Modernize mission-critical DDI

Secure, automate, and unify DNS, DHCP, and IPAM

BlueCat marketing page highlighting DDI mission readiness risks and a 44 percent statistic for U.S. defense managers

DDI complexity puts mission readiness at risk for U.S. defense and intelligence agencies

U.S. defense and intelligence agencies rely on the core network services of DNS, DHCP, and IP address management (together known as DDI) to keep mission systems reachable, resilient, and ready. But many federal environments still depend on fragmented tools, manual workflows, inconsistent data, and disconnected DNS and DHCP services across enterprise, cloud, remote, and operational networks.

This fragmentation results in real risk to mission readiness. Network teams lose time reconciling spreadsheets, chasing stale records, coordinating changes across silos, and responding to avoidable outages. As modernization accelerates, legacy DDI slows provisioning, limits visibility, and makes it harder to enforce consistent controls, underscoring the need for a unified approach.

Federal agencies need a way to manage DDI infrastructure across tactical environments, data centers, and the cloud from a single pane of glass to boost visibility and control.

DDI management your way: Appliance-based or an overlay on existing systems

BlueCat Integrity is a full appliance-based DDI solution that provides DNS and DHCP with centralized IP address management (IPAM), policy control, and automation. BlueCat Micetro is an overlay to help you manage existing DNS and DHCP services without forcing a major replacement project. With Micetro, network teams can centralize control while keeping current systems running.

With Integrity or Micetro, defense and intelligence network teams can:

  • Manage DDI across tactical, base, and cloud environments
  • See DNS, DHCP, and IP address data in one place
  • Reduce manual work with APIs and automation
  • Control who can make changes with role-based access
  • Track changes with audit logs and event data
  • Modernize at the pace that fits the mission
unified-ddi

44%

of DDI managers identify network resilience as the top business benefit of investing in a commercial DDI solution. Source:From DIY to BlueCat: Customers Earn ROI Within Three Months, Enterprise Management Associates

Now, we not only see our entire IP address space in one view, but we can also manage both DNS and DHCP through the same interface.

Senior security engineer, American multinational transportation company

A common DDI operating model built for federal modernization

A defense or intelligence network team may support users and systems across bases, remote locations, and cloud services. Without a common DDI view, each environment can become its own silo, leading to slower changes, more manual tracking, and riskier troubleshooting.

BlueCat’s solutions give network teams a common DDI operating model. Whether you implement a full appliance-based deployment or an orchestration layer over what you already have, you can see and manage IP space, DNS records, DHCP services, and related changes from one place.

The result is modernized DDI for mission-critical networks that results in simpler daily operations, faster troubleshooting, and better control over the network services that agencies depend on.

Next steps

Learn how BlueCat can help defense and intelligence agencies modernize DDI for mission-critical networks.

BlueCat’s Intelligent Network Operations (NetOps)

BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.

Isometric blue UI tiles showing gear, shield, chip, and magnifying glass icons on a grid background

Mission-ready network insight

Unified observability for defense and intelligence networks

BlueCat marketing page with 87 percent network operations statistic and text on fragmented network observability risks

Fragmented network observability puts mission-critical services at risk

U.S. defense and intelligence networks support users, applications, and mission services across distributed, multi-vendor environments. When device health, traffic flows, packet data, alerts, and change history are fragmented in separate tools, network teams lose valuable time trying to connect symptoms to root causes. The result is slower troubleshooting, more blind spots, and higher service availability risk.

Network teams may know something is wrong, but not whether the issue comes from device saturation, interface errors, traffic congestion, packet behavior, security anomalies, or a recent change.

Federal agencies need network observability solutions that consolidate operational evidence in one view, connecting device telemetry, flow analytics, packet-level insight, automated diagnostics, and AI-guided analysis. Network teams can better see what is happening, understand why, and act before issues disrupt critical missions.

BlueCat connects network observability signals

BlueCat’s network observability solutions bring together complementary observability capabilities for network and security teams. This reduces tool pivoting and helps you move from reactive monitoring to proactive mission assurance.

Solutions include:

  • BlueCat LiveNX, which offers observability for traffic behavior, performance, and application paths and Network Resource Monitoring, an add-on to boost device visibility and telemetry
  • BlueCat LiveWire, which provides packet-level intelligence for network forensics, and Security Insights, an add-on for fast packet-level anomaly detection and forensics at the network edge
  • BlueCat LiveAssist, which applies AI to telemetry, alerts, and configuration data, giving teams natural-language access to urgent risks, potential root causes, and recommended next steps
  • BlueCat LiveAssurance, which offers automated diagnostics, validation, and recommended remediation for critical infrastructure, including post-change verification
Abstract 3D-style dashboard with bar charts, donut chart, and numeric network analytics metrics on a grid background

87%

of network operations teams use multiple network observability tools. Source: The Network Observability Maturity Model: How to Plan for NOps Excellence, Enterprise Management Associates

LiveNX has significantly improved our organizations network performance monitoring capabilities, allowing us to promptly identify and rectify network issues, thereby minimizing downtime.

Senior technology services specialist, FedEx

Use case: How network observability solutions can help when a mission service degrades

When a mission service degrades, defense and intelligence network teams can start with LiveNX to identify affected paths and traffic patterns. You can then use Network Resource Monitoring to check device health, pivot into packet evidence with LiveWire where deeper analysis is required, and then use LiveAssist or LiveAssurance to guide root-cause analysis and remediation.

Implementing network observability solutions benefits operations in several ways, including:

  • Faster diagnosis with shared operational context
  • Fewer escalations caused by missing evidence
  • Lower risk from undetected device, traffic, security, or change-related issues

Next steps

Discover how BlueCat can unify network observability across defense and intelligence networks.

BlueCat’s Intelligent Network Operations (NetOps)

BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.

Isometric blue UI tiles showing gear, shield, chip, and magnifying glass icons on a grid background

Remote Packet Capture Engine

Forensic-grade endpoint visibility to eliminate blind spots and accelerate troubleshooting

LiveAction Remote Packet Capture Engine marketing header with description of forensic-grade endpoint packet collection and analysis

Challenge

Enterprises often lack visibility into user endpoints, creating blind spots that hinder troubleshooting and increase risk. Without insight into remote devices, teams struggle to diagnose issues, determine root causes, or analyze traffic outside the corporate perimeter.

Solution

An add-on to BlueCat LiveWire, Remote Packet Capture Engine provides forensic-grade endpoint visibility Windows and Linux devices, eliminating blind spots, accelerating troubleshooting, and enhancing the remote user experience—all within a single unified observability platform.

Benefits

  • Accelerate root cause analysis
  • Support remote users
  • Detect endpoint threats
  • Extend LiveWire’s value with seamless, unified visibility into

Enabling forensic-grade packet collection and analysis directly from laptops and workstations

Today’s enterprise network is no longer confined to the data center. It spans hybrid clouds, software-as-a-service (SaaS) environments, remote offices, and—most critically—endpoints such as laptops and mobile devices used by employees working anywhere.

Many organizations still focus their monitoring and packet capture on core infrastructure and network edges, leaving a major blind spot at user endpoints. Without visibility into what is happening directly on devices, IT and security teams face critical obstacles, including:

Incomplete diagnosis: IT teams cannot isolate application slowness that only occurs on a user’s machine without packet data from that endpoint.

Extended downtime: Troubleshooting delays compound user frustration and impact productivity.

Uncertain root cause analysis: Is an issue caused by the corporate wide-area network, SaaS provider, internet service provider, or the device itself? Without definitive packet-level evidence, teams guess rather than know for sure.

Security exposure: Endpoints are common entry points for cyberattacks. If packet data is unavailable, threat activity may remain invisible until it causes real damage.

Many incidents traced back to remote workers begin at the endpoint level. Lacking forensic-grade visibility not only increases risk but also undermines trust between IT teams and business stakeholders.

This solution brief presents how Remote Packet Capture Engine extends the power of BlueCat LiveWire to user endpoints, enabling forensic-grade packet collection and analysis directly from Windows and Linux devices. This brief offers specific use case examples that provide clarity, accelerate resolution, and maintain smooth business operations. It also highlights key differentiators from other solutions and outlines primary benefits.

Solution overview

As a part of BlueCat’s network observability and intelligence offerings, Remote Packet Capture Engine, an add-on to LiveWire, provides teams with clarity to eliminate blind spots, enhance remote troubleshooting, and improve the end-user experience.

Remote packet capture provides definitive data from the source, whether it’s a remote employee experiencing application slowness or an executive reporting intermittent connectivity issues.

Instead of waiting for physical access or shipping devices back to IT, network and security teams can:

  • Remotely capture live packet data from the user’s device—anywhere, anytime.
  • Perform forensic-grade analysis on session flows, latency, jitter, and retransmissions.
  • Correlate endpoint traffic with infrastructure-level data already captured by LiveWire.
  • Eliminate blind spots and create a continuous view from user devices to cloud applications.

This capability transforms the IT team’s operating model. What once required hours or days of back-and-forth with frustrated users can now be resolved in minutes with definitive, packet-level evidence.

LiveWire interface listing engines with host, version, last contact status, and management controls

Figure 2: LiveWire dashboard with a list of remote engines

How it works

The Remote Packet Capture Engine architecture is built around three tightly integrated components that deliver secure, centrally orchestrated packet capture across Windows and Linux environments:

  • Remote Packet Capture Engine endpoint agents deployed on Windows and Linux devices
  • LiveWire, serving as the centralized control plane (physical appliance or virtual instance)
  • Floating license server, which can run standalone or be hosted directly on LiveWire

Windows agents support both manual installation and automated deployment through any MSI-compatible third-party deployment tool. Linux or container agents can be deployed either manually or through container orchestration platforms. Each agent automatically establishes a session with the floating license server, checks out a license from the shared pool, and maintains an active health check with LiveWire. Routine heartbeats ensure the agent is reachable, healthy, and ready to capture when instructed.

By design, a Remote Packet Capture Engine agent does not capture packets until explicitly configured and activated. Multiple agents can be deployed at scale, all of which are visible from the LiveWire interface. From LiveWire, administrators can centrally configure filters, start or stop captures, and manage each remote agent. Once a capture is complete, the resulting packet file can be securely retrieved into LiveWire for analysis.

