teams that make the move are consistently surprised by what they learn about their own networks and eliminating those blind spots reduces the likelihood of both service disruptions and security incidents tied to invisible components.
5 Secrets DNS Can Uncover About Your Network
Play video “If you can’t see it, you can’t control. If you can’t control it, you can’t secure it.” Having blind…
Why does logging DNS response data expose misconfigurations that query logs miss?
Query logs record only which domain was requested; response data reveals where that query actually resolved, which server answered, and the response code returned. Logging responses exposes misconfigurations and attacks, including hijacked records, unexpected IPs, and answers that do not match the question, which query-only logging cannot detect.
The answer matters more than the question. If an attacker compromises a registrar and changes an A record, queries for the domain still look perfectly normal. Only the response data shows that the address quietly changed from a legitimate IP to one the attacker controls. Logging a DNS query tells only a fraction of the story; the response reveals where it resolved and which server provided the answer.
Correlating responses with internal hosts lets teams identify which systems reached a compromised destination and target investigation precisely. Logging queries and responses together at every service point, then feeding them into policies and SIEM tools such as Splunk, turns DNS answers into an active detection signal for hijacking, tunneling, and poisoning.
According to Cisco, 91 percent of malware uses DNS in attacks, which makes response-data visibility a decisive detection surface rather than an optional log.
The value of DNS response data for securing your network
Logging a DNS query only tells a fraction of the story. With Intelligent Security, we’ve changed the paradigm by logging DNS responses as well, uncovering…
How can DDI help identify rogue DHCP servers and DNS-layer threats?
A centralized DDI platform identifies rogue DHCP servers and DNS-layer threats by giving administrators a complete, authoritative view of DNS and DHCP activity across the organization. The same blind spots that let unmanaged services persist are the ones the four major DNS attack types exploit so full estate visibility, comprehensive logging, DNSSEC, and access control close both gaps together.
DNS was built to resolve names efficiently, not to question their intent, which is why it is attractive as an attack vector. The four major attack types: DoS/DDoS including amplification, DNS hijacking, DNS tunneling, and DNS/cache poisoning, cause outages, redirection, covert command-and-control, and data exfiltration when left unaddressed. Each exploits the same weak controls that unmanaged DHCP and orphaned zones create.
Basic protections materially reduce the surface: know your entire DNS architecture to eliminate silos and orphaned zones, log inbound and outbound queries and responses, harden recursive servers with DNSSEC and access controls, and tighten registrar access. Logging and monitoring outbound and inbound queries is the first step to detecting anomalies.
Four major DNS attack types and how to mitigate them
In a DNS attack, DNS is compromised or used as a vector. Learn about the different attack types and how to prevent, detect, and mitigate them with BlueCat.
How can network teams implement policy-as-code and automation for DDI configurations?
Network teams implement policy-as-code for DDI by driving DNS, DHCP, and IPAM changes through a single REST API instead of one console per service. A single API surface across on-premises and cloud lets the same workflow enforce change control, provision addresses consistently, and satisfy compliance mandates, turning detection into remediation at scale instead of one manual fix at a time.
Automation is one of the most common and important corporate mandates, and a strong API is how it reaches DNS and DHCP. The obstacle is rarely intent, it is sprawl. DDI services sit decentralized across the estate, Microsoft or ISC on-premises, native services in AWS, more again in Azure, each with its own interface and its own automation dialect. Built service by service, every new platform means another workflow to write, test, and maintain.
A software DDI overlay collapses that problem. Access control, DDI objects, and automation run through one REST API, so a single workflow covers cloud and on-premises alike and survives a change of underlying service. The mechanics are ordinary CRUD: POST creates, GET reads, PUT updates, DELETE removes, with the object addressed by a URL from the API documentation. That API then becomes the execution layer for Ansible, Terraform, PowerShell, or a service desk tool like ServiceNow, and the same endpoints feed monitoring. Repair stops being manual at that point. IP range templates, self-service onboarding, and reclaiming addresses when a service is retired all become code that runs on a trigger.
Ultimate Guide to the Micetro REST API
Create consistent DDI (DNS, DHCP & IPAM) automation workflows using one REST API, no matter where your workloads currently reside or will reside in the…
What should teams look for in a DDI platform to detect and repair misconfigurations automatically?
Teams should look for a platform that centralizes a single source of truth, logs both queries and responses, keeps primaries and secondaries consistent, and reduces the manual burden of complex functions like DNSSEC key rotation. Each criterion is the inverse of a documented failure mode. It addresses the operational complexity that stalls adoption when configuration is left to manual processes.
The clearest lesson from DNSSEC adoption is that operational complexity, not value, is what stalls the right controls. Configuring signed zones from scratch is genuinely hard. Administrators must manage signing keys, extra records, and regular key rotations, work most organizations avoid unless a vendor-managed solution takes it on. A platform worth choosing reduces that manual burden rather than leaving it to manual processes.
The same logic extends across the estate. Look for centralized visibility that eliminates silos and orphaned zones, response-data logging that exposes answers query logs miss, high-availability configuration that keeps secondaries in sync, and API-driven change control. Where encryption reduces traditional monitoring visibility, the platform should help preserve it rather than trade detection for privacy.
DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?
We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.
How do lean teams modernize a Microsoft DNS estate without a rip-and-replace?
Lean teams modernize a Microsoft-centric DNS estate by overlaying it with a DNS-focused platform that provides a single source of truth and a guided migration methodology, rather than enduring another painful upgrade. Micetro gives Microsoft-overlay estates centralized visibility, control, and compliance while modernizing in place — no rip-and-replace required.
DNS can no longer be an afterthought; it is the foundation of a robust network management strategy. When a provider treats DNS as one SKU among many, upgrades become difficult, time-consuming, and expensive, often breaking other functionality and driving costly professional-services bills. As the guidance frames it, migrating to a more robust, DNS-focused platform can be the easier and safer solution than the next fragile upgrade.
A DNS-focused vendor gets to know a team’s initiatives and long-term goals, proactively mitigating risk instead of playing catch-up on each project, and pairs that focus with a guided migration methodology covering data extraction, optimization, and validation. Micetro delivers that overlay for lean, Microsoft-centric teams, giving them a single source of truth and modernization without disruption.
Are you working with the right DDI provider?
As more and more businesses transform through key IT initiatives such as cloud, ITaaS and automation, DNS can no longer be an afterthought.
Micetro
With Micetro, integrate, orchestrate, and automate your current DNS, DHCP, and IPAM network infrastructure via a single web interface.
Which approach to DDI misconfiguration control is right for a Microsoft-centric team?
The right approach depends on how far a Microsoft-centric team has outgrown native DNS/DHCP and spreadsheet IPAM. Teams that cannot yet see their full estate should centralize visibility first; teams past the limits of manual change control should automate detection into remediation; and teams that cannot absorb a rip-and-replace should overlay the existing estate and modernize in place. The paths are sequential, not exclusive.
Centralize visibility before automating
Close the detection-to-remediation loop with API-driven policy
Overlay a Microsoft estate and modernize in place
Frequently asked questions
Practical answers to the DDI governance, automation, and modernization questions that come up most in Microsoft-centric estates.
Still have questions?
Get real answers from a BlueCat representative.
Key research findings
The research demonstrates that network observability has evolved beyond simple monitoring into a strategic operational capability. Organizations managing hybrid infrastructure require correlated visibility across applications, traffic flows, devices, and multiple telemetry sources to maintain performance at scale.
Respondents consistently identified fragmented visibility, disconnected monitoring tools, and manual troubleshooting as their largest operational challenges before adopting LiveNX. Following implementation, teams reported faster root cause analysis, improved collaboration between operational teams, and substantially less manual effort during investigations.
The findings also show that observability investments create measurable business value beyond technical improvements. Reduced troubleshooting time, tool consolidation, and increased engineering productivity contribute directly to significant annual cost savings.
What does this mean for network teams?
Modern network teams are expected to manage larger, more complex environments without proportional increases in staffing. The research shows that improving observability helps teams scale operations while reducing operational risk. Organizations evaluating network observability platforms should consider how solutions impact both technical outcomes and business metrics. Key benefits include:
- Improve visibility across hybrid and multi-vendor networks
- Reduce mean time to identify and resolve issues
- Consolidate multiple monitoring platforms
- Free engineering teams for strategic initiatives
- Demonstrate measurable operational ROI to leadership
Organizations that invest in end-to-end network visibility aren’t simply improving monitoring—they’re improving operational resilience, efficiency, and long-term scalability.
Download the LiveNX ROI report
Discover how enterprise organizations are improving network operations with BlueCat LiveNX
What you’ll get:
- Benchmark data from enterprise LiveNX customers
- Insight into how organizations achieved $196,500 in average annual ROI
- Practical strategies for improving visibility, troubleshooting, and operational efficiency
What is the business impact of observability across core DDI services?
Traditional monitoring tells teams that DNS or DHCP broke; observability tied to core DDI tells them why and what to do next. BlueCat Horizon turns core DDI telemetry into operational intelligence that shortens outages, proves change history, and cuts manual toil.
- 01 Why does core DDI matter to the business?
- 02 What is the value of network observability tied to core…
- 03 What does poor DDI visibility actually cost the business?
- 04 Why do large enterprises run the most under-instrumented…
- 05 How does DDI observability improve security, governance,…
- 06 What should teams look for in an observability approach for…
- 07 How do NetOps teams turn DDI telemetry into faster…
- 08 Which observability path fits a lean team, a complex…
- 09 Frequently asked questions
- 10 Every source cited in this analysis
Why does core DDI matter to the business?
Core DDI matters because DNS, DHCP, and IPAM together form the network control plane that enables device connectivity, application routing, and policy enforcement across the enterprise. When any part of that control plane fails, devices and endpoints can no longer communicate, and the business impact scales from a stuck print job to an ecommerce site losing revenue to patients being put at risk in a hospital.
DHCP assigns the IP addresses that let devices join the network, IPAM tracks and governs those allocations, and DNS maps names to the addresses services actually use. The three are grouped as DDI because they are tightly coupled: a failure in one quickly becomes a failure across all of them, which is why they are treated as a single foundation rather than three separate utilities.
The stakes rise as networks stretch across hybrid and multicloud environments. Managing core services through fragmented, manual processes leaves the business exposed to outages, security gaps, and slow change, and the difficulty compounds as the estate grows and diversifies. Centralizing DNS, DHCP, and IPAM turns that fragile plumbing into a measurable driver of operational performance rather than a source of unmanaged risk.
DDI Directions 2026: Turning DDI solutions into success
Explore EMA’s DDI Directions 2026 research to learn how integration, automation, and DNS security turn DDI solutions into measurable operational success.
What is the value of network observability tied to core services like DNS and DHCP?
The value of network observability tied to core services is that it turns DNS and DHCP telemetry into the fastest path to root cause. Traditional monitoring flags that something is slow or broken; observability built on core-service data shows where a query degraded, why resolution slowed, and which fix restores performance. That is the difference between knowing a problem exists and knowing what to do about it.
DNS underlies nearly every transaction on the network, which makes it one of the richest and most underused sources of performance insight. When resolution paths are inefficient or queries are routed to distant resolvers, latency climbs and users feel it, yet the cause stays invisible to tools that only watch uptime and bandwidth. Analyzing core-service telemetry exposes those degraded paths directly, so teams can trace an issue to its source and remediate faster instead of guessing.
The value compounds when that visibility is unified rather than scattered. Pulling DNS, DHCP, and IPAM into a single source of truth turns isolated data points into correlated context that spans on-premises and cloud, which is what moves a team from reactive troubleshooting toward proactive operations. Observability tied to core services does not just add another dashboard; it makes the network’s own data answer the questions monitoring leaves open.
By analyzing DNS query data, one organization found that 80% of its network traffic was being routed to external trusted services; rerouting it directly to the internet cut WAN costs and improved user experience, a fix that only surfaced through core-service telemetry.
Case Study: DNS data identifies network performance issues
In this case study, we see how DNS data provides critical clues to identifying and mitigating network performance issues.
What does poor DDI visibility actually cost the business?
Poor DDI visibility costs far more than the license line suggests, because most of the expense is hidden: administrative overhead, SIEM ingestion and storage, excess infrastructure, cloud overspend, outages, breaches, compliance effort, and staff turnover. There is no such thing as a free lunch DDI — enterprises either pay for a purpose-built solution or pay to cope with the limitations of a DIY one.
Budgeting only for direct costs like licensing misses the point. DIY approaches built on Microsoft DNS or homegrown BIND are difficult to automate, so network teams spend person-hours on DNS tickets and routine maintenance. One customer, a senior network engineer in higher education, noted the move off DIY saved “hidden money” over time.
A centralized DDI solution is built to be automated, which is where the savings concentrate. Automation reduces the manual ticket work, accelerates provisioning and remediation, and lowers the resourcing cost tied to high engineering salaries — freeing team members for strategic projects rather than repetitive toil.
How to budget for a DNS, DHCP, and IPAM solution
If you're considering purchasing a DNS, DHCP, and IPAM solution, it can be difficult to calculate the actual costs and ROI. BlueCat is here to help.
Why do large enterprises run the most under-instrumented DDI?
Large enterprises run the most under-instrumented DDI because the pattern of adoption is inverted: the biggest, most complex estates are the most likely to still run decentralized, manual DNS. The reason is largely organizational inertia and entrenched complexity — big-budget organizations tend to staff around the problem rather than rearchitect a global network.
Decentralized DDI simply does not scale well. Managing Microsoft DNS or homegrown BIND across high-performing global networks overwhelms teams with service requests, particularly from DevOps and cloud teams. Larger organizations tend to staff around the problem rather than rearchitect, and management of critical systems can become a source of internal power that stakeholders resist centralizing.
The consequence surfaces during modernization. Many respondents using Microsoft or BIND reported their DDI was less capable or inferior in the cloud than on-prem, because those solutions were not built with the cloud in mind. Centralized, automation-ready DDI, by contrast, correlates strongly with successful SDN and hybrid cloud deployments and consistent behavior across environments.
The bigger the business, the more misguided the DDI
EMA research for BlueCat found an inverse relationship between commercial DDI use and business size, as well as more surprises about DDI adoption trends.
How does DDI observability improve security, governance, and compliance?
DDI observability improves security, governance, and compliance by logging DNS responses — not just queries — so teams can see where a query actually resolved, which server answered, and whether that answer was malicious. Logging a DNS query only tells a fraction of the story; response data reveals the destination IP and the source of the answer, giving defenders forensic-grade evidence.
When only queries are logged, a hijacked domain looks perfectly normal. Response data exposes the change — a modified A record now resolving to an attacker-controlled IP — and lets teams identify exactly which internal hosts reached the compromised destination. According to Cisco, 91 percent of malware uses DNS in attacks, which makes that visibility essential rather than optional.
Correlating queries and responses at every service point, then forwarding those logs to a SIEM such as Splunk, turns core DDI into a governance and audit layer. Policies can monitor, alert on, or block servers and IPs with poor reputations, and the complete change history satisfies the evidence requirements that cloud governance and compliance increasingly demand.
The value of DNS response data for securing your network
Logging a DNS query only tells a fraction of the story. With Intelligent Security, we’ve changed the paradigm by logging DNS responses as well, uncovering…
What should teams look for in an observability approach for core DDI services?
eams should look for a unified, intelligent approach that advances them along a clear maturity path rather than adding more tools to an already fragmented stack. The criteria that matter most are integration across network, cloud, and security domains, centralized visibility that closes cloud blind spots, high-quality data that cuts alert noise, and a route toward AI-driven operations. Each one directly counters a documented reason enterprises stall mid-maturity: tool sprawl, limited visibility, poor data quality, and excessive alerts.
Most enterprises are stuck in the middle stages of the maturity curve, described in EMA and BlueCat’s research as “Fragmented and Opportunistic” or “Integrated and Centrally Managed.” In those stages tools are siloed, correlation is manual and inconsistent, and every issue becomes a fire drill because teams can see parts of the network but not the whole picture. The instinctive response is to buy another tool, which deepens sprawl rather than resolving it.
Pulling ahead means integrating tools across domains, breaking down silos between network, cloud, and security teams, and unifying core DDI as a single source of truth so observability data can be shared and acted on. That unified foundation is what moves teams from reactive monitoring toward predictive, AI-ready operations, which is the difference between investing in observability and actually succeeding with it.
Nearly every IT organization invests in observability tools, yet only 46% say they are fully successful with them. The rest are stuck somewhere in the middle of the maturity curve, facing tool sprawl, limited visibility, poor data quality, and alert noise.
Network observability maturity stuck? Learn how to pull ahead
In EMA and BlueCat's new report, learn about the five-stage Network Observability Maturity Model and how your enterprise can move along it.
How do NetOps teams turn DDI telemetry into faster resolution?
NetOps teams turn DDI telemetry into faster resolution by pairing continuous, correlated observability across the whole network with agentic AI that reasons over it. BlueCat Horizon provides the SaaS-based foundation that orchestrates DNS and DHCP services across on-premises and cloud, eliminating the visibility silos that keep manual correlation slow.
The scale of modern networks has made manual correlation unworkable — no engineer can consistently connect performance telemetry, flow data, configuration state, and security signals in real time. Network observability goes beyond monitoring by connecting real-time metrics, network context, and configuration data to proactively detect and isolate root causes, often before users notice a problem.
BlueCat Horizon carries that principle into a single orchestration layer for services deployed on-premises and in the public cloud, providing a path to AI-driven, resilient, secure networks. Agentic AI reasons over the correlated telemetry to move teams from reactive troubleshooting toward autonomous operations — answering not only what is happening, but why, and what to do next.
90% of survey respondents agree or strongly agree that network observability is increasingly critical with the arrival of AI.
Agentic AI adoption in network observability propels NetOps teams
Network observability is crucial for today's networks and even more capable with agentic AI, according to new Omdia and BlueCat research.
Horizon
BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI
Which observability path fits a lean team, a complex estate, or a security-driven mandate?
The right path depends on which pressure is loudest — alert fatigue, budget scrutiny, or audit exposure. Three patterns recur across the environments described on this page, and each maps to a different first move rather than a single universal answer. The paths are sequenceable: teams often start with one and pick up the others as maturity grows.
Instrument core DDI before adding tools
Quantify the hidden cost before renewal
Make DNS response data the audit and security layer
Frequently asked questions
Common questions from teams evaluating observability and DDI modernization across hybrid environments.
Still have questions?
Get real answers from a BlueCat representative.
How can organizations achieve unified operational visibility across core DDI without ripping out Microsoft DNS and legacy tools?
Hybrid, Microsoft-dependent environments make it hard to see what’s really happening across DNS, DHCP, and IPAM, especially when teams are lean and split between on‑prem and cloud. This piece shows how to pull every core DDI signal into a single, live view so you can spot issues faster, cut manual investigation time, and support cloud projects without creating new blind spots. We’ll walk through practical ways to unify data from Windows DNS, cloud DNS services, and IPAM into one operational pane, setting the stage for BlueCat’s Horizon‑style intelligent observability and automation.
- 01 What is DDI and why do enterprises need unified DNS, DHCP,…
- 02 How can on‑prem DDI teams regain visibility when cloud…
- 03 How does unified DDI visibility tame hybrid cloud…
- 04 What should teams look for in a platform to validate DDI…
- 05 How can DDI integration with security platforms improve…
- 06 How do you measure ROI for DDI modernization projects when…
- 07 How can distributed networks centralize DDI visibility and…
- 08 Which unified DDI visibility path is right for a…
- 09 Frequently asked questions
- 10 Every source cited in this analysis
What is DDI and why do enterprises need unified DNS, DHCP, and IPAM visibility?
DDI is the combination of DNS, DHCP, and IP address management, and enterprises need a unified view of all three because fragmented tools, spreadsheets, and siloed servers create IP conflicts, outages, weak accountability, and blind spots that make automation, security, and hybrid cloud projects fragile.
Spreadsheets layered on top of Microsoft DNS or BIND lack centralized visibility and do not scale for networks spanning regions, hybrid clouds, and multiple business units. As the IP space grows, manual tracking practically invites errors and overlaps that can take down services, while role-based access and reliable reporting are essentially impossible.
Standalone IPAM tools improve address tracking but leave DNS and DHCP fragmentation untouched. As one BlueCat guide notes, “IPAM tools on their own can be helpful as a short term band-aid. But they do not solve the underlying problems inherent in decentralized network infrastructure systems.” The recommended approach is to rationalize DNS, DHCP, and IPAM into a unified DDI solution and single source of truth.
The article stresses that using an IP address spreadsheet simply isn’t viable long term and that DDI data belongs in a single source of truth.
Looking for an IPAM solution? There’s something you should know.
IPAM tools alone do not solve the underlying issues with decentralized network infrastructure systems such as Microsoft DNS and BIND.
How can on‑prem DDI teams regain visibility when cloud and DevOps manage their own DNS?
The practical way to regain visibility is to establish a consistent, enterprise-wide DDI model with a single source of truth, then extend or integrate that DDI layer with cloud-native DNS services and expose it via automation so cloud and DevOps teams can self-service without creating shadow DDI.
Unmanaged cloud activity creates multiple concrete problems for on‑prem teams: overlapping IP assignments when cloud networks allocate space without a shared source of truth, complex DNS routing as workloads move, creeping fragmentation of DDI management, and gaps in continuous security and compliance. Network administrators carry responsibility for these failures but often lack authority or insight into what cloud teams are doing.
Addressing this requires a DDI architecture that “speaks the same language” across on‑prem and cloud. Core DDI must either extend into the cloud or integrate with cloud-native DNS such as Amazon Route 53 and Azure DNS so data and policy flow seamlessly. Once that foundation exists, network automation tools can provide self-service provisioning, giving cloud and DevOps teams speed while preserving centralized control and visibility in the cloud.