LiveWire centrally manages multiple remote packet capture engines that automatically register and securely upload packet data


Figure 1: Remote Capture Packet Engine architecture

Five types of use cases

Every second counts when resolving issues that impact users. These use cases demonstrate how Remote Packet Capture Engine delivers instant clarity, empowering network teams to cut through the noise, accelerate resolution, and keep business operations running smoothly.

Use case 1: Troubleshooting end-user performance issues

An employee reports intermittent slowness or connection drops in an internal or SaaS application. Remote packet capture enables network operations teams to capture and analyze traffic directly from the user’s device, helping them determine whether the root cause lies in the network, the application, or the local machine.

LiveWire web dashboard listing multiple packet captures with status, adapters, packet statistics, and start times

Figure 3: LiveWire dashboard with a list of capture sessions running on remote engines

Use case 2: Supporting remote and hybrid workers

IT teams need to diagnose problems for employees working from home, on the road, or outside the virtual private network. Remote packet capture enables end-to-end visibility without requiring physical access to the endpoint, significantly reducing mean time to resolution.

Use case 3: Application-level performance analysis

Users can experience slow performance with specific apps, such as VoIP, video conferencing, or internal business systems. Packet capture at the source provides visibility into session flows, jitter, retransmissions, and latency, helping to differentiate between application, network, and device issues.

Use case 4: Navigating threats at the endpoint

A device shows signs of unusual traffic or a potential breach. Packet-level data from the endpoint helps security teams investigate threats, trace lateral movement, and identify command-and-control traffic.

Use case 5: Executive or VIP user support

A C-level executive reports sporadic connectivity issues or degraded performance. High-priority support teams can initiate a remote capture without disruption, providing immediate and accurate diagnostics.

Key differentiators

Targeted or always-on capture

Flexible options to maintain continuous collection or initiate packet capture as needed.

Scalable agent management

Manage thousands of endpoints from the LiveWire interface.

Forensic-grade analysis

Leverage advanced analytics to dissect traffic down to the packet level.

Secure and lightweight

Minimize performance impact on endpoints while ensuring secure data transmission.

Solution benefits

Accelerate root cause analysis

Quickly determine if issues are network-related or endpoint-specific, without needing physical access to devices.

Improve support for remote users

Capture and analyze traffic from remote laptops, regardless of location.

Enhance your security posture

Get insights into endpoint traffic patterns to detect anomalies or malicious activity.

Maximize return on existing investments

Extend LiveWire’s capabilities with endpoint visibility and utilize a unified workflow.

Next steps

Discover how Remote Packet Capture Engine can transform your network operations.

BlueCat’s Intelligent Network Operations (NetOps)

BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.

Isometric blue UI tiles showing gear, shield, chip, and magnifying glass icons on a grid background

Intelligent Forwarding

Optimize network traffic by directing DNS queries to the right destination across hybrid environments

BlueCat Intelligent Forwarding solution brief webpage showing DNS query optimization overview and hybrid network architecture

Challenge

To better optimize DNS traffic across on-premises, cloud, and hybrid environments, network teams need DNS management solutions that tame conditional forwarding rules, automate tedious and error-prone processes, minimize latency, and prevent DNS attacks.

Solution

BlueCat Edge, a DNS resolver and caching layer that leverages your existing DNS infrastructure, uses Intelligent Forwarding to direct queries to the right destination across your hybrid environment. With each DNS query, Edge can apply security policies and forwarding rules, boosting visibility and control over DNS traffic.

Benefits

  • Reduced complexity
  • Consistent DNS resolution across hybrid and distributed infrastructure
  • Lower latency
  • Stronger network security

Directing DNS queries to the right destination every time

Whether the challenge is a DNS migration that must be outage-free, a corporate merger or acquisition that requires combining network environments, or a cloud integration that requires a single source of truth for DNS, network teams need DNS management solutions that reduce risk and automate tedious, error-prone processes. Furthermore, as branch offices expand worldwide, enterprises also need to optimize DNS query routing to cut costs and minimize latency.

And overarching everything is security: Network teams also need a solution that can provide IP source data for queries and apply restrictive DNS configurations and policies to help ward off DNS-based attacks.

This solution brief explains how BlueCat Edge uses Intelligent Forwarding to direct DNS queries to the right destination rather than manually maintaining reams of conditional forwarding rules across multiple authoritative DNS servers. This brief explains how Edge works and provides specific use-case examples that demonstrate how it intelligently applies security policies and forwarding rules to every query, ensuring DNS traffic moves safely and optimally through the cloud. It also highlights key differentiators from other solutions and outlines primary benefits.

Solution overview

Edge is an intelligent DNS resolver and caching layer that leverages your existing BlueCat Integrity DNS infrastructure to provide unprecedented visibility and control over DNS traffic. As a first hop DNS resolver, Edge intelligently manages DNS forwarding policy and logs all queries to offer intuitive analytics and data governance.

With Intelligent Forwarding, network teams can architect DNS resolution routes by leveraging Edge namespaces. Network teams get:

  • Optimized DNS resolution: Edge provides multiple DNS query resolution paths while simplifying DNS data segmentation.
  • Improved network performance: Used as both a caching and forwarding server, Edge reduces network congestion.
  • Direct Internet Access: You can use a cloud-managed solution to enable Direct Internet Access for remote branch locations.

How it works

When Edge receives a DNS query, it determines the zone to select the appropriate DNS namespace(s) from. It considers the matching destination zone, source IP or network, security policies, and the forwarders’ order of priority.

After determining the zone, Edge selects the appropriate DNS namespace(s) for resolution. Once Edge determines a set of potential forwarders to query, it tries each selected namespace in order, looking for a valid response. If the resolver receives a negative response from a namespace, it will remember the answer and move on to the next namespace, attempting to resolve the query again until it receives a positive response. If all namespaces are exhausted without a positive response, then a negative response is returned to the client.

To leverage Intelligent Forwarding, a namespace is configured with one or more DNS forwarders and can optionally include match and exception domain lists. Each site in Edge has at least one associated namespace, up to a maximum of 10. DNS caches are segmented across namespaces to prevent mixed responses from different resolution paths. Edge can fully optimize query performance and maintain states between a variety of DNS authorities to ensure an optimal client experience.

Namespaces also allow zone overlap. You can add or modify individual records in a zone on an authoritative server without needing all resource records in that zone to be available. Dynamic environments, such as cloud computing, require zone overlap, as different networks may use the same zone but require different responses for subsets of records. Unlike traditional conditional forwarding rules or other resolver solutions, Edge’s forwarding policies provide this flexibility with simple administration and make DNS resource record management easier.

Figure 1. A network environment that has resources in AWS and Azure while having a domain called xyz.com. If none of the queries match, it will forward to an external resolver.

Nine types of use cases

This section outlines nine real-world scenarios that demonstrate the benefits of using Edge Intelligent Forwarding to extend traditional DNS forwarding and gain greater control over resolution across hybrid and distributed environments.

Use case 1: Split-view DNS zones

Enterprises often use different views of the same zone for private and public DNS. This allows the same services, with the same names, to be resolvable both internally and externally. Split view (often called split brain or split horizon) allows each view to be managed separately, as if they were different zones.

However, resource records in the external zone view must also be maintained in the internal view. This leads to errors. Enterprises have tried to solve this by using web proxies to arbitrate service locations. In some environments, an “internal root” overrides the public root zone, fully segmenting these DNS namespaces. The move to Direct Internet Access breaks this, leaving enterprises without a way to resolve split-view records.

Edge intervenes at the DNS level to address split views of DNS zones. Clients can resolve multiple views and use Direct Internet Access for zones outside corporate DNS infrastructure.

How Edge helps: Intelligent Forwarding lets you create two namespaces for xyz.com—one internal and one external. Edge keeps trying to resolve after a negative response to ensure successful resolution. A query destined for xzy.com would have a matching zone indicating it should be queried in both the internal and external xyz.com namespaces, returning the external answer only if no internal answer is found. This removes the need to manage split-view DNS.

Figure 2: When an environment has the same internal and external domain names, the biggest challenge is often ensuring that the correct resolution path is utilized.

Use case 2: Mitigating outage risks during migration

Most DNS migrations use planned cutover periods to migrate data. A major concern for organizations is the risk of outages during migration. Each migration event (some migrations span upwards of 50 events over several years) carries a risk that missing or misconfigured DNS data in the new environment could cause an outage. Mitigating that risk is critical.

How Edge helps: During migration to Integrity, you can use Intelligent Forwarding to build a resilient DNS infrastructure. This avoids outages caused by missing or misconfigured DNS records. Edge queries the new BlueCat infrastructure first. If there’s a negative response, it then queries the legacy DNS server.

Figure 3: A typical initial state when using Edge with a traditional DNS migration.

Use case 3: Stealth migration for faster completion and reduced outage risk

Migrating DNS with zero downtime is possible. But it can be slow, labor-intensive, risky, and expensive, depending on your infrastructure and tolerance for service disruption. Before most migrations, you must expend significant effort to cleanse existing DNS data to ensure only accurate, relevant records move to the new environment.

With Edge, organizations can migrate from legacy DNS environments to Integrity’s DNS infrastructure programmatically, passively, and efficiently.

During the initial phase of BlueCat’s stealth migration process, Edge is configured to forward DNS queries to the legacy DNS environment. Records returned from the legacy infrastructure are recreated and copied into the new BlueCat DNS infrastructure. Queries that receive a negative response are forwarded to the new BlueCat DNS infrastructure.

After a specified period, the order of the namespaces will be swapped. This makes the new BlueCat infrastructure the primary for DNS queries. Any query that receives a negative response from BlueCat will then be forwarded to the legacy DNS infrastructure. The record for any query resolved by the legacy DNS infrastructure will then be recreated in the new BlueCat DNS infrastructure.

How Edge helps: A stealth migration uses Edge’s query log to migrate data as records are queried. By leveraging namespaces, you can migrate records on the fly, allowing resolution to continue and removing the need for a traditional cutover.

Figure 4: A typical initial state when using Edge with a DNS stealth migration.

Figure 5: A typical final state when using Edge with a DNS stealth migration.

Use case 4: Network integration via DNS for mergers and acquisitions

Integrating a merger or acquisition into your infrastructure is challenging. Outages or other problems caused by name conflicts, overlapping IP space, or complex forwarding rules often need manual intervention.

Edge lets queries from legacy and acquired networks avoid resolution failures by querying authoritative DNS servers directly. This helps network teams identify and resolve DNS data. Coupled with the previously described stealth migration process, this allows rapid merging of DNS data while retaining a passive, low-risk approach.