Cloud DNS: Addressing the visibility challenge
If your network team can't see what's happening in the cloud, you've got a serious challenge. Time for a DDI system that works in all environments.
How does unified DDI visibility tame hybrid cloud complexity and enable safe automation?
Unified DDI visibility across on‑prem and cloud—down to every DNS query and endpoint—eliminates silos, reveals IP and zone conflicts, and provides the single source of truth required to automate changes safely instead of relying on fragile manual forwarding rules.
An ONUG discussion highlighted four critical hybrid DDI challenges: DDI teams have zero visibility into cloud DNS, cloud and on‑prem DDI become silos with fragmented or overlapping IP space, automation stalls without a source of truth, and a growing tangle of forwarding rules and private endpoints consumes resources. As Zeus Kerravala notes, “trying to manually manage these things is going to lead to failure.”
For automation to work, “you can’t change something unless you can assert some sort of source of truth.” That means discovering services, seeing how each DNS query was resolved, and correlating authorities across internal private networks and cloud zones. With total visibility and a single DDI truth, teams can build automation and security segmentation that adapts as applications shift, instead of hand-curating conditional forwarders for every new dependency.
Total visibility key to tame DDI hybrid cloud challenges
In an ONUG webinar, BlueCat’s Andrew Wertkin explains how DNS, DHCP, and IPAM visibility is key to automation and taming four hybrid cloud challenges.
What should teams look for in a platform to validate DDI changes against policies and compliance requirements?
Teams should look for a DDI approach that centralizes DNS, DHCP, and IPAM into a single policy-aware source of truth, separates management and services planes for resilience, provides rich reporting on changes and IP usage, and supports automation so policy checks and audit trails are enforced consistently across hybrid environments.
A structured evaluation starts with requirements: scalability, security, compliance, reliability, environment, and support. Guidance from DDI experts stresses that projects fail when requirements are vague or fragmented between teams. Platforms should avoid artificial limits on database objects, support centralized rather than siloed environments, and enforce consistent naming policies so governance does not depend on manual review of every zone and record.
For compliance validation, DDI must act as a single authoritative data set that automation and reporting can trust. That includes robust IPAM that “ensures effective management of IP resources,” detailed change history, and the ability to parse DNS activity for risk indicators. Buyers are urged to “ask hard questions” about migration experience, reporting, and integrations so that DDI changes can be audited and policy aligned instead of buried in ad‑hoc scripts or spreadsheets.
What to ask a DNS, DHCP, and IPAM solution vendor
You've decided your DNS, DHCP, and IP address management are too complex to DIY. Learn more from BlueCat about how to find the right solution partner.
How can DDI integration with security platforms improve visibility into internal and external DNS traffic?
Integrating DDI resolvers as the first DNS hop with security platforms adds endpoint-level context and internal east‑west visibility to existing north‑south telemetry, enabling granular DNS security policies and faster identification of infected devices without deploying separate sensors.
One integration pattern places the DDI resolver at the first hop so it sees the source IP and all internal queries before forwarding external requests to cloud-based defenses. This adds visibility into the roughly 60% of traffic flowing through internal DNS, which is otherwise a blind spot. As one customer noted, this level of endpoint detail was “a game changer for cybersecurity.”
With combined visibility, security teams can deploy granular DNS policies grounded in both external reputation and internal behavior. Lightweight service points enable traffic steering for SD‑WAN and hybrid cloud resolution without heavy hardware. Crucially, “with [the resolver] sitting at the first hop as a DNS resolver, all of that information is collected without all of that extra effort,” avoiding a separate sensor deployment project.
Bolster DNS security with BlueCat and Cisco Secure Access
Working together, BlueCat and Cisco Umbrella extend the breadth and depth of domain name system security across the enterprise.
How do you measure ROI for DDI modernization projects when moving off spreadsheets and legacy servers?
ROI for DDI modernization is measured by reductions in outages and incident time, labor saved from manual DNS/IPAM work, security and compliance risk reduction, and agility gains such as faster provisioning and automation—all of which are hard to achieve with spreadsheets and disparate DNS servers.
Legacy environments built on “spreadsheets and disparate DNS servers” suffer from system fragmentation, security gaps, and manual processes that directly result in outages. Organizations often accept this because “if it’s not broken, don’t fix it,” but the hidden costs include slow incident response, duplicated effort across teams, and mounting audit pressure as hybrid complexity grows.
In contrast, unified DDI improves “the visibility, security, and resiliency of core network services.” Real-world migrations have reported “important operational gains (cost and agility)” once automation replaces ticket-driven changes. Metrics that resonate with leadership include fewer DNS-related incidents, shorter mean time to resolve, reduced hands-on changes per week, and the ability to support new projects without adding headcount.
Webinar: Ditch legacy DDI to unify your DNS, DHCP and IPAM
BlueCat’s Solutions Architects explore the potential created by unifying DNS, DHCP and IPAM, including challenges and real-world solutions (enterprise and…
How can distributed networks centralize DDI visibility and control without disrupting local DNS and DHCP?
Distributed networks can centralize DDI visibility and control by adding a SaaS-based orchestration and reporting layer that connects to existing DNS, DHCP, and IPAM via lightweight agents, synchronizes states bi-directionally, and surfaces metadata for insight while letting services execute locally for performance and resilience.
A data sheet describes this approach as a shared control plane that “connects to existing DNS, DHCP, and IPAM systems via lightweight agents and service points.” Those agents communicate outbound-only, linking on‑prem, branch, and cloud environments to a centralized orchestrator that applies consistent identities, policies, and automation. Local servers continue handling queries and leases, preserving performance and data sovereignty.
This is the design pattern implemented by BlueCat Horizon. Horizon “uses bi-directional synchronization between the shared control plane and connected systems so that changes made centrally or locally are reconciled automatically,” reducing operational risk and configuration drift. It also includes built-in reporting for IP utilization, DHCP lease activity, and configuration changes without separate licenses, forming a foundation for intelligent, AI-assisted NetOps over time.
Horizon’s built-in reporting focuses on IP utilization, DHCP lease activity, and configuration changes as the starting set of operational visibility.
BlueCat Horizon data sheet
BlueCat Horizon is a SaaS-based orchestration and control plane that centralizes DDI policy, identity, reporting, and automation across heterogeneous,…
Horizon
BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI
Which unified DDI visibility path is right for a Microsoft-centric hybrid network?
The right path depends on where DDI pain is sharpest—IPAM drift, cloud blindness, compliance pressure, or distributed operations—but in every case the destination is the same: a single, policy-aware DDI source of truth with centralized visibility, automation hooks, and local execution.
Consolidate DNS, DHCP, and IPAM into one source of truth
Integrate cloud DNS into centralized hybrid visibility
Establish a governance and compliance control plane
Add SaaS orchestration for distributed DDI estates
Frequently asked questions
These answers focus on how unified DDI visibility improves day-to-day operations, compliance, and security in Microsoft-heavy hybrid networks.
Still have questions?
Get real answers from a BlueCat representative.
How do you unify DNS management workflows across on-premises, cloud, and edge environments?
Hybrid and multi-cloud growth fragments DNS across Microsoft on-prem servers, native cloud DNS, and edge sites, creating IP conflicts, blind spots, and forwarding sprawl no single console solves alone. The durable fix is a control plane matched to your domain. Teams anchored in Microsoft on-prem and edge centralize with BlueCat Micetro as an overlay, no rip-and-replace. Teams whose center of gravity is cloud and multi-cloud orchestrate DDI from a SaaS foundation with BlueCat Horizon. Each governs its own domain and delivers one source of visibility and control there.
- 01 Why isn't native cloud DNS enough for a hybrid or…
- 02 How can teams tell when free or bundled DNS is no longer…
- 03 Why does integrating cloud provider DNS with enterprise DNS…
- 04 Can encrypted and modern DNS standards hold together across…
- 05 What should teams look for in an approach to unify hybrid…
- 06 How do lean teams centralize on-prem and edge Microsoft DNS…
- 07 How do you orchestrate cloud and multi-cloud DDI from a…
- 08 Which approach to unifying hybrid DNS management is right…
- 09 Frequently asked questions
- 10 Every source cited in this analysis
Why isn’t native cloud DNS enough for a hybrid or multi-cloud enterprise?
Public cloud DNS services are designed to serve compute inside a single provider's tenant and lack the mechanisms to distribute or interoperate DNS data beyond those boundaries. In a hybrid or multi-cloud estate, cloud DNS is unlikely to be the only DNS service an enterprise relies on, and treating it as one creates real availability, compliance, and security gaps.
Each cloud has different, conflicting, or missing support for zone delegation, recursion, and forwarding, and there is no name server interoperability for distributing zone data outside the cloud-delivered service. Providers historically vary on DNSSEC support, and reliance on a third party introduces outage risk for an essential network component. When that provider has an outage, the impact can be substantial.
Where cloud DNS is used without extending on-prem DDI, BlueCat sees four recurring outcomes: lost visibility into IP space that leads to conflicts and outages, separate cloud and on-prem DDI silos, complex forwarding rules that consume resources and invite misconfiguration, and suboptimal SaaS delivery that degrades user experience. Hybrid environments require centralized management of DNS, DHCP, and IP address management that cloud DNS does not provide.
Cloud DNS: Benefits and obstacles for hybrid networks
Unsure about cloud DNS services and hybrid-cloud enterprises? Learn more with BlueCat, including why it isn't so simple for managing networks.
How can teams tell when free or bundled DNS is no longer enough for enterprise networks?
Free or bundled DNS is no longer enough when ad hoc configurations, undocumented workarounds, and reliance on a few experts turn DNS into a fragile, hard-to-scale dependency. At that point the operational risk and maintenance burden outweigh any license savings.
Relying on free DNS tends to produce non-standard configurations, custom scripts, and device-specific tweaks that only a handful of engineers fully understand. As hybrid initiatives, new applications, or acquisitions arrive, every change on that foundation requires more workarounds, raising the odds of misconfiguration, outages, and slow incident response because critical knowledge stays trapped in individuals.
The true cost of free Microsoft DNS combines administrator labor for DNS, DHCP, and IPAM changes, time spent firefighting unexpected issues, and the business impact of outages. A single disruption can cost hundreds of thousands of dollars, and at scale can lead to multi-million-dollar monthly losses. Treating those events as an unavoidable side effect obscures a measurable, recurring cost that can be modeled against modernization options.
The true cost of “free” Microsoft DNS is the sum of administrator labor, firefighting time, and the business impact of outages — not the license price.
Deciding when free or bundled DNS is no longer enough
Wondering when to replace Microsoft DNS or other free DNS services? Learn the real costs, risks, and how to get more from Microsoft DNS without replacing…
Why does integrating cloud provider DNS with enterprise DNS change your architecture?