How Edge helps: Admins can use domain lists to configure Edge to route client requests to the right DNS server. Edge then uses stealth DNS migration to move only relevant, accurate data between organizations. After the migration, the namespace order is updated to ensure optimal resolution paths.

Use case 5: DNS query route optimization

In traditional hub-and-spoke networks, all non-local traffic is backhauled to a central data center. This often causes DNS query response localization issues and can saturate already highly utilized, expensive WAN circuits.

Edge optimizes your DNS query path. This lets you buy smaller routers than you would need with additional traffic, reducing infrastructure requirements at branch locations and overall WAN spending. An optimized query path also provides hidden benefits, such as reduced latency and unblocked end user access to more localized services.

For example, servers send queries to the store301.xyz.com zone locally, avoiding backhauling traffic to the core data center. Traffic to predefined, trusted external services, such as Office 365, is routed directly to a local external resolver via the branch’s ISP connection. This improves performance, reduces WAN costs, and delivers more localized DNS responses.

How Edge helps: Configuring Edge with domain or zone match lists for a namespace optimizes query routing. This prevents localization issues and reduces excess DNS traffic on WAN links.

Figure 6: Utilizing Edge to provide local breakout to trusted services while ensuring local resolution occurs properly.

Use case 6: Creating a single source of truth for cloud DNS integration

Cloud-native DNS is usually managed as an isolated component. This prevents a single DNS solution from being the sole source of network truth. To ensure DNS resolution continues to function, hybrid cloud environments introduce

complex forwarding rules, leading to inefficient routing of network traffic over VPN or dedicated network connections. Customers who move to a multicloud solution will also struggle with complex cross-cloud forwarding rules. Moreover, cloud migrations and deployments can lead to DNS resolution and performance issues that are difficult to debug without complete visibility.

With Edge, all cloud-centric DNS traffic is routed to a local DNS resolver, which determines the most appropriate resolver to forward it to. Network teams can manage both cloud and on-premises DNS from a single pane of glass.

Private link services across major clouds often share zones across virtual private clouds (VPCs) or virtual networks (VNets). However, because Edge can resolve across overlapping zones, specific private link records resolve correctly.

All resolution data is available for auditing and debugging. Each query’s source is tracked, and you have full visibility into latency and other performance data.

Cloud computing is usually broken down into segmented services with predictable DNS usage. This provides ample opportunity to segment DNS with policies for accessing remote services or to reduce the risk of systems being exploited to use DNS for command-and-control.

How Edge helps: With Edge, you can configure namespaces in one of two ways. First, you can use a domain list that includes the appropriate domain name for your cloud provider. The second method is to configure namespaces in a priority order that first looks for intra-VPC or intra-VNet traffic, then for shared services VPCs or VNets, and finally for on-premises DNS.

Figure 7: A typical cloud integration configuration. Queries go into the VPC or VNet, then to a shared services VPC or VNet, then to on-premises DNS.

Use case 7: Proxy bypass and Direct Internet Access

Proxy servers are typically centrally located in core data centers to optimize costs. Thus, internet-bound traffic is forced to route through central locations, which can often lead to inaccurate service localization, high latency, and poor user experience. The centralization of proxy servers further complicates local internet breakouts at remote and branch offices.

With Edge, you can ensure clients resolve all queries, both internal and external, enable local breakout for Direct Internet Access to trusted services, and maintain the control and oversight required by security teams.

How Edge helps: With Edge namespaces, you can configure DNS traffic to query an internal or external resolver or an internet-based resolver based on the targeted domain name. Edge is also deployed in remote or branch offices to provide for local breakout.

Figure 8: A typical configuration for proxy bypass with Direct Internet Access from a remote branch.

Use case 8: Securing IoT devices

Infrequent updates and/or a lack of security patches for Internet of Things (IoT) devices make them vulnerable to cyberattacks. While IoT devices are largely serviced like any other node on the network, their nature often leads to insufficient monitoring of their activity. This, combined with the fact that many have unfettered access to DNS data, makes them a lucrative target for bad actors.

With Edge, you can restrict DNS access for IoT devices to specific pre-approved records and apply security policies to them even when traditional controls, such as security agents, may not be available.

How Edge helps: With Edge, you can implement specific DNS configurations and security policies to centrally manage IoT devices. DNS policies are applied to permit access only to predefined internal and external services. Using namespaces, you can also specify which devices the IoT devices are permitted to query.

Figure 9: IoT devices are only permitted to use certain secure DNS servers. Everything else is blocked.

Use case 9: Augment Cisco Secure Access with visibility into IP query sources

Cisco Secure Access provides cloud-based resolvers to identify and block queries associated with specific threats. One of the drawbacks to this solution is that all the DNS requests must recurse through internal DNS servers before reaching the Cisco Secure Access external recursive system. Because of this, Cisco Secure Access loses the client’s source IP address for the queries, leading to blind spots on the internal network.

How Edge helps: BlueCat exclusively partners with Cisco Secure Access for external-facing DNS threat protection. Edge forwards external DNS queries directly to Cisco Secure Access for filtering while preserving the client source IP using EDNS Client Subnet. When identity service is enabled, queries are enriched with user identity information from the organization’s identity provider, allowing Cisco Secure Access admins to see and act on both the source IP and the user ID for every query, improving visibility and policy enforcement.

Figure 10: A configuration used when having the same domain internally and externally. If the query is destined for the internet, it is forwarded to Cisco Secure Access.

Key differentiators

Intelligent Forwarding (namespaces) extends traditional DNS forwarding. It uses a policy-driven namespace model that simplifies how organizations control resolution across hybrid and distributed environments. This model enables organizations to deliver consistent, scalable DNS behavior, reduce operational complexity, and improve visibility.

These core differentiators set Intelligent Forwarding apart from conventional forwarding approaches:

  • Namespace-based resolution—simplifying control through logical abstraction Intelligent Forwarding organizes DNS resolution using namespaces, eliminating fragmented conditional forwarding rules across multiple resolvers. This approach aligns resolution behavior to logical domains such as environments, business units, or application boundaries. By abstracting complexity into a centralized model, network admins can reduce configuration overhead, minimize errors, and ensure consistency across the infrastructure.
  • Context-aware query routing—optimized for performance and resiliency Traditional forwarding relies on static rules and lacks awareness of network conditions or upstream resolver health. Intelligent Forwarding dynamically routes DNS queries based on namespace logic, upstream health, and real-time performance metrics. The resolver actively monitors upstream availability through health checks and distributes queries based on latency and load. This approach always routes requests to the most responsive and reliable resolution path. The result is improved performance, enhanced resiliency, and seamless operation for on-premises, cloud, and multicloud DNS.
  • Centralized policy and visibility—enabling governance at scale Intelligent Forwarding consolidates forwarding logic into a unified namespace framework. It provides greater control and transparency over DNS resolution. Teams can enforce consistent policies, maintain clear segmentation between environments, and gain visibility into how queries are routed. This strengthens security posture, supports compliance requirements, and simplifies ongoing operations.

Solution benefits

Intelligent Forwarding delivers measurable operational and architectural benefits for network and security teams:

Reduced operational complexity Streamline

DNS management by replacing distributed rule-based configurations with a centralized namespace model.

Consistent resolution across environments

Ensure predictable DNS behavior across on-premises, cloud, and hybrid infrastructure.

Improved application performance Optimize

query routing to reduce latency and improve user experience.

Enhanced resiliency and availability

Avoid single points of failure by enabling flexible and adaptive resolution paths.

Stronger security and segmentation

Maintain clear boundaries between environments and control how DNS queries traverse the network.

Faster onboarding and change

management Simplify integration of applications, domains, and environments with minimal configuration.

Next steps

Discover how Intelligent Forwarding can transform your network operations.

BlueCat’s Intelligent Network Operations (NetOps)

BlueCat’s Intelligent NetOps solutions provide the analytics and intelligence needed to enable, optimize, and secure the network to achieve business goals. With an Intelligent NetOps suite, organizations can more easily change and modernize the network as business requirements demand.

Isometric blue UI tiles showing gear, shield, chip, and magnifying glass icons on a grid background
Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

What are the essential Windows Server networking fundamentals for reliable core services?

DDI Windows Server Updated

Windows Server DNS, DHCP, and Active Directory carry enterprise core services reliably at first, then reach their design boundary as estates grow, losing centralized visibility, automation, and audit control. Because Active Directory is DNS-server agnostic, teams can consolidate without breaking replication. For organizations outgrowing native tooling, BlueCat Integrity delivers full DNS, DHCP, and IPAM consolidation across complex multi-platform estates.

· 01 — The bill arrives later

Why is treating Microsoft DNS as “set it and forget it” risky for enterprise core services?

Treating Microsoft DNS as set-and-forget is risky because it works only about 90 percent of the time, an unacceptable reliability level for high-availability services, and because Active Directory, authentication, and application-to-application traffic all fail when DNS fails.

Microsoft DNS auto-deploys with Active Directory, encouraging administrators to configure it once and move on. But “’90 percent of the time’ in a high-functioning IT organization is a horrible metric.” Call centers, global load balancing, and authentication cannot tolerate that gap.

DNS is the fundamental backplane of the network; every internal and external resource depends on it, and Active Directory does not function without it. Properly managed DNS also yields visibility: DNS firewalls disrupt malicious queries, and DHCP and IPAM reveal who requests addresses on the network.

IT professional studying DNS architecture diagrams sketched on a whiteboard, planning network and cybersecurity strategy Read article
Deeper read

Ignore DNS at your Peril

When organizations don't leverage the power of DNS, they're missing out on network security, visibility, etc. How can we convince executives they need DNS?

3 min Blog
Read more

· 02 — The handoff nobody sees

How does DNS resolution actually work, from root servers to authoritative answers?

DNS resolves queries hierarchically: a recursive server with no cached answer queries a root server to learn the correct Top-Level Domain server, follows referrals down to the authoritative name server, then caches the result according to its configured TTL.

Root DNS servers sit at the top of the hierarchy, serving the root zone that lists every Top-Level Domain and managed by IANA. “Root DNS servers are the servers that literally run DNS for the entire Internet,” and “without the root DNS servers, the Internet would no longer function.”

There appear to be only 13 root servers, but that reflects an original IPv4 limitation; each of the 13 logical hostnames now sits behind highly available, globally distributed clusters. Understanding this chain and its caching behavior is the baseline for diagnosing any resolution failure.