Cloud provider DNS is a different beast than enterprise DNS. Each provider abstracts underlying detail but implements DNS features and limits differently, which can quietly break existing enterprise DNS architectures if you assume they behave the same.
In hybrid designs the differences surface around role-based access, service tags and labels, provider-specific routing, and how DNS integrates with cloud-native load balancers and identity. These constructs change how traffic, telemetry, and incidents appear, because ephemeral IPs and identity-based policies alter how traffic looks the moment it crosses into on-prem networks — which matters for monitoring, source-IP tracking, and incident response.
Teams should adopt metadata-driven policy models based on identity, tags, and labels alongside legacy IP-based controls, and combine cloud fundamentals with hands-on labs to observe behavior. Organizationally, avoid a silo where legacy teams keep the lights on while a separate cloud group builds independently; involve DDI and firewall SMEs in cloud projects to share ownership of hybrid design.
5 IT pros on joining enterprise and cloud provider DNS
Networking pros explore integrating enterprise and cloud DNS during the fifth Critical Conversation on Critical Infrastructure hosted in Network VIP.
Can encrypted and modern DNS standards hold together across a hybrid estate?
Only with centralized policy. DNSSEC and DNS over HTTPS solve different problems — DNSSEC provides origin authentication via a chain of trust, while DoH encrypts DNS transport for privacy — so they are complementary, not competing. Holding either together across a hybrid estate depends on consistent policy that spans otherwise fragmented platforms.
DNSSEC adoption has been slow primarily due to operational complexity and legacy compatibility concerns: administrators must manage signed zones, key material, and ongoing key rotation, while backward compatibility requirements bloated DNS and added more to break. DNS Flag Day was essentially a wake-up call to DNS providers to remove older, broken, non-compliant systems and support modern extensions like EDNS.
Encrypting DNS with DoH improves end-user privacy but hampers traditional enterprise monitoring that relies on plaintext DNS to detect threats, route traffic, and apply controls. It also concentrates resolution in a small number of public resolvers. Retaining visibility across a hybrid estate therefore requires a centralized layer that applies consistent controls, including DNSSEC, across what would otherwise be separate platforms.
DNSSEC has existed for roughly 25 years, yet adoption stays slow because signing zones, rotating keys, and debugging broken trust chains remain operationally hard.
DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?
We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.
What should teams look for in an approach to unify hybrid DNS management workflows?
Teams should look for an approach that adds a centralized management layer over existing DNS rather than replacing it — one that delivers unified visibility, role-based delegation, workflow-based change control, and an incremental path to automation, while the DNS services teams already trust keep running underneath.
DNS rarely fails on technical merit; the strain is operational. As servers, zones, sites, and cloud services multiply, management fragments across native tools, spreadsheets, scripts, tickets, and the institutional knowledge of one or two senior admins. Adding more DNS infrastructure compounds this rather than solving it, so the right approach attacks the operating model instead of the platform.
Centralizing services, zones, records, and IP address data behind a single interface gives teams visibility into what exists and what changed, lets them delegate access by role without handing out full control, and applies consistent workflows to every change. Because the layer sits on top of existing services, there is no migration event. From that stabilized baseline, automation becomes a choice — codified incrementally through a REST API and infrastructure-as-code tooling such as Ansible and Terraform.
Getting more from Microsoft DNS
Simplify, automate, and gain visibility across your Microsoft DNS environment—without replacing what already works.
How do lean teams centralize on-prem and edge Microsoft DNS without a rip-and-replace?
Lean teams centralize on-prem and edge Microsoft DNS by overlaying it with a management layer that consolidates DNS zones, records, and IP address assignments into a single interface. BlueCat Micetro does this without replacing existing Microsoft DNS and DHCP servers, making it as easy to manage them at branch and edge sites as in the data center.
Fragmented management across on-prem servers and separate consoles makes consistency hard and lets IP conflicts and overlapping allocations accumulate — problems spreadsheets and disparate tools cannot track in real time. Micetro consolidates records and address assignments from on-premises infrastructure into one management interface, so teams see all zones, records, and allocations in one place and cut the risk of misconfiguration.
Micetro automates the workflows that eat engineering time: IP address assignments, subnet management, and DNS updates, plus automatic discovery of new zones and allocations as resources change. It enforces uniform DNS policies and provides audit logging to prevent unauthorized changes, giving lean teams centralized visibility, governance, and operational efficiency across on-prem and edge without disruptive migration.
Micetro consolidates DNS zones, records, and IP address assignments from on-premises and cloud infrastructure — including Microsoft Azure and AWS — into a single management interface.
Micetro simplifies hybrid cloud DNS and IP address management
Learn how Micetro can help you simplify and streamline DNS and IP address management across hybrid and multicloud environments.
Micetro
With Micetro, integrate, orchestrate, and automate your current DNS, DHCP, and IPAM network infrastructure via a single web interface.
How do you orchestrate cloud and multi-cloud DDI from a single SaaS control plane?
You orchestrate cloud and multi-cloud DDI by connecting your cloud DNS, DHCP, and IPAM systems to a SaaS-based control plane that centralizes policy, identity, automation, and reporting while services keep executing locally in each cloud. BlueCat Horizon does this through lightweight, outbound-only agents, so your cloud and multi-cloud environments join one SaaS control plane without migration.
Modern estates spread DNS across multiple cloud platforms, and appliance-bound, siloed cloud DDI introduces operational risk, inconsistent governance, and slow response when issues occur. Horizon connects those cloud systems via lightweight agents and service points, applying consistent identities, policies, and automation while preserving native cloud workflows, local performance, and data sovereignty.
Bi-directional synchronization reconciles changes made centrally or locally, ensuring consistent state and auditable change across heterogeneous deployments. Built-in reporting surfaces IP utilization, DHCP lease activity, and configuration changes from selectively surfaced metadata, without full data ingestion or extra licenses. For estates whose center of gravity is cloud and multi-cloud, Horizon delivers one source of visibility and a path to AI-driven NetOps, without moving on-prem execution.
BlueCat Horizon data sheet
BlueCat Horizon is a SaaS-based orchestration and control plane that centralizes DDI policy, identity, reporting, and automation across heterogeneous,…
Horizon
BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI
Which approach to unifying hybrid DNS management is right for your estate?
The right choice depends on where the immediate pressure sits, on-prem and edge Microsoft-centric operations or cloud and multi-cloud sprawl. Micetro governs the on-prem and edge Microsoft domain, Horizon governs the cloud and multi-cloud domain. The two paths below map to where your pressure sits today, and a true hybrid estate runs each in its own domain.
Overlay on-prem and edge Microsoft DNS
Orchestrate cloud DDI from SaaS
Run each domain on its own control plane
Frequently asked questions
Common questions from teams unifying DNS across on-premises, cloud, and edge environments.
Still have questions?
Get real answers from a BlueCat representative.
What are the best enterprise strategies for hybrid and multicloud DNS forwarding across on-premises and cloud environments?
Public cloud DNS alone cannot span on-premises, cloud, and edge, and as estates grow, forwarder sprawl, overlapping IP space, and provider walled gardens erode visibility and invite outages. This pillar covers why cloud DNS falls short, how to standardize naming across AWS, Azure, and GCP, DNS security trade-offs, and what a centralized forwarding approach needs. Two paths follow, chosen by where your estate lives: Micetro modernizes on-premises Microsoft DNS in place, and Horizon runs cloud DDI with observability.
- 01 Why isn't public cloud DNS enough for hybrid and…
- 02 How do you standardize DNS naming conventions across AWS,…
- 03 What new DNS challenges do hybrid and multicloud networking…
- 04 What are effective strategies for DNS security and threat…
- 05 What should teams look for in a hybrid DNS forwarding…
- 06 How do lean, Microsoft-centric teams modernize on-premises…
- 07 How do teams unify cloud and multi-cloud DDI with network…
- 08 Which hybrid DNS forwarding path is right for your estate?
- 09 Frequently asked questions
- 10 Every source cited in this analysis
Why isn’t public cloud DNS enough for hybrid and multi-cloud environments?
Public cloud DNS services are designed to serve workloads inside a single provider's tenant and do not deliver the cross-tenant, cross-cloud, and on-premises connectivity that hybrid enterprises need, a gap that creates availability, compliance, and security risk.
Cloud DNS is optimized for compute inside its own environment, with limited or conflicting mechanisms for zone delegation, recursion, and forwarding beyond those boundaries, and little name-server interoperability outside the cloud-delivered service. As the analysis notes, “cloud DNS is unlikely to be the only DNS service your enterprise relies on.”
Relying solely on cloud DNS leaves teams guessing at IP allocation, splits DDI into separate silos, and forces complex forwarding rules that invite misconfiguration and outages. “Enterprises need highly available network services that can deploy and scale and across heterogeneous architectures, from on-prem to cloud” which means extending on-premises DDI into the cloud.
Cloud DNS: Benefits and obstacles for hybrid networks
Unsure about cloud DNS services and hybrid-cloud enterprises? Learn more with BlueCat, including why it isn't so simple for managing networks.
How do you standardize DNS naming conventions across AWS, Azure, and GCP?
Standardizing DNS naming across clouds requires involving DDI teams early and enforcing consistency through centralized DDI practices and third-party tooling that span the account, VPC, and provider boundaries the clouds themselves do not bridge, because each public cloud exhibits heterogeneous support for DNS features and readily duplicates names across boundaries.
Self-service adoption creates “islands of cloud”, many teams spin up accounts, VPCs, zones, and records without DDI expertise. “This decentralization fragments DNS management, reduces visibility and control, and increases interoperability issues across heterogeneous stacks,” producing duplicated names and one-off forwarding rules across boundaries.
Providers also differ on supported record types, DNSSEC (AWS and GCP support it; Azure does not), and hosted-zone limits, so cross-boundary resolution stays brittle. Because the clouds will not interoperate across their own walls, consistency has to be imposed from outside: “organizations should involve their DDI teams early in cloud adoption to design consistent, enterprise-grade DNS that spans on-premises and multiple clouds,” supported by third-party discovery and management tooling.
AWS, Azure, and GCP cap hosted zones at 10, 250, and 10,000 respectively; one of many inconsistencies that force workarounds and complicate naming across a multi-cloud estate.
Comparing AWS, Azure, and GCP cloud DNS services
The public cloud presents major challenges for DNS management. Examine various capabilities and limitations of Azure, AWS, and GCP with BlueCat.
What new DNS challenges do hybrid and multicloud networking introduce during cloud migrations?
Hybrid and multicloud networking introduces segmented virtual networks, overlapping IP space, fragmented DNS namespaces, and new security boundaries that make traditional ad hoc DNS stitching unmanageable and push teams toward a brittle patchwork of conditional forwarders.
Cloud networking replaces familiar Layer 2 domains and clear public/private boundaries with VPCs, peering, gateways, and private endpoints across providers. Microservices and Kubernetes multiply DNS names, while multi-cloud designs “create overlapping IP space and fragmented namespaces that outstrip typical cloud team skills.”