Web UI showing IPv4 blocks with overlay cards for network allocation and ranges (10.244.50.3 and 10.0.0.0/8) and names EMEA, Read article
Deeper read

DNS Root Sever How Root Servers Work

DNS root servers are authoritative servers that direct top level domain queries and list the 13 root hostnames, operators, and IP addresses.

1 min Page
Read more

· 03 — Guilty until proven otherwise

Why is the network team blamed first when DNS problems surface across teams?

Network teams are blamed first because network changes have a disproportionately large blast radius and DNS is foundational to nearly every service. As a result, DNS misunderstandings drive misdiagnosis, blame, and slower incident resolution across IT.

“There’s this concept of Mean Time to Innocence, which is a joke, but it’s true. It’s always the network until you prove that it’s not.” Because a single change can disrupt everyone, network engineers become cautious and defensive, reinforcing organizational silos.

DNS is described as the oxygen of the environment: problems surface as application or authentication failures, such as Active Directory trust issues. Modern dynamic infrastructure makes naming indispensable, raising the need for baseline networking literacy and a shared language across roles.

Seven headshots and avatars of IT professionals featured in an IT pros debate on network silos and cross-team collaboration Read article
Deeper read

IT Pros Debate: Guilty Networks, Speaking Up The Stack, and Essential Career Skills

In the spirit of breaking down barriers, IT professionals discuss guilty networks, speaking up the stack, and essential career skills.

96 min Blog
Read more

· 04 — Received wisdom, tested

Does Active Directory actually require AD-integrated Microsoft DNS?

No. Active Directory does not require AD-integrated DNS; it is DNS-server agnostic and works correctly on any platform that properly supports its DNS update mechanism, SRV records, and secure dynamic updates.

A persistent myth holds that Active Directory only works with AD-integrated DNS. Expert guidance “denounces the myth that Active Directory will only work with AD-integrated DNS” and “shows what Active Directory really needs from a DNS system.”

What AD truly needs is correct support for its DNS update mechanism, not a hard coupling to a particular vendor’s integration model. Hosting AD DNS on an alternative platform, following established best practices, delivers operational and architectural benefits without breaking AD functionality.

Curved library bookshelves symbolizing deep technical knowledge and uncovering myths around Active Directory and DNS Read article
Deeper read

Webinar: The myth behind Active Directory and DNS

Graham Lockwood, Senior Solution Architect at BlueCat, discusses what Active Directory really needs from a DNS system and denounces AD and DNS myths.

1 min Blog
Read more

Send us a message and start your assessment today.


· 05 — Security versus visibility

How do DNSSEC, DNS over HTTPS, and DNS Flag Day affect enterprise DNS management?

DNSSEC and DNS over HTTPS solve different problems: DNSSEC authenticates DNS data integrity through a chain of trust, while DoH encrypts DNS transport for privacy. Both introduce operational tradeoffs around complexity, key management, and enterprise visibility.

DNSSEC signs record sets rather than individual records. A zone-signing key produces the signatures in RRSIG records, a key-signing key validates the public key published in DNSKEY, and a DS record in the parent zone links the levels into a chain of trust. When any link fails validation, the resolver returns SERVFAIL rather than passing a forged answer to the client. The security case is strong; the operational case is where teams stall. “DNSSEC provides origin authentication via a chain-of-trust but is hard to configure and maintain.” Every zone change means resigning, keys need scheduled and emergency rollover, and one mistake takes the zone dark.

DoH runs the other way. It encrypts DNS in transit for privacy, but it “hampers traditional enterprise monitoring that relies on plaintext DNS,” concentrating resolution in a handful of public resolvers outside enterprise control. DNS Flag Day sits alongside both as a compliance forcing function: it “was essentially a wake-up call to DNS providers to remove older, or broken, non-compliant systems.”

padlock and key Read article
Deeper read

What is DNSSEC and how does it work?

DNSSEC authenticates DNS queries and responses by using cryptographic digital signatures. Learn more and how BlueCat can help to make implementation easier.

8 min Blog
Read more

· 06 — Platform requirements

What should teams look for in a DNS, DHCP, and IPAM platform for reliable core services?

Teams should look for a platform that centralizes DNS, DHCP, and IPAM into a single source of truth with a single pane of glass, supports self-service automation, and enforces compliance requirements like DNSSEC, failover, and network segmentation across the entire estate.

“Centralized DNS is necessary because shared services architectures have scale and complexity that make decentralized DNS unwieldy and error-prone.” As the shared-services analysis puts it, keeping multiple “points of truth” for DNS is “just asking for trouble in the form of error-driven network outages which can be time-consuming to solve.” This is the direct inverse of the fragmentation established above.

The platform must provide self-service provisioning for automation and DevOps, unify DNS across hybrid and multi-cloud environments rather than fragmenting into per-cloud instances, and “deliver a compliant network that adheres to standard requirements such as DNSSEC, failover capabilities, and network segmentation.”

Skyscrapers and a plane overhead, illustrating large enterprises relying on shared IT services as a common foundation Read article
Deeper read

DNS as the Foundation of Shared Services

DNS is not only a key foundation of shared IT services, but also delivers the functionality which makes those shared services thrive. 

3 min Blog
Read more

· 07 — Consolidating onto an enterprise DDI platform

How do teams that have outgrown native Microsoft DNS and DHCP move to an enterprise DDI platform?

Teams that have outgrown native Microsoft DNS and DHCP consolidate by replacing scattered Windows servers with an enterprise DDI platform, BlueCat Integrity, which brings DNS, DHCP, and IPAM management under enterprise governance. Because Active Directory is DNS-server agnostic, AD zones migrate in phased steps without downtime.

Integrity is BlueCat’s core DDI software suite, combining Address Manager with distributed BlueCat DNS/DHCP Servers to unify fragmented DNS, DHCP, and IPAM into a single source of truth, along with insight into the relationships between devices, users, and IP addresses across the enterprise. The hub-and-spoke architecture makes consolidation practical at scale: one enterprise-grade appliance manages thousands of DNS/DHCP servers without additional infrastructure cost, over 1,000 servers connect to a single Address Manager under N-2 release support, and the model supports phased upgrades rather than a single cutover.

Governance is built into the platform rather than layered on top. Role-based access controls define multiple administrative users at different privilege levels, network templates and IP modeling tools enforce consistency, and a vendor-agnostic RESTful OpenAPI exposes operations to automation so provisioning no longer depends on tickets. DNS and DHCP failover hold uptime across IPv4 and IPv6, backup and recovery options cover both on-premises and cloud deployments, and Prometheus-based real-time metrics surface problems before they become downtime.

15,000

A global manufacturer replaced Microsoft DHCP and brought roughly 15,000 IP addresses across 27 production sites under a single management console.

BlueCat Integrity X marketing page describing integrated DNS, DHCP, and IPAM solution benefits and capabilities Read article
Deeper read

Integrity Data Sheet

BlueCat Integrity X is a software suite that centralizes and automates mission-critical DNS, DHCP, and IP address management (DDI) services across…

4 min Blog
Read more
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button Read article
DDI Solution

Integrity

Tame network complexity with Integrity's full-stack DDI management platform and get visibility and control over your DNS, DHCP, and IPAM.

9 min Page
View Integrity

· 08 — Paths forward

Which modernization path is right for a Microsoft-centric team outgrowing native DNS and DHCP?

The right path depends on estate scale and governance requirements. It ranges from quantifying the reliability gap, to decoupling Active Directory from integrated DNS, to full enterprise consolidation onto a governed DDI platform.

PATH 01
When leadership still treats DNS as set-and-forget

Quantify the reliability gap first

Establish how much manual effort, outage risk, and blame friction native tooling is generating. Ground the case in how resolution actually works and why DNS failures cascade into authentication and application outages. This builds the internal mandate for change.
References: · 01, · 02, · 03
PATH 02
When the AD-integration myth blocks modernization

Decouple Active Directory from integrated DNS

Confirm that Active Directory is DNS-server agnostic and needs only correct support for its update mechanism and SRV records. Weigh which security standards, like DNSSEC, the current tooling can realistically operate. This removes the last objection to moving AD zones off scattered Windows DNS.
References: · 04, · 05
PATH 03
When scattered Windows servers can no longer meet governance and scale needs

Consolidate onto an enterprise DDI platform

Replace fragmented DNS, DHCP, and IPAM with a single governed control plane offering visibility, automation, audit trails, and enforced compliance. For enterprise-scale, multi-platform estates, this is full consolidation onto BlueCat Integrity, migrated in phased steps.
References: · 06, · 07

Frequently asked questions

Common questions from teams evaluating Windows Server networking fundamentals and enterprise DDI consolidation.

Every source cited in this analysis

Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

How do you detect and repair misconfigurations across DNS, DHCP, and IPAM before they cause outages?

DDI DNSSEC Updated

Most DNS and DHCP outages trace back to preventable misconfigurations: stale serials, missing secondaries, orphaned zones, and spreadsheet IPAM drift. Native Microsoft tooling and manual processes cannot surface these issues at scale. Centralized visibility, response-data logging, and API-driven automation turn DDI from a blind spot into a controlled, self-correcting layer. For lean teams modernizing a Microsoft-centric estate without a rip and replace, Micetro provides that overlay.

· 01 — OVERALL DNS RELIABILITY

What are the most common DNS misconfigurations?

The most common DNS misconfigurations are accidental zone overwrites, hidden-primary SOA serial skew that breaks DNSSEC, missing secondary server configurations, provider-side zone disappearance, and spreadsheet-based IPAM overwrites. Each stems from human error compounded by fragile architecture and the absence of a single source of truth.

Real incidents show the pattern plainly. A single mistyped record overwrote and deployed a company’s top-level domain, taking down internal and external resolution for an hour. On a hidden primary that could not support full SOA serial dynamic updates, serial skew caused secondaries to stop pulling the zone, aging out DNSSEC and breaking the public-facing zone until operators manually re-added updates to compensate.

Other failures came from ownership gaps rather than syntax. A zone hosted at an ISP simply vanished after an undocumented server upgrade, and DNS and IPAM tracked across shared spreadsheets meant one person’s edit silently overwrote another’s. In one incident a team replaced a primary DNS server only to find secondaries were never configured across the farm and recovery meant waking fifteen people for physical access.