Manually maintained conditional forwarders and stub zones become a “wild west” that erodes visibility and security as the environment grows. DDI teams regain control by establishing a single, authoritative source of truth for DNS, DHCP, and IPAM, because “single source of truth is necessary to drive any level of automation with success.”
Hybrid cloud environments routinely accumulate thousands of conditional DNS forwarding rules, concentrating risk and operational burden on a small group of DNS experts.
Hybrid and Multicloud Networking Strategies for Cloud Migrations
Hybrid multicloud DNS should centralize DDI, governance, and cloud integration to avoid brittle forwarding and restore visibility.
What are effective strategies for DNS security and threat detection in hybrid environments?
Effective DNS security for hybrid environments combines integrity and visibility: DNSSEC provides origin authentication through a chain of trust, while preserving enterprise visibility into plaintext DNS queries remains essential for threat detection; the reason many organizations approach DNS over HTTPS cautiously.
DNSSEC and DoH solve different problems. DNSSEC signs DNS data so resolvers can validate that responses are authentic and untampered; DoH encrypts DNS transport for privacy. They are complementary, not competing but “DNSSEC provides origin authentication via a chain-of-trust but is hard to configure and maintain.”
Encrypting DNS with DoH “hampers traditional enterprise monitoring that relies on plaintext DNS,” reducing the visibility security tools use to detect malware and route traffic, and concentrating resolution in a few public resolvers. That trade-off is why hybrid threat-detection strategies prioritize retaining query-level visibility.
DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?
We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.
What should teams look for in a hybrid DNS forwarding approach?
Teams should look for a centralized approach that treats each data source as a namespace with ordered, prioritized forwarding, maintains a single source of truth across on-premises and every cloud, works across all major providers, and automates DNSSEC rather than requiring manual command-line work.
“Decentralized or parallel management of DNS infrastructure can result in a situation where automation becomes harder to achieve.” The first criterion, then, is centralized, intelligent resolution: when the resolver is the first hop, it checks each namespace in the administrator’s chosen priority order and forwards only if the previous source returned no answer.
The second is cloud neutrality and low-toil security, resolution certified across AWS, Azure, Google Cloud, and private clouds so DNS is managed consistently wherever assets live, plus DNSSEC that propagates across parent and child zones automatically instead of manual key generation and trust-anchor redistribution.
Secure, cloud-managed network services through DNS
DNS can be a major headache in the cloud, but it doesn't have to be. When centrally managed with tools for intelligent routing, DNS can be an asset.
How do lean, Microsoft-centric teams modernize on-premises DNS and DHCP without rip-and-replace?
Lean teams modernize on-premises DNS and DHCP by orchestrating migration in place with BlueCat Micetro, which replaces manual exports and late-night cutovers with wizard-driven, transactional workflows across Microsoft, BIND, Kea, and Cisco IOS, reducing effort while preserving a one-click rollback path.
Micetro treats every migration as a secure transaction using the same object model as its REST API, so data stays consistent and pre-flight verification catches configuration conflicts and missing dependencies before any change is applied. “Pre-flight verification eliminates change risk,” with automated halt-on-error and instant rollback removing the cutover anxiety.
It can even recover DNS zones and DHCP scopes from offline or decommissioned hardware using cached metadata and backups, so legacy Microsoft servers retire without being brought back online. Because every function is exposed via REST API, bulk migrations integrate with Ansible and Terraform for gradual, on-premises modernization.
Wizard-based migration with built-in validation reduces migration effort by an estimated 60 to 80% compared with manual export-and-script processes, with fewer post-migration incidents.
Automate your DDI modernization path by migrating with Micetro
Automate cross-platform DNS and DHCP migration with Micetro to reduce risk, eliminate manual effort, and modernize infrastructure faster.
How do teams unify cloud and multi-cloud DDI with network observability as SaaS?
Teams whose center of gravity is cloud-first and multi-cloud unify DDI with observability through BlueCat Horizon, a SaaS platform that brings DNS, DHCP, and IPAM together with network observability so addressing and resolution data can be correlated with live telemetry for faster incident response. It is the cloud-domain choice, selected by estate, distinct from the on-premises modernization path, not layered onto it.
Horizon functions as a common control and integration layer across SaaS-based offerings, providing shared API gateways, authentication, and centralized AI analytics. EMA identifies unifying DDI and observability as a strategic shift, because it enables cross-product workflows, context-driven operations, intelligent traffic steering, and closed-loop security responses that were previously siloed.
Its architecture separates cloud-based control from local data and service residency: the control plane, AI, and orchestration run in the cloud while protocol services and high-volume telemetry can remain in the customer’s chosen cloud environments. Adding new services becomes less disruptive because integrations and data flows already exist within the platform.
EMA Impact Brief: BlueCat Horizon
EMA evaluates BlueCat Horizon, highlighting unified DDI and observability, SaaS control architecture, and AI-driven integration benefits.
Which hybrid DNS forwarding path is right for your estate?
The right path depends on where your estate's center of gravity sits and what your immediate priority is: gaining visibility, modernizing on-premises without disruption, or running cloud-first DDI with observability. Most organizations progress iteratively, but the products divide cleanly by domain; choose the one that matches where your workloads and your risk actually live.
Establish visibility and a single source of truth first
Modernize on-premises in place with Micetro
Run cloud and multi-cloud DDI with Horizon
Frequently asked questions
Common questions from teams designing hybrid and multi-cloud DNS forwarding.
Still have questions?
Get real answers from a BlueCat representative.
HS136 – Sponsored Bluecat
[John Burke] (0:00 – 0:05)
Hi, I’m John Burke, CTO of Nemertes, here with my co-host.
[Scott Robohn] (0:05 – 0:14)
I’m Scott Robohn, CEO of Solutional and host of Total Network Operations, a sibling show here on Packet Pushers.
[John Burke] (0:16 – 0:28)
And you’re listening to Heavy Strategy, the show that tries to ask the right questions, not give the right answers. Joining us today is Andrew Wertkin, Chief Strategy Officer at BlueCat Networks. Andrew, thanks for joining us.
[Andrew Wertkin] (0:28 – 0:30)
Thank you for having me. I’m looking forward to it.
[John Burke] (0:30 – 0:52)
And on today’s show, we’re going to be talking about just what a network management company is going to talk about, the challenges of using AI for enterprise network automation, because we all know IT folks are bending AI to the task of speeding up network automation efforts. Why isn’t that as simple as it sounds? Why can’t we just take Claude’s word for it 99% of the time?
[Andrew Wertkin] (0:54 – 2:08)
Yeah, just put it in a permissive mode and just click go. Done. Yeah, you know, it’s interesting because, you know, I’ve been in, well, I’ve been developing software since I can remember. You know, there’s a reason I can’t write. I’ve been typing my entire life. And I’ve enjoyed the craft very, very much. But you know, it’s been interesting on the network side because the teams have been doing a really good job. And by the teams, I just mean network engineers out there driving automation, like, you know, pre-code generation, pre-LM, and really trying to sort of, you know, mature the methodology of developing software akin to how software development companies develop software. And with AI and with LM-driven or generated code, without those best practices, it’s kind of scary to think about what might happen on the network. So, you know, it comes down to probably a further transformation in those teams to sort of more sophisticated processes around software development, because the faster stuff can be created, the more stuff can break, probably.
[Scott Robohn] (2:09 – 3:24)
You have a thesis that really resonates with me, right? I would say, you know, one of the other hats I wear is a co-founder of an organization called the Network Automation Forum. And as of recording today, I’m coming off our last meeting, AutoCon 5 in Munich, Germany.
And, you know, we started that discussion on the attenuation against the adoption of network automation before AI entered the room, right? And so there’s always been a certain level of resistance to letting automation go full throttle. And now, you know, the bots and the agents are walking into the room and, you know, the eye rolls are happening and the skepticism is strong. I would love to use that as part of our conversation here to say, I agree with you. We need to see great best practices develop in software engineering and software development, because a lot of what we do in network operations is downstream from that. So I know I’m throwing a little maybe taking a little too much time here up front, but just that’s my perspective. And I’m really interested to have this dialogue with you.
[John Burke] (3:24 – 3:42)
Yes, super. And I think you’re spot on. The distrust issue of automation in the network shop runs 25 years deep. I mean, we have been hurt. We have been hurt badly by trusting automation too far, too fast, many times.
[Andrew Wertkin] (3:43 – 6:00)
Yeah, what I always hear is trust, trust more so for repeatable, templated actions. Yep. If it’s outside of sort of simple, repeatable, templated, then, yeah, that’s where that sort of lack of trust starts, starts coming in pretty heavily. And, you know, as we know, our brethren, a vendor coming by saying just point and click, simple, easy automation is probably the worst way to gain trust with end customer. You know, the more sort of opaque it is, the more concern there usually is, which, yeah, is, you know, drives, it just sort of accelerates potential that distrust in the world of AI, you know, and I don’t know, well, we can talk about ways to sort of approach it and drive more trust, but, you know, it’s not just in networking and network, you know, it’s obviously across the board. You know, many of us have lived in environments where source code control wasn’t being used, where, you know, reviews weren’t done appropriately, where code was copy and pasted from somewhere else without being scrutinized for current environment, where I could just go on and on and on.
And you can trip like, you know, 10 of those major issues and like within a day if you’re if you’ve only accelerated it, but it does bring a tremendous amount of promise. And but it’s not just it’s not just software development, right? It’s debugging what’s going on and trying to figure out what’s going on in live environments and why it’s not working in some of those areas. As long as you stay, you have somebody with the right expertise and you stay critical of what you’re being told, the amount of work that be done in a short amount of time is just it’s it’s amazing, just absolutely amazing. As long as you’re not just like, oh, you said it’s that it’s that, OK, I should do this, I should do this. That’s where the concern is, because we know the LM’s, you know, tend to as hard as you prompt them otherwise tend to get pretty black and white about, you know, they think they found the root cause.
[John Burke] (6:01 – 6:43)
I like with the idea of accelerating automation, the idea that you’re going to be able to help people accelerate better practices if they’re using better practices with AI, they’ll get to the end of their automation project more frequently. They won’t leave it half finished or three quarters finished, never fully debugged, never fully documented. Right.
And then move on to the next emergency. There’s more chance that they’ll be able to in a single day or two days or a week or two weeks get all the way through and leave something behind that they can actually use again confidently as opposed to, you know, with some fear and trembling.
[Andrew Wertkin] (6:44 – 6:58)
Yeah, yeah. It’s a lot of it’s just about architecture. A lot of it’s about. Well, one is that, you know, the appropriate developer mindset, which is I’m writing this for the people that will maintain in the future, so let me keep that in mind.
[Scott Robohn] (6:58 – 7:02)
Which is automatic, right? Every developer thinks about that from day one.