DNS Horror Stories for Halloween Read article
Deeper read

6 DNS Horror Stories that will Spook Your IT Team this Halloween

Working with DNS can be spooky. Here are 6 DNS horror stories to enjoy this Halloween, coming from IT teams just like yours.

6 min Blog
Read more

· 02 — CENTRALIZED DDI VISIBILITY

How do you detect and remediate misconfigurations across DNS and DHCP?

Detection begins with centralized visibility across DNS, DHCP, and IPAM. If you cannot see an asset, service, or configuration, you cannot control it and without control you cannot secure or remediate it. Surfacing the full estate in one view is the precondition for catching misconfigurations before they cause outages.

Blind spots are where misconfigurations hide. When organizations centralize DNS, DHCP, and IPAM data, they routinely discover unknown assets, unmanaged services, and misconfigurations they did not know existed. The principle is blunt: if you can’t see it, you can’t control it; if you can’t control it, you can’t secure it.

That visibility translates directly into faster troubleshooting, clearer operational context, and more consistent policy enforcement. Teams that make the move are consistently surprised by what they learn about their own networks and eliminating those blind spots reduces the likelihood of both service disruptions and security incidents tied to invisible components.

Hand holding lens sharply focusing a city at night, illustrating DNS revealing hidden network activity and blind spots Read article
Deeper read

5 Secrets DNS Can Uncover About Your Network

Play video “If you can’t see it, you can’t control. If you can’t control it, you can’t secure it.”  Having blind…

1 min Blog
Read more

· 03 — DNS RESPONSE VISIBILITY

Why does logging DNS response data expose misconfigurations that query logs miss?

Query logs record only which domain was requested; response data reveals where that query actually resolved, which server answered, and the response code returned. Logging responses exposes misconfigurations and attacks, including hijacked records, unexpected IPs, and answers that do not match the question, which query-only logging cannot detect.

The answer matters more than the question. If an attacker compromises a registrar and changes an A record, queries for the domain still look perfectly normal. Only the response data shows that the address quietly changed from a legitimate IP to one the attacker controls. Logging a DNS query tells only a fraction of the story; the response reveals where it resolved and which server provided the answer.

Correlating responses with internal hosts lets teams identify which systems reached a compromised destination and target investigation precisely. Logging queries and responses together at every service point, then feeding them into policies and SIEM tools such as Splunk, turns DNS answers into an active detection signal for hijacking, tunneling, and poisoning.

91%

According to Cisco, 91 percent of malware uses DNS in attacks, which makes response-data visibility a decisive detection surface rather than an optional log.

Linux terminal with system directories and symlink paths, representing DNS response and network security data on screen Read article
Deeper read

The value of DNS response data for securing your network

Logging a DNS query only tells a fraction of the story. With Intelligent Security, we’ve changed the paradigm by logging DNS responses as well, uncovering…

6 min Blog
Read more

· 04 — IDENTIFYING ROGUE SERVICES

How can DDI help identify rogue DHCP servers and DNS-layer threats?

A centralized DDI platform identifies rogue DHCP servers and DNS-layer threats by giving administrators a complete, authoritative view of DNS and DHCP activity across the organization. The same blind spots that let unmanaged services persist are the ones the four major DNS attack types exploit so full estate visibility, comprehensive logging, DNSSEC, and access control close both gaps together.

DNS was built to resolve names efficiently, not to question their intent, which is why it is attractive as an attack vector. The four major attack types: DoS/DDoS including amplification, DNS hijacking, DNS tunneling, and DNS/cache poisoning, cause outages, redirection, covert command-and-control, and data exfiltration when left unaddressed. Each exploits the same weak controls that unmanaged DHCP and orphaned zones create.

Basic protections materially reduce the surface: know your entire DNS architecture to eliminate silos and orphaned zones, log inbound and outbound queries and responses, harden recursive servers with DNSSEC and access controls, and tighten registrar access. Logging and monitoring outbound and inbound queries is the first step to detecting anomalies.

Cluster of arrows embedded in a wooden wall, illustrating multiple simultaneous DNS attacks in the article context Read article
Deeper read

Four major DNS attack types and how to mitigate them

In a DNS attack, DNS is compromised or used as a vector. Learn about the different attack types and how to prevent, detect, and mitigate them with BlueCat.

7 min Blog
Read more

Talk to a BlueCat expert about your environment


· 05 — POLICY-AS-CODE AND AUTOMATION

How can network teams implement policy-as-code and automation for DDI configurations?

Network teams implement policy-as-code for DDI by driving DNS, DHCP, and IPAM changes through a single REST API instead of one console per service. A single API surface across on-premises and cloud lets the same workflow enforce change control, provision addresses consistently, and satisfy compliance mandates, turning detection into remediation at scale instead of one manual fix at a time.

Automation is one of the most common and important corporate mandates, and a strong API is how it reaches DNS and DHCP. The obstacle is rarely intent, it is sprawl. DDI services sit decentralized across the estate, Microsoft or ISC on-premises, native services in AWS, more again in Azure, each with its own interface and its own automation dialect. Built service by service, every new platform means another workflow to write, test, and maintain.

A software DDI overlay collapses that problem. Access control, DDI objects, and automation run through one REST API, so a single workflow covers cloud and on-premises alike and survives a change of underlying service. The mechanics are ordinary CRUD: POST creates, GET reads, PUT updates, DELETE removes, with the object addressed by a URL from the API documentation. That API then becomes the execution layer for Ansible, Terraform, PowerShell, or a service desk tool like ServiceNow, and the same endpoints feed monitoring. Repair stops being manual at that point. IP range templates, self-service onboarding, and reclaiming addresses when a service is retired all become code that runs on a trigger.

unified-ddi Read article
Deeper read

Ultimate Guide to the Micetro REST API

Create consistent DDI (DNS, DHCP & IPAM) automation workflows using one REST API, no matter where your workloads currently reside or will reside in the…

8 min Blog
Read more

· 06 — THE SHORTLIST TEST

What should teams look for in a DDI platform to detect and repair misconfigurations automatically?

Teams should look for a platform that centralizes a single source of truth, logs both queries and responses, keeps primaries and secondaries consistent, and reduces the manual burden of complex functions like DNSSEC key rotation. Each criterion is the inverse of a documented failure mode. It addresses the operational complexity that stalls adoption when configuration is left to manual processes.

The clearest lesson from DNSSEC adoption is that operational complexity, not value, is what stalls the right controls. Configuring signed zones from scratch is genuinely hard. Administrators must manage signing keys, extra records, and regular key rotations, work most organizations avoid unless a vendor-managed solution takes it on. A platform worth choosing reduces that manual burden rather than leaving it to manual processes.

The same logic extends across the estate. Look for centralized visibility that eliminates silos and orphaned zones, response-data logging that exposes answers query logs miss, high-availability configuration that keeps secondaries in sync, and API-driven change control. Where encryption reduces traditional monitoring visibility, the platform should help preserve it rather than trade detection for privacy.

Seven headshots and avatars of IT professionals featured in an IT pros debate on network silos and cross-team collaboration Read article
Deeper read

DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?

We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.

50 min Blog
Read more

· 07 — NO FORKLIFT REQUIRED

How do lean teams modernize a Microsoft DNS estate without a rip-and-replace?

Lean teams modernize a Microsoft-centric DNS estate by overlaying it with a DNS-focused platform that provides a single source of truth and a guided migration methodology, rather than enduring another painful upgrade. Micetro gives Microsoft-overlay estates centralized visibility, control, and compliance while modernizing in place — no rip-and-replace required.

DNS can no longer be an afterthought; it is the foundation of a robust network management strategy. When a provider treats DNS as one SKU among many, upgrades become difficult, time-consuming, and expensive, often breaking other functionality and driving costly professional-services bills. As the guidance frames it, migrating to a more robust, DNS-focused platform can be the easier and safer solution than the next fragile upgrade.

A DNS-focused vendor gets to know a team’s initiatives and long-term goals, proactively mitigating risk instead of playing catch-up on each project, and pairs that focus with a guided migration methodology covering data extraction, optimization, and validation. Micetro delivers that overlay for lean, Microsoft-centric teams, giving them a single source of truth and modernization without disruption.

Two business professionals stacking wooden blocks to symbolize building the right DDI and DNS solution strategy Read article
Deeper read

Are you working with the right DDI provider?

As more and more businesses transform through key IT initiatives such as cloud, ITaaS and automation, DNS can no longer be an afterthought.

3 min Blog
Read more
Visual showing how you can regain control and visibility over your network infrastructure with BlueCat Micetro. Read article
The Overlay Approach

Micetro

With Micetro, integrate, orchestrate, and automate your current DNS, DHCP, and IPAM network infrastructure via a single web interface.

5 min Page
View Micetro

· 08 — Paths forward

Which approach to DDI misconfiguration control is right for a Microsoft-centric team?

The right approach depends on how far a Microsoft-centric team has outgrown native DNS/DHCP and spreadsheet IPAM. Teams that cannot yet see their full estate should centralize visibility first; teams past the limits of manual change control should automate detection into remediation; and teams that cannot absorb a rip-and-replace should overlay the existing estate and modernize in place. The paths are sequential, not exclusive.

PATH 01
When misconfigurations are suspected but the estate is not fully mapped.

Centralize visibility before automating

Surface DNS, DHCP, and IPAM in one authoritative view before attempting any automated correction. Response-data logging exposes answers query logs miss, and a single source of truth reveals the unknown assets, orphaned zones, and drift that outages trace back to. You cannot auto-repair what you cannot see.
References: · 01, · 02, · 03
PATH 02
When manual change control and spreadsheet IPAM no longer scale.

Close the detection-to-remediation loop with API-driven policy

Use a robust API to enforce change control, provision addresses consistently, and act on high-value DNS telemetry automatically. This converts detection into remediation at scale, blocking a bad answer or flagging a rogue DHCP scope without a human in the path while keeping availability and compliance intact.
References: · 04, · 05
PATH 03
When rip-and-replace is off the table but native tooling has hit its boundary.

Overlay a Microsoft estate and modernize in place

Overlay the existing Microsoft DNS/DHCP estate with a DNS-focused platform that delivers a single source of truth and a guided migration methodology. This gives lean teams centralized visibility, control, and compliance without the risk of another fragile upgrade or a full replacement project they cannot staff.
References: · 06, · 07

Frequently asked questions

Practical answers to the DDI governance, automation, and modernization questions that come up most in Microsoft-centric estates.

Every source cited in this analysis

Network observability ROI report: See how enterprise IT teams achieve $196.5K in annual ROI with LiveNX

Modern enterprise networks are more distributed, hybrid, and complex than ever before. As organizations expand across cloud, SD-WAN, branch offices, and remote work environments, maintaining end-to-end visibility has become increasingly difficult.

To better understand how network teams are addressing these challenges, BlueCat partnered with independent research firm UserEvidence to survey LiveNX customers across multiple industries. The findings show that organizations using LiveNX significantly improve network visibility, accelerate troubleshooting, simplify operations, and generate measurable business value through productivity gains and tool consolidation.

Whether you’re responsible for network operations, infrastructure, or enterprise architecture, this research provides benchmark data to help evaluate the operational and financial impact of modern network observability.

What the research reveals

Independent research across enterprise LiveNX customers highlights a consistent pattern: Organizations struggle with fragmented visibility before deployment, then realize measurable operational improvements after adopting LiveNX.

The research found that organizations improved daily network visibility by 142%, making it easier to monitor increasingly distributed infrastructures. Customers also reported a 62% improvement in overall network performance, driven by faster identification of application and infrastructure issues. Operational efficiency improved significantly through faster troubleshooting, fewer manual investigations, and reduced dependence on multiple disconnected monitoring tools.

Perhaps most importantly, organizations translated these operational improvements into measurable financial outcomes, generating an average annual return on investment (ROI) of $196,500.

142 %

+62 %

$196.5 K

Key research findings

The research demonstrates that network observability has evolved beyond simple monitoring into a strategic operational capability. Organizations managing hybrid infrastructure require correlated visibility across applications, traffic flows, devices, and multiple telemetry sources to maintain performance at scale.

Respondents consistently identified fragmented visibility, disconnected monitoring tools, and manual troubleshooting as their largest operational challenges before adopting LiveNX. Following implementation, teams reported faster root cause analysis, improved collaboration between operational teams, and substantially less manual effort during investigations.

The findings also show that observability investments create measurable business value beyond technical improvements. Reduced troubleshooting time, tool consolidation, and increased engineering productivity contribute directly to significant annual cost savings.

Today’s network environments are more complex than ever

icon used for an eye

Limited end-to-end visibility

Time-consuming troubleshooting

Tool sprawl and disconnected data

Manual processes slow teams down

Higher risk of outages and issues

Real productivity. Real savings.

On average, organizations using LiveNX save the equivalent of one full-time network engineer.

user icon
4
hours saved
per user per week
×
calendar icon
52
weeks
per year
×
multiple users icon
10
average
proficient users
=
clock icon
2,080
hours saved
annually

Equivalent to one full-time network engineer

networking

See how 28 enterprise organizations achieved an average annual ROI of

$196500

Download the full UserEvidence research report to see the data and get customer insights.

What does this mean for network teams?

Modern network teams are expected to manage larger, more complex environments without proportional increases in staffing. The research shows that improving observability helps teams scale operations while reducing operational risk. Organizations evaluating network observability platforms should consider how solutions impact both technical outcomes and business metrics. Key benefits include:

  • Improve visibility across hybrid and multi-vendor networks
  • Reduce mean time to identify and resolve issues
  • Consolidate multiple monitoring platforms
  • Free engineering teams for strategic initiatives
  • Demonstrate measurable operational ROI to leadership

Organizations that invest in end-to-end network visibility aren’t simply improving monitoring—they’re improving operational resilience, efficiency, and long-term scalability.

The BlueCat perspective

BlueCat LiveNX provides comprehensive network observability by collecting and correlating telemetry across applications, devices, traffic flows, and network infrastructure into a single operational view. Rather than requiring teams to switch between disconnected tools, LiveNX enables faster root cause analysis, performance optimization, and operational decision-making from one platform.

About the research

This report is based on independent research conducted by UserEvidence, which surveyed 28 BlueCat LiveNX customers representing enterprise organizations across healthcare, finance, government, manufacturing, technology, education, retail, and other industries. The study examines customer experiences, operational improvements, and measurable business outcomes following LiveNX adoption.

Download the LiveNX ROI report

Discover how enterprise organizations are improving network operations with BlueCat LiveNX

What you’ll get:

  • Benchmark data from enterprise LiveNX customers
  • Insight into how organizations achieved $196,500 in average annual ROI
  • Practical strategies for improving visibility, troubleshooting, and operational efficiency

You can stop receiving marketing emails by clicking the unsubscribe link in each email. You agree on behalf of yourself and your company to have your data processed in accordance with our Privacy policy.

Frequently asked questions

Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

What is the business impact of observability across core DDI services?

Unified DDI Updated

Traditional monitoring tells teams that DNS or DHCP broke; observability tied to core DDI tells them why and what to do next. BlueCat Horizon turns core DDI telemetry into operational intelligence that shortens outages, proves change history, and cuts manual toil.

· 01 — THE FOUNDATION

Why does core DDI matter to the business?

Core DDI matters because DNS, DHCP, and IPAM together form the network control plane that enables device connectivity, application routing, and policy enforcement across the enterprise. When any part of that control plane fails, devices and endpoints can no longer communicate, and the business impact scales from a stuck print job to an ecommerce site losing revenue to patients being put at risk in a hospital.

DHCP assigns the IP addresses that let devices join the network, IPAM tracks and governs those allocations, and DNS maps names to the addresses services actually use. The three are grouped as DDI because they are tightly coupled: a failure in one quickly becomes a failure across all of them, which is why they are treated as a single foundation rather than three separate utilities.

The stakes rise as networks stretch across hybrid and multicloud environments. Managing core services through fragmented, manual processes leaves the business exposed to outages, security gaps, and slow change, and the difficulty compounds as the estate grows and diversifies. Centralizing DNS, DHCP, and IPAM turns that fragile plumbing into a measurable driver of operational performance rather than a source of unmanaged risk.

EMA report cover titled "DDI Directions 2026" with BlueCat logo and subtitle about preparing core network services for multi- Read article
Deeper read

DDI Directions 2026: Turning DDI solutions into success

Explore EMA’s DDI Directions 2026 research to learn how integration, automation, and DNS security turn DDI solutions into measurable operational success.

3 min Blog
Read more

· 02 — SIGNAL IN THE NOISE

What is the value of network observability tied to core services like DNS and DHCP?

The value of network observability tied to core services is that it turns DNS and DHCP telemetry into the fastest path to root cause. Traditional monitoring flags that something is slow or broken; observability built on core-service data shows where a query degraded, why resolution slowed, and which fix restores performance. That is the difference between knowing a problem exists and knowing what to do about it.

DNS underlies nearly every transaction on the network, which makes it one of the richest and most underused sources of performance insight. When resolution paths are inefficient or queries are routed to distant resolvers, latency climbs and users feel it, yet the cause stays invisible to tools that only watch uptime and bandwidth. Analyzing core-service telemetry exposes those degraded paths directly, so teams can trace an issue to its source and remediate faster instead of guessing.

The value compounds when that visibility is unified rather than scattered. Pulling DNS, DHCP, and IPAM into a single source of truth turns isolated data points into correlated context that spans on-premises and cloud, which is what moves a team from reactive troubleshooting toward proactive operations. Observability tied to core services does not just add another dashboard; it makes the network’s own data answer the questions monitoring leaves open.

80% of traffic misrouted

By analyzing DNS query data, one organization found that 80% of its network traffic was being routed to external trusted services; rerouting it directly to the internet cut WAN costs and improved user experience, a fix that only surfaced through core-service telemetry.

Glossy metallic infinity loop symbolizing continuous DNS data visibility and ongoing network performance monitoring Read article
Deeper read

Case Study: DNS data identifies network performance issues

In this case study, we see how DNS data provides critical clues to identifying and mitigating network performance issues.

4 min Blog
Read more

· 03 — THE HIDDEN LEDGER

What does poor DDI visibility actually cost the business?

Poor DDI visibility costs far more than the license line suggests, because most of the expense is hidden: administrative overhead, SIEM ingestion and storage, excess infrastructure, cloud overspend, outages, breaches, compliance effort, and staff turnover. There is no such thing as a free lunch DDI — enterprises either pay for a purpose-built solution or pay to cope with the limitations of a DIY one.

Budgeting only for direct costs like licensing misses the point. DIY approaches built on Microsoft DNS or homegrown BIND are difficult to automate, so network teams spend person-hours on DNS tickets and routine maintenance. One customer, a senior network engineer in higher education, noted the move off DIY saved “hidden money” over time.

A centralized DDI solution is built to be automated, which is where the savings concentrate. Automation reduces the manual ticket work, accelerates provisioning and remediation, and lowers the resourcing cost tied to high engineering salaries — freeing team members for strategic projects rather than repetitive toil.

man holding a magnifying glass Read article
Deeper read

How to budget for a DNS, DHCP, and IPAM solution

If you're considering purchasing a DNS, DHCP, and IPAM solution, it can be difficult to calculate the actual costs and ROI. BlueCat is here to help.

13 min Blog
Read more

Talk to a BlueCat expert about your environment. Get a practical 30-minute assessment — no slideware.


· 04 — THE INVERTED PATTERN

Why do large enterprises run the most under-instrumented DDI?

Large enterprises run the most under-instrumented DDI because the pattern of adoption is inverted: the biggest, most complex estates are the most likely to still run decentralized, manual DNS. The reason is largely organizational inertia and entrenched complexity — big-budget organizations tend to staff around the problem rather than rearchitect a global network.

Decentralized DDI simply does not scale well. Managing Microsoft DNS or homegrown BIND across high-performing global networks overwhelms teams with service requests, particularly from DevOps and cloud teams. Larger organizations tend to staff around the problem rather than rearchitect, and management of critical systems can become a source of internal power that stakeholders resist centralizing.

The consequence surfaces during modernization. Many respondents using Microsoft or BIND reported their DDI was less capable or inferior in the cloud than on-prem, because those solutions were not built with the cloud in mind. Centralized, automation-ready DDI, by contrast, correlates strongly with successful SDN and hybrid cloud deployments and consistent behavior across environments.

Hand with pen pointing at printed EMA survey bar and line charts on enterprise DDI strategy and usage data Read article
Deeper read

The bigger the business, the more misguided the DDI

EMA research for BlueCat found an inverse relationship between commercial DDI use and business size, as well as more surprises about DDI adoption trends.

7 min Blog
Read more

· 05 — THE ANSWER

How does DDI observability improve security, governance, and compliance?