[Andrew Wertkin] (7:02 – 9:15)
Yeah, yeah, yeah, yeah, yeah. Especially when it started with, oh, you know, we need a quick script to try to solve this issue. And and, you know, and then somebody finds that six months later or. So a lot of it comes down to architecture, you know, like a lot of what is going to be in that automation will be repeated, right? Like how do we authenticate or what are standards around logging or how do we want to log or, you know, just how are we going to interface with with our devices? How are password faulted and how do we get those out of the vaults and, you know, how do we want to test or how should we think about backing out changes or whatever the case might be? Almost everything I just listed off is something that is repeatable and in this appropriate methodology. Well, now you just need to go sort of add your business logic, not necessarily all these other pieces. And and therefore all the code stays fresh and it’s being tested and on and on. But, you know, it’s it’s it’s really easy to build something quickly. And everything I just listed off also sounds like it’s going to take longer than just having eight people reel off a different, fully functional, you know, A to Z scripts, applications, you know, whatever we’re building. And so it’s just there’s there’s, you know, it’s probably more important than ever to sort of start with the right foot forward and start thinking about how we’re going to make this sustainable and and, you know, where humans will be in the loop and where they, you know, it’s critical they’re in the loop.
And, you know, what what sort of practices are we going to bring forward to do this safely? All of these things are just, you know, it’s many of these are the same things we’ve always considered or we’re concerned about as building software over, you know, the last several decades. Right. Some of it’s just how rapidly it can be done now. And and it’s not like just people copying and pasting stuff off of Stack Exchange.
[Scott Robohn] (9:16 – 10:33)
Like anybody can have code generated that works in that environment, you know, like that’s easy to do, it’s, you know, and that it was not the case two years ago, like I think like we you were in the middle of this fast changing and experimental time, right, where if you go back just a couple of years, you know, people had their their initial experiences with chat based tools and got widely varying results. You know, the whole nondeterminism of LLMs thing that was that was our first experiences. And then, you know, we see we see the advent of vibe coding and what an enabler it is for prototyping and but what a spaghetti mess it can produce for an enterprise code base to now emergent methodologies like spec driven development and test driven development. Like, I think we’re seeing the emergence of, OK, here’s how I use the tools, you know, and here’s how I can actually build trust in the technologies versus my first, you know, chat GPT three dot X experience. Right. What are you seeing on those fronts, you know, in the emergence of these strategies and repeatable tools that are coming up?
[Andrew Wertkin] (10:34 – 11:59)
Yeah, no, we’re we’re we’re seeing them for sure and have been experimenting and adopting a couple. I think we’re we’re. We my company and also me personally have had the most success is interestingly, like the part I spent probably the least time about in my career, not the company, but me personally, which is that upfront spec development and working with the LM on trade offs, and that’s where I can bring in my experience and how should we approach this and spending that time up front, breaking it down into reasonable chunks and and then, you know, putting the appropriate guardrails in place and, you know, that that sort of stuff has been transformative and versus, you know, trying to type out a prompt describing exactly what you want, just the sort of iterative spec and test development that really starts with, OK, I want to create a high speed TCEBF logger. Right. I’ve never done that before. Right. And and so I don’t even know what the trade offs are. And so, you know, I’m not I’m not, you know, so how much can I trust, you know, whatever? But I can start at a very high level. I want to do this. What don’t I know?
[John Burke] (11:59 – 12:47)
Intent. You got it. Yeah. I think there’s a really important point, sort of one level underneath that, which is that stating your intent and need very clearly is crucial because when you’re having software twiddle the settings on hardware out in your network, twiddling the wrong settings shuts down the traffic flow or overburdens the processors so much that you get, you know, terrible performance drops as it as it maybe devotes all of its time to generating logs and sending them. So, you know, you’re in a space where infrastructural mistakes can happen and can happen at automation speed and have really huge consequences.
[Andrew Wertkin] (12:47 – 14:57)
Yeah. Yeah. I mean, in our world of DNS, I mean, just on the public side, if you look at the last several major outages that were announced by huge public corporations, I think, you know, 80 percent of them were automation driven change to DNS that took everything down, you know, and and now that I’m not going to remotely blame an LLM for that. That’s just but but you just, you’re well more likely the faster you can come up with the solutions and the more especially the more certain your your coding partner or your debugging partner, your performance partner, whatever the use case might be, the more certain they are, the more likely you’re going to be like, OK, you know, and then and then, you know, they’re everybody suffers from permission fatigue and. You just your fingers over enter and you just keep pressing it, you know, and so, you know, that comes down to also like, how do we how do we appropriately supervise the behavior and make sure those things don’t happen?
But, yeah, and, you know, so the more successful that sort of more successful express intent includes those things. You know, what do you know could potentially go wrong? What are you concerned about? What do you make sure is actually tested? What does load actually mean here? How should it behave? Now, you don’t need that stuff up front, but having the right experience to know what sort of the categories of things that you should probably be considering are good, you know, but what what you don’t need to do, and I think this is really matured in both tooling, but also process over the last six months, insanely small period of time, is just that you don’t need to start by writing a four page prompt on exactly what to deliver, right? You you do if you’re using like a, you know, less expensive, more run rate type model, like not a frontier model, but but just have a frontier model, write the spec for the run rate model. You know, you don’t need you’ll never be as good as an LLM in generating prompts.
[Scott Robohn] (14:58 – 15:55)
Right. Well, I I so I’ve layered in a technique where I basically ask the LLM to interview me where I’ll bring, you know, a page, page and a half of intent that’s reasonably detailed. And if you’re using it, using the process to develop all the all the all the right markdown files for SDD, number one, it’s it’s cheap. I know there’s token cost here, but, you know, I’m creating human readable documents that I can validate and verify after I’ve gone through an interview process. And I heard a great comment last week. You know, the code is free in a sense where, you know, we’re used to thinking about us, you know, laboring to get the code just right. But now we’re asking agents to write the code and we can iterate and we can throw away stuff that looks like garbage. And you still have to have enough domain knowledge to know that it’s actually garbage, right?
[Andrew Wertkin] (15:56 – 16:32)
Exactly. And that last point is, well, on the personal side, sort of my fear, what everything looks like in 10 years, but but also the most critical thing now without the domain knowledge and the sort of experience and expertise of how things can fail and how things should work and how they should gracefully fail and on and on, then then you’re you’re asking for trouble. But but yeah, I like that sort of and I do that to probably less regiment than you do. But that sort of like, you know, what what am I not thinking about here? Exactly. What else could go wrong here?
[John Burke] (16:33 – 16:53)
And when the LLMs are just as happy to bring you the, you know, deadly poisonous mushroom as the tasty and edible mushroom, and they look the same to a casual inspection. Yeah, that kind of domain expertise becomes irreplaceable and absolutely necessary.
[Andrew Wertkin] (16:54 – 20:08)
Yeah. And here’s what happens and why process is so important here is people sit down and they think they’re on the same page with the LLM. And, you know, over a couple of weeks, it seems to be true, like it’s seemingly remember stuff. And then, you know, on day seven, you start a new session and seemingly it forgot everything it ever knew. And it’s been sort of degrading over the week because you haven’t been documenting this. You haven’t been having, you know, saving the appropriate memories and making sure you’re updating your prompts and everything else. And then it makes a decision that is unbelievably naive. And you, because we humanize these things, have this thought of like, you know, you’re you’re working with a doppelganger or who is this person I’m working with? Like, how is it possible they forgot this? And so there’s a lot of errors that occur in those moments when operator, developer, network operator, whoever’s using it, is unclear of the state of the memory of the session and assumes some not necessarily something deterministic, but something at least informed by things we’ve done in the past is about to happen. And then, you know, surprise, you know, and and what do we call that? Like, you know, part of it is rediscovery tax. So, you know, I’m going to spend a lot of money as in tokens or credits or whatever in rediscovering the same thing over and over and over again because it’s not appropriately documented. And and these are things that the LMs in general, but, you know, depending on the coding tool. But, you know, I tend to use Claude a lot, but but regardless of you, several. But, you know, they’re really good at, you know, every time I end a session, like, what did we do? What did you have to rediscover and what that you had to rediscover? Should we should we appropriately document so you have to rediscover it again? And that’s not everything, because, you know, experimentation works. Sometimes you learn a ton when you make mistakes, you know, and maybe going back to the personal side is still professional side of sort of hardened software, like software that works, as we say, like works in anger, doesn’t just work in the lab. It doesn’t just work in the happy cases like it works, put pressure on it and still works. And, you know, getting getting to that point is, you know, it takes takes experience of having done it, but specifically having failed at doing it like it’s like, you know, something smells bad because you once made that error before, you know, or you around when that happened. And that kind of learning, which is, you know, very specific to the very large context sizes of our brains, you know, like is like you don’t even have to go review your notes. You’ll spot that pattern immediately if you’ve had the experience of failing, it just it’s wired in and those are things I just don’t know how they’re going to happen, you know, without purpose, without purpose.
[John Burke] (20:09 – 21:10) And I sometimes hear people saying it won’t be too long now when, you know, we won’t even be having AI develop these scripts or these programs for us. We’ll just tell it what we want to have happen. It’ll spin up a program in the background, send it off and get the thing done. And the next time we need it done, it’ll generate a program and send it off to get executed and we’ll be done. So it’s like it will be creating automation for us. It’ll be the automation. Sure. And for me, I think what you’re saying right now is the pushback on that. It’s like, OK, but the second time it sees this problem and it’s time to generate a program to solve it, is it going to remember how it solved it the last time?
Is it going to remember what went wrong and how it got fixed? Maybe, maybe not. I think until that problem is resolved and resolved by stuff that works in anger, as you say, like no matter how mad I am when I type the prompt to the AI, it’s still going to give me the right answer and the good answer. Then it’s not solved.
[Andrew Wertkin] (21:11 – 24:34)
And yeah, then it’s not solved. And the only thing I was going to add to that is you run into the opposite problem of, of, um, you know, cause the elements are matching patterns basically. Uh, and so something looks like it fits this pattern. It doesn’t mean that’s the answer. And ironically, like if you only have a couple of cases of this sort of like, you know, something failed, here’s why I know the pattern, like then the more likely something’s going to get sort of, you know, force fit into that, like, you know, pound the, the, the round peg into the square hole if it almost fits, you know? And, uh, and it’s just, I think there’s a, still a bit of a chasm between, um, especially in the world of Brownfield, but, but, uh, between, right, I’m just going to state my intent and the scripts will be written, stuff will be done. I’ll never have to look at this twice. Um, for that actually being done in an enterprise network where, um, you know, you don’t have all the tools today to get that done. Um, you don’t necessarily have the budget today to get that done. Um, and you have history. And that history includes things that are not good in the world of AI, which are things like tribal knowledge and one-offs. And, you know, this was done for a very specific reason, but there’s like yellow tape around it. Nobody knows why, but we just know if we change it, everything breaks. So, so we’re not changing anymore. You know, it just, this was never documented that wasn’t documented. So, um, you know, I, I just go back to, um, one of the sort of, um, really well-known, um, foundation books in software development that, that, you know, tools and tactics have changed, but this book is as true as it ever been was, uh, Martin Fowler’s refactoring, which, which I think in the forward, like the first, in the first couple of paragraphs, it says, if you can’t test, put this book back on the shelf, um, paraphrasing something, something close to that, like you can’t change it unless you can test it. And in this world of like, um, you know, tribal knowledge and one-offs and not everything following a pattern, um, how, how are you going to, how are you going to approach that, um, especially if there’s nothing to test against your lab, doesn’t have those one-offs, your lab, you know, it’s how do we actually test this appropriately? And, and, and that’s what causes all of this, you know, longer change management process. They know the organization’s learned if we touch that, it’s going to break. So that’s only going to happen on like this type of change window where we have three and a half hours and nothing else can be scheduled during that change window and like they’ve, they’ve never fixed the underlying problem, but they’ve, they’ve wrapped it around process. And so, you know, companies also enterprise is going to have to look at, you know, where to start with this stuff. Um, and, and stating the obvious, um, uh, net new is, uh, you know, build this way to begin with great, um, changing something exists, whether that’s software or a network architecture, um, that’s way harder for humans and LLMs, uh, but on the L at least the humans hopefully have some of the tribal knowledge.