DDI observability improves security, governance, and compliance by logging DNS responses — not just queries — so teams can see where a query actually resolved, which server answered, and whether that answer was malicious. Logging a DNS query only tells a fraction of the story; response data reveals the destination IP and the source of the answer, giving defenders forensic-grade evidence.

When only queries are logged, a hijacked domain looks perfectly normal. Response data exposes the change — a modified A record now resolving to an attacker-controlled IP — and lets teams identify exactly which internal hosts reached the compromised destination. According to Cisco, 91 percent of malware uses DNS in attacks, which makes that visibility essential rather than optional.

Correlating queries and responses at every service point, then forwarding those logs to a SIEM such as Splunk, turns core DDI into a governance and audit layer. Policies can monitor, alert on, or block servers and IPs with poor reputations, and the complete change history satisfies the evidence requirements that cloud governance and compliance increasingly demand.

Linux terminal with system directories and symlink paths, representing DNS response and network security data on screen Read article
Deeper read

The value of DNS response data for securing your network

Logging a DNS query only tells a fraction of the story. With Intelligent Security, we’ve changed the paradigm by logging DNS responses as well, uncovering…

6 min Blog
Read more

· 06 — MIRROR THE FAILURE

What should teams look for in an observability approach for core DDI services?

eams should look for a unified, intelligent approach that advances them along a clear maturity path rather than adding more tools to an already fragmented stack. The criteria that matter most are integration across network, cloud, and security domains, centralized visibility that closes cloud blind spots, high-quality data that cuts alert noise, and a route toward AI-driven operations. Each one directly counters a documented reason enterprises stall mid-maturity: tool sprawl, limited visibility, poor data quality, and excessive alerts.

Most enterprises are stuck in the middle stages of the maturity curve, described in EMA and BlueCat’s research as “Fragmented and Opportunistic” or “Integrated and Centrally Managed.” In those stages tools are siloed, correlation is manual and inconsistent, and every issue becomes a fire drill because teams can see parts of the network but not the whole picture. The instinctive response is to buy another tool, which deepens sprawl rather than resolving it.

Pulling ahead means integrating tools across domains, breaking down silos between network, cloud, and security teams, and unifying core DDI as a single source of truth so observability data can be shared and acted on. That unified foundation is what moves teams from reactive monitoring toward predictive, AI-ready operations, which is the difference between investing in observability and actually succeeding with it.

46% fully successful

Nearly every IT organization invests in observability tools, yet only 46% say they are fully successful with them. The rest are stuck somewhere in the middle of the maturity curve, facing tool sprawl, limited visibility, poor data quality, and alert noise.

Frustrated IT engineer at laptop with overlaid network observability UI widgets showing memory utilization, allocation percen Read article
Deeper read

Network observability maturity stuck? Learn how to pull ahead

In EMA and BlueCat's new report, learn about the five-stage Network Observability Maturity Model and how your enterprise can move along it.

7 min Blog
Read more

· 07 — FROM DATA TO ACTION

How do NetOps teams turn DDI telemetry into faster resolution?

NetOps teams turn DDI telemetry into faster resolution by pairing continuous, correlated observability across the whole network with agentic AI that reasons over it. BlueCat Horizon provides the SaaS-based foundation that orchestrates DNS and DHCP services across on-premises and cloud, eliminating the visibility silos that keep manual correlation slow.

The scale of modern networks has made manual correlation unworkable — no engineer can consistently connect performance telemetry, flow data, configuration state, and security signals in real time. Network observability goes beyond monitoring by connecting real-time metrics, network context, and configuration data to proactively detect and isolate root causes, often before users notice a problem.

BlueCat Horizon carries that principle into a single orchestration layer for services deployed on-premises and in the public cloud, providing a path to AI-driven, resilient, secure networks. Agentic AI reasons over the correlated telemetry to move teams from reactive troubleshooting toward autonomous operations — answering not only what is happening, but why, and what to do next.

90% agree or strongly agree

90% of survey respondents agree or strongly agree that network observability is increasingly critical with the arrival of AI.

Three colleagues at monitors collaborating, overlaid with network, analytics, cloud, and gear icons. Read article
Deeper read

Agentic AI adoption in network observability propels NetOps teams

Network observability is crucial for today's networks and even more capable with agentic AI, according to new Omdia and BlueCat research.

6 min Blog
Read more
unified-ddi Read article
Cloud-native intelligent NetOps platform

Horizon

BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI

6 min Page
View Horizon

· 08 — Paths forward

Which observability path fits a lean team, a complex estate, or a security-driven mandate?

The right path depends on which pressure is loudest — alert fatigue, budget scrutiny, or audit exposure. Three patterns recur across the environments described on this page, and each maps to a different first move rather than a single universal answer. The paths are sequenceable: teams often start with one and pick up the others as maturity grows.

PATH 01
Team is drowning in alerts and stuck mid-maturity.

Instrument core DDI before adding tools

Most teams that feel overwhelmed respond by adding another monitoring tool, which produces sprawl rather than clarity. The higher-leverage move is to unify visibility through DNS, DHCP, and IPAM as a single source of truth, then apply criteria that invert the known failure modes. Understanding faster beats monitoring more.
References: · 02, · 06
PATH 02
Budget owner comparing DIY spend to a platform.

Quantify the hidden cost before renewal

A license-only comparison makes DIY DDI look cheaper and misses the administrative, outage, breach, and turnover costs that dominate the real total. Adding up the hidden line items reframes the decision — especially for large estates, where inertia, not economics, keeps decentralized DDI in place. There is no such thing as free DDI.
References: · 03, · 04
PATH 03
Compliance or SecOps pressure on DNS change history.

Make DNS response data the audit and security layer

Query-only logging cannot prove where traffic went or which hosts reached a compromised destination. Logging DNS responses at every service point and forwarding them to a SIEM turns core DDI into forensic-grade evidence — the change history that governance and compliance now demand. It reframes DNS from a thing to protect into a thing that protects.
References: · 05, · 01

Frequently asked questions

Common questions from teams evaluating observability and DDI modernization across hybrid environments.

Every source cited in this analysis

Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

How can organizations achieve unified operational visibility across core DDI without ripping out Microsoft DNS and legacy tools?

Unified DDI Updated

Hybrid, Microsoft-dependent environments make it hard to see what’s really happening across DNS, DHCP, and IPAM, especially when teams are lean and split between on‑prem and cloud. This piece shows how to pull every core DDI signal into a single, live view so you can spot issues faster, cut manual investigation time, and support cloud projects without creating new blind spots. We’ll walk through practical ways to unify data from Windows DNS, cloud DNS services, and IPAM into one operational pane, setting the stage for BlueCat’s Horizon‑style intelligent observability and automation.

· 01 — Understanding unified DDI visibility

What is DDI and why do enterprises need unified DNS, DHCP, and IPAM visibility?

DDI is the combination of DNS, DHCP, and IP address management, and enterprises need a unified view of all three because fragmented tools, spreadsheets, and siloed servers create IP conflicts, outages, weak accountability, and blind spots that make automation, security, and hybrid cloud projects fragile.

Spreadsheets layered on top of Microsoft DNS or BIND lack centralized visibility and do not scale for networks spanning regions, hybrid clouds, and multiple business units. As the IP space grows, manual tracking practically invites errors and overlaps that can take down services, while role-based access and reliable reporting are essentially impossible.

Standalone IPAM tools improve address tracking but leave DNS and DHCP fragmentation untouched. As one BlueCat guide notes, “IPAM tools on their own can be helpful as a short term band-aid. But they do not solve the underlying problems inherent in decentralized network infrastructure systems.” The recommended approach is to rationalize DNS, DHCP, and IPAM into a unified DDI solution and single source of truth.

1 source of truth

The article stresses that using an IP address spreadsheet simply isn’t viable long term and that DDI data belongs in a single source of truth.

Office receptionist sitting at a front desk, looking frustrated, symbolizing admins stuck managing IPAM with basic DNS tools Read article
Deeper read

Looking for an IPAM solution? There’s something you should know.

IPAM tools alone do not solve the underlying issues with decentralized network infrastructure systems such as Microsoft DNS and BIND.

6 min Blog
Read more

· 02 — Restoring cloud DDI visibility

How can on‑prem DDI teams regain visibility when cloud and DevOps manage their own DNS?

The practical way to regain visibility is to establish a consistent, enterprise-wide DDI model with a single source of truth, then extend or integrate that DDI layer with cloud-native DNS services and expose it via automation so cloud and DevOps teams can self-service without creating shadow DDI.

Unmanaged cloud activity creates multiple concrete problems for on‑prem teams: overlapping IP assignments when cloud networks allocate space without a shared source of truth, complex DNS routing as workloads move, creeping fragmentation of DDI management, and gaps in continuous security and compliance. Network administrators carry responsibility for these failures but often lack authority or insight into what cloud teams are doing.

Addressing this requires a DDI architecture that “speaks the same language” across on‑prem and cloud. Core DDI must either extend into the cloud or integrate with cloud-native DNS such as Amazon Route 53 and Azure DNS so data and policy flow seamlessly. Once that foundation exists, network automation tools can provide self-service provisioning, giving cloud and DevOps teams speed while preserving centralized control and visibility in the cloud.

Snow-covered mountain peaks obscured by thick clouds, symbolizing limited visibility in dynamic cloud DNS environments Read article
Deeper read

Cloud DNS: Addressing the visibility challenge

If your network team can't see what's happening in the cloud, you've got a serious challenge. Time for a DDI system that works in all environments.

6 min Blog
Read more

· 03 — Total visibility in hybrid environments

How does unified DDI visibility tame hybrid cloud complexity and enable safe automation?

Unified DDI visibility across on‑prem and cloud—down to every DNS query and endpoint—eliminates silos, reveals IP and zone conflicts, and provides the single source of truth required to automate changes safely instead of relying on fragile manual forwarding rules.

An ONUG discussion highlighted four critical hybrid DDI challenges: DDI teams have zero visibility into cloud DNS, cloud and on‑prem DDI become silos with fragmented or overlapping IP space, automation stalls without a source of truth, and a growing tangle of forwarding rules and private endpoints consumes resources. As Zeus Kerravala notes, “trying to manually manage these things is going to lead to failure.”