[Scott Robohn] (24:35 – 26:08)
One of the, so another exciting thing that I think is in front of us here is, you know, to your point of everything you’ve just laid out. Um, you know, if I have an LLM, everything looks like a prompt, right. And we’re, I think many of us are figuring out that, you know, not everything is a problem for an LLM. And, and we have, we have this really interesting and potentially useful set of new computational techniques in front of us, and we haven’t gotten rid of all the others. Like machine learning is still really useful for other things in the, in the AI space, statistical regression last I checked doesn’t really cost me any tokens. Right.
Right. So I’m adding to the tools in my toolbox and the really fun puzzle that’s going to be in front of us all is like using the right tools for the right job here. LLMs where they make sense, ML where it makes sense, regression where it makes sense, um, maybe for the, the, the problem that you called out of, you know, reinventing the wheel every time the question’s asked, maybe part of my constraints are, okay, I’ve solved a problem and I’ve put it into my IT service catalog. And if there’s something in my service catalog that is a 90% or better match for this prompt, use what’s in the service catalog and don’t spend tokens on creating another solution for it. And I’m, I’m riffing here, right? But I think these are all like approaches we need to put on the table as we collectively all figure this stuff out.
And I’m, I’m much more positive about it than I am cynical about it. Um, check in with me in a year and see if I say I feel the same way.
[Andrew Wertkin] (26:08 – 30:11)
So, no, it’s interesting on that sort of service catalog side. I mean, it’s in the good news is just have the LM check to see if you solve the problem before, you know, and, uh, and they’re again, super good at matching patterns, they’ll find something. And that’s actually like of all the sort of techniques I’ve developed, uh, over the last year, let’s say, um, that sort of tight link between, uh, documentation of what I did and what I actually did is, um, is, is, is super both from the perspective of, you know, it’s, it’s, it’s quick story. I years and years ago, I was CTO of a company in the application lifecycle management space. So we built software to help build software and we specifically, um, like part of our, like ideal customer was in, uh, embedded software that was safety relevant where, um, a defect could cause harm to the operator, for instance, um, like automotive or, you know, you name it. And so, um, there in, in that world, there’s all sorts of standards like ISO 26000 and, and, uh, automotive SPICE and on and on. And part of the standards around, like there must be traceability between requirements and code. Right. Um, and if the requirements change or the code changes, that trace becomes, um, you know, potentially problematic. And I’m going to go in and look for any of those impacts and I’m going to have to say in this change, by the way, I changed the code, the requirement still, you know, is correct. The test case is still correct. The architecture is still correct.I’m going to have to go do that for all these suspect traces. Um, and that like, you know, you’re not going to convince somebody building, um, B2B software that they need that level of traceability. Right. But like I do that when I’m doing LLM based development, cause it’s amazing, you know, one and mostly, well, I enjoy it, but, but also because the LLM then goes and traces. Um, and the LLM can quickly figure out why we did something the way we did it, because it can trace back to the documentation and, and, and the LLMs writing that documentation and the LLM knows to write the documentation for itself, which is something that, you know, like, um, uh, even if I, sometimes I will say, write this for a human, sometimes I’ll write it like, you know, write this document for a customer that may or may not be aware of software development, how software development works, or may never have installed Python before, whatever the case might be. Um, but oftentimes with those docs, I’ll be like, um, either include an addendum just for an LLM or just write this for an LLM and, um, and one, it’s more terse, but two, like, you know, LLMs are pretty good at writing documents for them to read and, uh, and, um, you know, both from an efficiency and cost standpoint, reading it, right. You know, like, um, the human version is, is more expensive, but regardless of that, um, that also like goes to this, um, okay, now I’ve included in the right software for the next person to maintain to also write software for the next LLM to maintain. Um, and given it, you know, the capability obviously to pull in and parse a lot of text rapidly, um, yeah, I’ve never had better documentation in my code or outside of my code. Um, would never have done this much documentation as a human. Um, ever, uh, you know, with the assumption, like most humans have, like while you’re writing it, uh, yeah, I’ll remember this. Yeah, this is pretty easy to read. Like I’ll just read the code, like it’s obvious or anybody would understand what I meant by that. Yeah, exactly. Yeah. I said, sorting, I’m sorting here, you know, and, um, and that, that those things lead to a tremendous amount of defects, but so does, um, uh, that, you know, even worse sometimes, I mean, what’s the old adage? Like the only thing worse than, um, no internet connectivity is crappy internet connectivity. That’s right.
Yes. Yeah. It same thing with documentation.
[John Burke] (30:11 – 30:48)
So in a way, um, you’re both mentoring your AI to improve its domain expertise. You’re teaching it more about what it means to run a physical network of physical devices and what the risks are and, uh, what the limits of experimentation are and so forth. Uh, and at the same time, you’re mentoring it on being a good team member by doing things like documenting its code and explaining itself for sure.
[Andrew Wertkin] (30:48 – 32:30)
No, it’s a good, it’s a good analogy because, um, that’s what I usually, uh, advise people is like, um, yeah, especially if they’re, they’re senior, like, um, yeah, just imagine you’ve got four junior to intermediate software developers working with you and, um, and that are pretty self assured, you know, like that, that are convinced they’re correct, you know? And, and so if one of them said to you, no, no, this is the best way to do it. You would say, why, what evidence do you have? Do we have enough evidence? You know, like what alternatives did you pursue before you came to the solution? And if you think about your interactions like that, then, then you’ll always think about what the right question, even though from a ability to generate code that works rapidly, you know, this is not a junior or intermediate software developer, but in terms of thought process, um, yeah, in many cases, intermediate software developers is, is, is, you know, is, is better thought process, you know, in other words, cause it’s thought process, it’s not, it’s not pattern matching and, and, you know, the other magic of LMs. Um, and so like that, I think that’s the biggest mistake, uh, people, you know, whether it’s, it’s bias, you know, confirmation bias or otherwise, like, um, uh, people are looking for, um, that sort of positive, this is how we’re going to do it. And, uh, and if they say, Hey, I was thinking about this, this is a good idea. We all know. Um, that’s the worst way to interact with an LLM because it’s going to happily come back and tell you brilliant. Wow.
[Scott Robohn] (32:31 – 32:39)
Yeah. You are so smart. That’s the best way I’ve ever heard. Yeah. Just, just include no sycophancy in every one of your problems.
[Andrew Wertkin] (32:39 – 33:53)
Yeah, no, a hundred percent do that. Cause I, I, I don’t need that from my peers, my employees and my parents. I definitely don’t need from an LLM, but, um, I do like it for my wife every once in a while. Um, but, but regardless, and my kids definitely, but regardless of that, yeah, no, it’s, but that idea that you’re like, you are the expert here and you’re working with, um, uh, something with less knowledge than you do of what you want to create and how it should work and what success looks like and how it’s failed in the past. And just keep that mindset, keep that mindset, keep that mindset. And then at some point you feel like, this is like, I’ve got the four best interns in the world working for me because that to me with the LLM, maybe five, sometimes seven, but like, it’s, you know, um, uh, the, the acceleration of being able to get this done tonight, please launch 10 parallel agents.
I wouldn’t say please, by the way, launch 10 parallel agents and run through our blitz testing protocol. And then I wake up in the morning and a whole team has been doing work all night and, uh, I, I don’t feel guilty. I don’t feel, you know, I, I have my coffee and read through the results and very powerful.
[John Burke] (33:53 – 34:32)
And you’re sort of, I think by implication saying what vendors like you can do to support this kind of work in enterprise network shops, and that is, you know, basically building the power tools that those AIs can wield with appropriate safety features. So, you know, the, the, uh, circular saw has the automatic shutoff, so you can’t cut your own fingers off as easily as you used to be able to things like that. Uh, you want to help them not crash the network by failing to do the obvious things with your power tools.
[Andrew Wertkin] (34:32 – 39:51)
Yeah. No, it’s interesting. Cause like, you know, like, um, most, uh, software vendors today, one of the things that we, we produce our, our MCP servers for our backend products.
And we have several backend products and, and, um, and I think like a lot of vendors out there, like initially that was just, okay, let’s wrap up our open API tools and this new protocol. And we’ll just expose that and, you know, uh, LM will figure it out. And you realize pretty quickly that, um, that’s not the right approach at all. You’re just going to waste a ton of tokens. It can be a ton of guesswork. You just sit there watching the LM guess and guess and guess. And, um, uh, you know, you’re yes, no, I’m can pretty quickly figure out how to use a rest API. And if it’s wrapped in, in, uh, MCP tools even faster, but that doesn’t mean they understand your domain. And yes, especially the frontier models have been trained on not just your domain, but probably understand more about your product than you might realize. Um, but, but none of them, um, like part of, part of what we deliver, it’s, it’s not just, um, you know, uh, more, uh, domain specific tools than an open API. Like, you know, have more conversation between the MCP server and our backend server than the LM has to see. Don’t don’t send the, uh, there’s a packet capture example. Like there’s no reason to send the LM a 20 megabyte packet capture that that’s, that ain’t going to do anything or send it a whole time series that you should be sending to, uh, ML, not, not in AI, you know, like, and so how do I get the data needs summarized data, maybe even opinionated data, because we know our systems well, so, you know, with, with sort of opinions built in. What does the LM need to answer the user’s question, which might’ve been like, you know, why doesn’t this work and think through that stuff as opposed to just, it’s a bit, I’m going to use the word lazy, but it’s a naive. I think it’s the better word. It’s naive just to assume the LMs will figure this stuff out well. And especially if you want this stuff to be remotely repeatable. Um, so yeah, so we do that, but it’s way more than that. Like, so now, you know, we just went through software development stuff. And, and so like, yeah, our, our customers can now pump out tons of automation scripts and otherwise against our products, super. How do we encode the best practices for doing that? So our customers don’t, you know, automate themselves into, um, downtime. So that, uh, so that they know, and that comes out in things like, you know, uh, network advisors and other things that, that, um, whether through prompts or, uh, specific code or capabilities or training material, like, uh, help our customers succeed at automation, because in our industry, like on the DDI side of our industry, on the, in the world of DNS and IPAM, especially, um, the tailwind of this industry has always been automation. You have to change the stuff faster. And so, um, it, we want our customers to be successful. It, it pains us. Um, we had a customer a few years ago, well before LMs, and it just going back to an example of like, um, the horrors that can happen if there’s no processes around the way you develop software was sort of teaching himself how to script against our product. And he had an administrative user and he wrote a script and went to test it and deleted the entire DNS environment inside this company, which immediately locked him out of systems and active director was down and they’re using that for LDAP and yada, yada, yada glass had to break. And it was, and he’s sitting there, um, like I can imagine I’ve, I’ve had that experience before, you know, like, um, I think once in university, I wrote an endless loop in an application running on a like old IBM PC where there was no, like you couldn’t control seed. You couldn’t like, you know, three hours of work. The only thing I can do is reboot the computer. You know, I know that sort of, that’s one of several examples, some being professional, that sort of sinking feeling of, oh crap. Yeah, we, we got, and I can imagine what was going through that guy’s head, you know? And, um, and so like, yeah, obviously that’s an extreme example, but my point is, um, the more we like, um, we always get asked in software development, like, uh, about metrics and measurements and somebody always goes, well, why don’t you guys just use like lines of code or something? And that’s like, yeah, like the idea for anybody in software engineering that the number of lines of code they wrote, the more, the better is a appropriate metric is, is insanity, right? So we don’t do that and nor do we suggest it. But my point is like, when you start thinking about the right metrics, well, certainly in the world of SAS, but now also in the world of like these scripts, it’s just not about like, the question is, did it work the way we expected it to? Was this a successful automation? Um, and, and what did we learn that didn’t succeed? And, and how do we sort of bring that back into a feedback loop? And like, it doesn’t, um, you know, I mean, I was like, uh, the, the least number of lines of code to solve a problem, the better, but, but mostly did it actually solve the problem?
[Scott Robohn] (39:52 – 40:36)
Well, in going to, you know, least lines of code as, as the other, um, could cause other problems, right? And like, again, one of the things that really jazzed about this whole environment and conversation is like the art of specifying our constraints is becoming much more important, um, probably than it ever has in our careers, right? You know, we’ve got power tools, where are we going to put the right blade guards on? And there were grounding plug. Um, my grandfather made a power tools for Porter cable. And I’ve actually have some of his old prototypes that I would never use to build a deck because there are pieces missing that keep losing digits. Right. So the system’s thinking, um, and there’s tribal knowledge.
[Andrew Wertkin] (40:36 – 40:39)
Cause yeah. Somebody else can, uh, that was right.
[Scott Robohn] (40:39 – 40:44)
For sure, John, this could go so many ways. Like, where do you want to take this?
[John Burke] (40:44 – 41:20)
Well, I think just to, to round it out, I want to follow through on this idea that, uh, folks in the business now need to be thinking about their software portfolio as power tools that will ultimately be wielded by robot hands, not human hands. And, um, how that’s going to change the enterprise software landscape. You know, we’ve talked a bit about how it changes process inside the enterprise, uh, for using it, but what about the rest of it?
Like, does it change licensing? Does it change, uh, you know, how else does things for sure.
[Andrew Wertkin] (41:20 – 44:13)
And I think, I mean, you know, part of it is sort of what you’ve seen in what the, you in, in the private markets in general with, um, with the devaluation of some software companies, which, uh, like, you know, we, well, we all should know the stock market doesn’t is, is it’s own thing. It’s his own thing. Yeah. Uh, but, but outside of that, um, it, for sure, it’s going to change licensing models. Uh, like, you know, if you’re only, if your licensing model is just based on per user and I’m not saying cause everybody’s in a fire, everybody, I’m just going to say, okay, what’s an agent is an agent user. And, and, um, uh, you know, it, it, it, yeah.
Companies are going to have to figure out, um, you know, what, what the right metric is going to be. And, you know, a lot of companies are switching to, okay, it’s going to be credits. And that’s the real value is, you know, how, how much you’ve pushed through this LM or how much, and, and their, you know, enterprises don’t like surprising bills every month.
Um, they, they like consistency, you know? And so, um, I, I think, uh, you know, early companies, especially the, the LM companies themselves, or the AI companies themselves, obviously are very focused on a sort of an opaque credit type, um, model where we all know the price is going to keep going up and up. We won’t be able to do the networking vendors.
Won’t be able to go in there and go up. Sorry, your bill this month is, um, yeah, it’s twice as much this month because yeah, we’ve changed the ratio between, um, credit and token. And, uh, and by the way, uh, we improved our stuff. So it’s better. So you’re going to pay more. Like it doesn’t work that way in our world. And so, yeah, I think licensing models are going to have to change. And, um, uh, uh, but so much, so much more than that, I think there’s going to be, I think we now have the opportunity, you know, how, how we always sort of go back and forth between platform and best of breed and platform and best of breed. I think we’re going to be heading back towards best of breed because sort of interoperability between these vent a lot between different products has become, um, much simpler to solve. Um, especially with things like MCP, like I don’t necessarily think I need a specific integration to, uh, ITSM systems anymore because all the ITSM systems, uh, have the ability to speak MCP. And so, um, that becomes easier, uh, picking a platform versus best of breed, but, but so, so in certain areas, it’s going to be disruptive to businesses where, you know, if their only goal was put as much stuff in our platform as possible, uh, and nobody will be able to compete with us, uh, that’s gonna change. Um, you know, and, uh, and I think should I launch in this? Yeah, I’ll do the 60 second, 30 second version.
[Scott Robohn] (44:13 – 44:13)
30 second.
[Andrew Wertkin] (44:14 – 44:29)
Yeah. Yeah. It used to be like in the world of big, ugly central systems that nobody can change, like the big ERP systems and stuff like that, like where companies would have to, like in their earnings report would be, we missed it this quarter because of a bad upgrade to this massive internal system.
[Scott Robohn] (44:29 – 44:31)
That wasn’t that long ago.
[Andrew Wertkin] (44:31 – 45:58)
Yeah, it wasn’t that long ago. Yeah. And that was like, that was like the whole Salesforce marketing campaign initially with the no software. And we got that for you and all this greatness about, uh, SAS, um, uh, in that world, how they started getting disrupted was all these like new companies were bringing SAS based systems that were easy to use. They’re still the system of record, but here’s this new system engagement for HR, for travel management, for purchasing, for whatever, any part of that system. And then of course, those large companies in that space would just go buy those companies one after the next, after the next, after the next. And so to some extent, I, outside of the, I’m not quite sure acquisition is going to happen at, at, uh, there can be way too much to acquire.
Um, you’re going to see a lot of companies that, um, are coming up with system of engagement, like value propositions for existing platforms out there to slowly start taking user engagement or system engagement, uh, away. And, um, and that’s going to happen way faster than, than, uh, travel management and, and, uh, you know, goals on the HR side or purchasing or whatever these system engagements were that sort of started doing this with a large internal system. So in that world where it’s simpler to disrupt or at least do better a small part of an existing platform with integration almost laid out for you, I think that’s going to sort of drive this, you know, us back to best of breed.
[John Burke] (45:59 – 46:42)
And I can even, you know, envision taking it, uh, really far down that path. Uh, only the AI’s that work for us really understand what the software portfolio currently is because a new service pops up, they see that if they can do half of what they need to do in functional area X better, faster, cheaper. So now I’ve got two things in that area and it’s the one managing what work goes to which one. And, you know, it’s like a redundant array of software vendors kind of an approach. Uh, I’ll just arbitrage wherever it works best against the criteria that my AI, uh, understands for me matter the most saving time, saving money, better performance, whatever. Yeah. Yeah.
[Andrew Wertkin] (46:43 – 50:10)
Yeah. Cause I, I see like go to some expo floor in tech these days, especially in networking, but, um, you know, pretty much any, any tech related area. And you’re going to see company after company after company, uh, selling your platform for AI, you know, no matter where they came from, they’re now have a platform for AI that’s going to be multi-vendor. Why not? Everybody’s got MCP servers. And, and so what are you going to have as an enterprise, multiple platforms for agentic operations, uh, a single platform, um, uh, you know, one meta agent that manages a bunch of other agent platforms. What if I put the wrong one here? And, uh, and, and how quickly can I change? And, uh, um, and, and we seemingly, and I don’t understand this part cause it’s not the way I work, but people do have easy bias as well.
Oh. Oh yeah. They said they can handle this all for me. So I’m just going to buy that, you know? And, uh, and it comes down to like this theme. It’s funny, you know, earlier I said, I gave a real example. I had never written a EBPF, like, uh, you know, uh, internal space, high-speed logger. And, uh, and now I have, I still couldn’t write one. Um, right.
I use that as an experiment of what if I follow this process in an area that yeah, I’m well aware of how this stuff works, but I’ve never actually written software there. Like what will I learn? What I learned was how rapidly I can do something that I didn’t know how to do ahead of time. Um, and just with establishing the things we’re talking about before, like, you know, criteria and exit criteria and things I’m concerned about, I’m worried about, I have something that works. I don’t know if it’s the best way to solve the problem I started with. I don’t know if like, uh, you know, all I know is it’s maintainable code that, that works.
I mean, you know, I know more than that. That’s really well documented. So, so I guess my point is, um, uh, just like people still need to learn this stuff, you know, to, to sort of bring that experience forward. And that, I mean, like as much as I appreciate this technology, that’s my biggest fear is just, um, the worst mistakes always start when somebody believes they’re right. And people are either too intimidated or too starstruck or too odd or just too lazy to question person who for sure knows how to get something done. And the end result are things that could have been prevented that cause, um, problems. And we, we see that across like, you know, everything from tech to, uh, social environments to everywhere else, you know, and, uh, groupthink or, but, but, you know, it’s, um, that’s what I rely on my experts for, uh, you know, even if they don’t know, even if it sounds right In fact, the more right it sounds to them, the less likely they’ll take that at face value, uh, because there, there must be something wrong with this. What is it? It’s a puzzle. These are, you know, engineers in many cases. And, and, um, um, so as much as I appreciate the technology, use the technology, pushing forward with the tech, like creating value with the tech, uh, there’s part of it that just makes me uncomfortable.
[John Burke] (50:12 – 50:35)
Uh, a solidly cautionary note on which to end the conversation. Yeah. Thank you, Andrew, for joining us today. This has been fantastically interesting and lots for the enterprise strategist to chew on as they think about how things go next, uh, in their it shops. Uh, Scott, thank you so much for, for joining us today as well. And as always, thanks to everyone watching.