For automation to work, “you can’t change something unless you can assert some sort of source of truth.” That means discovering services, seeing how each DNS query was resolved, and correlating authorities across internal private networks and cloud zones. With total visibility and a single DDI truth, teams can build automation and security segmentation that adapts as applications shift, instead of hand-curating conditional forwarders for every new dependency.

man standing in front of a digital cloud Read article
Deeper read

Total visibility key to tame DDI hybrid cloud challenges

In an ONUG webinar, BlueCat’s Andrew Wertkin explains how DNS, DHCP, and IPAM visibility is key to automation and taming four hybrid cloud challenges.

6 min Blog
Read more

· 04 — Validating policy and compliance

What should teams look for in a platform to validate DDI changes against policies and compliance requirements?

Teams should look for a DDI approach that centralizes DNS, DHCP, and IPAM into a single policy-aware source of truth, separates management and services planes for resilience, provides rich reporting on changes and IP usage, and supports automation so policy checks and audit trails are enforced consistently across hybrid environments.

A structured evaluation starts with requirements: scalability, security, compliance, reliability, environment, and support. Guidance from DDI experts stresses that projects fail when requirements are vague or fragmented between teams. Platforms should avoid artificial limits on database objects, support centralized rather than siloed environments, and enforce consistent naming policies so governance does not depend on manual review of every zone and record.

For compliance validation, DDI must act as a single authoritative data set that automation and reporting can trust. That includes robust IPAM that “ensures effective management of IP resources,” detailed change history, and the ability to parse DNS activity for risk indicators. Buyers are urged to “ask hard questions” about migration experience, reporting, and integrations so that DDI changes can be audited and policy aligned instead of buried in ad‑hoc scripts or spreadsheets.

DNS, DHCP, IPAM RFP cover next to blank page with sticky note about not knowing what to ask a DDI solution vendor Read article
Deeper read

What to ask a DNS, DHCP, and IPAM solution vendor

You've decided your DNS, DHCP, and IP address management are too complex to DIY. Learn more from BlueCat about how to find the right solution partner.

10 min Blog
Read more

· 05 — Extending visibility with security tools

How can DDI integration with security platforms improve visibility into internal and external DNS traffic?

Integrating DDI resolvers as the first DNS hop with security platforms adds endpoint-level context and internal east‑west visibility to existing north‑south telemetry, enabling granular DNS security policies and faster identification of infected devices without deploying separate sensors.

One integration pattern places the DDI resolver at the first hop so it sees the source IP and all internal queries before forwarding external requests to cloud-based defenses. This adds visibility into the roughly 60% of traffic flowing through internal DNS, which is otherwise a blind spot. As one customer noted, this level of endpoint detail was “a game changer for cybersecurity.”

With combined visibility, security teams can deploy granular DNS policies grounded in both external reputation and internal behavior. Lightweight service points enable traffic steering for SD‑WAN and hybrid cloud resolution without heavy hardware. Crucially, “with [the resolver] sitting at the first hop as a DNS resolver, all of that information is collected without all of that extra effort,” avoiding a separate sensor deployment project.

Network diagram showing BlueCat Service Points and Cisco DNS Defense securing internal and external DNS resolution Read article
Deeper read

Bolster DNS security with BlueCat and Cisco Secure Access

Working together, BlueCat and Cisco Umbrella extend the breadth and depth of domain name system security across the enterprise.

1 min Blog
Read more

· 06 — Measuring ROI and justifying modernization

How do you measure ROI for DDI modernization projects when moving off spreadsheets and legacy servers?

ROI for DDI modernization is measured by reductions in outages and incident time, labor saved from manual DNS/IPAM work, security and compliance risk reduction, and agility gains such as faster provisioning and automation—all of which are hard to achieve with spreadsheets and disparate DNS servers.

Legacy environments built on “spreadsheets and disparate DNS servers” suffer from system fragmentation, security gaps, and manual processes that directly result in outages. Organizations often accept this because “if it’s not broken, don’t fix it,” but the hidden costs include slow incident response, duplicated effort across teams, and mounting audit pressure as hybrid complexity grows.

In contrast, unified DDI improves “the visibility, security, and resiliency of core network services.” Real-world migrations have reported “important operational gains (cost and agility)” once automation replaces ticket-driven changes. Metrics that resonate with leadership include fewer DNS-related incidents, shorter mean time to resolve, reduced hands-on changes per week, and the ability to support new projects without adding headcount.

Webinar Ditch legacy DDI to unify your DNS, DHCP and IPAM cover page Read article
Deeper read

Webinar: Ditch legacy DDI to unify your DNS, DHCP and IPAM

BlueCat’s Solutions Architects explore the potential created by unifying DNS, DHCP and IPAM, including challenges and real-world solutions (enterprise and…

1 min Blog
Read more

Talk to a BlueCat expert about your environment. Get a practical 30-minute assessment — no slideware — focused on unifying DDI visibility across your Microsoft DNS, DHCP, and IPAM footprint.


· 07 — Centralizing visibility with SaaS orchestration

How can distributed networks centralize DDI visibility and control without disrupting local DNS and DHCP?

Distributed networks can centralize DDI visibility and control by adding a SaaS-based orchestration and reporting layer that connects to existing DNS, DHCP, and IPAM via lightweight agents, synchronizes states bi-directionally, and surfaces metadata for insight while letting services execute locally for performance and resilience.

A data sheet describes this approach as a shared control plane that “connects to existing DNS, DHCP, and IPAM systems via lightweight agents and service points.” Those agents communicate outbound-only, linking on‑prem, branch, and cloud environments to a centralized orchestrator that applies consistent identities, policies, and automation. Local servers continue handling queries and leases, preserving performance and data sovereignty.

This is the design pattern implemented by BlueCat Horizon. Horizon “uses bi-directional synchronization between the shared control plane and connected systems so that changes made centrally or locally are reconciled automatically,” reducing operational risk and configuration drift. It also includes built-in reporting for IP utilization, DHCP lease activity, and configuration changes without separate licenses, forming a foundation for intelligent, AI-assisted NetOps over time.

3 core insights

Horizon’s built-in reporting focuses on IP utilization, DHCP lease activity, and configuration changes as the starting set of operational visibility.

BlueCat Centralized DDI control datasheet header with branding, headline, and introductory description text Read article
Deeper read

BlueCat Horizon data sheet

BlueCat Horizon is a SaaS-based orchestration and control plane that centralizes DDI policy, identity, reporting, and automation across heterogeneous,…

3 min Blog
Read more
unified-ddi Read article
Cloud-native intelligent NetOps platform

Horizon

BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI

6 min Page
View Horizon

· 08 — Paths forward

Which unified DDI visibility path is right for a Microsoft-centric hybrid network?

The right path depends on where DDI pain is sharpest—IPAM drift, cloud blindness, compliance pressure, or distributed operations—but in every case the destination is the same: a single, policy-aware DDI source of truth with centralized visibility, automation hooks, and local execution.

PATH 01
When spreadsheets and IPAM-only tools are the main bottleneck

Consolidate DNS, DHCP, and IPAM into one source of truth

This path fits teams fighting IP conflicts and stale records on top of Microsoft DNS. Retiring spreadsheets and treating DDI as one system eliminates manual reconciliations and gives automation a clean data set to work from. Unified DDI visibility also lays groundwork for IPv4/IPv6 governance and DNS security.
References: · 01, · 06
PATH 02
When cloud and DevOps operate DNS independently

Integrate cloud DNS into centralized hybrid visibility

Here, the priority is integrating cloud-native DNS with on‑prem naming and IP space to eliminate blind spots and brittle forwarding rules. Establishing a consistent DDI model and exposing it through automation lets cloud teams move quickly without creating shadow DNS, while central teams regain full-path visibility and control.
References: · 02, · 03, · 05
PATH 03
When audits, change control, and policy drift dominate discussions

Establish a governance and compliance control plane

In regulated environments, focus first on centralizing policy, naming standards, and change history across DNS, DHCP, and IPAM. A platform that separates management and services planes, provides detailed reporting, and integrates with automation gives stakeholders the evidence they need for compliance and the guardrails needed for safe self-service.
References: · 04, · 06
PATH 04
When infrastructure is geographically dispersed and hard to replace

Add SaaS orchestration for distributed DDI estates

For organizations with many data centers, branches, or mixed DDI stacks, the pragmatic step is to add a SaaS control plane that connects existing systems via lightweight agents. This delivers unified visibility, reporting, and automation while preserving local performance and giving teams a platform for intelligent NetOps.
References: · 03, · 07

Frequently asked questions

These answers focus on how unified DDI visibility improves day-to-day operations, compliance, and security in Microsoft-heavy hybrid networks.

Every source cited in this analysis

Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

How do you unify DNS management workflows across on-premises, cloud, and edge environments?

DDI On-premises Cloud Updated

Hybrid and multi-cloud growth fragments DNS across Microsoft on-prem servers, native cloud DNS, and edge sites, creating IP conflicts, blind spots, and forwarding sprawl no single console solves alone. The durable fix is a control plane matched to your domain. Teams anchored in Microsoft on-prem and edge centralize with BlueCat Micetro as an overlay, no rip-and-replace. Teams whose center of gravity is cloud and multi-cloud orchestrate DDI from a SaaS foundation with BlueCat Horizon. Each governs its own domain and delivers one source of visibility and control there.

· 01 — Why native cloud DNS alone breaks in hybrid environments

Why isn’t native cloud DNS enough for a hybrid or multi-cloud enterprise?

Public cloud DNS services are designed to serve compute inside a single provider's tenant and lack the mechanisms to distribute or interoperate DNS data beyond those boundaries. In a hybrid or multi-cloud estate, cloud DNS is unlikely to be the only DNS service an enterprise relies on, and treating it as one creates real availability, compliance, and security gaps.

Each cloud has different, conflicting, or missing support for zone delegation, recursion, and forwarding, and there is no name server interoperability for distributing zone data outside the cloud-delivered service. Providers historically vary on DNSSEC support, and reliance on a third party introduces outage risk for an essential network component. When that provider has an outage, the impact can be substantial.

Where cloud DNS is used without extending on-prem DDI, BlueCat sees four recurring outcomes: lost visibility into IP space that leads to conflicts and outages, separate cloud and on-prem DDI silos, complex forwarding rules that consume resources and invite misconfiguration, and suboptimal SaaS delivery that degrades user experience. Hybrid environments require centralized management of DNS, DHCP, and IP address management that cloud DNS does not provide.

Three hanging lightbulbs reflecting clouds, symbolizing ideas and visibility in hybrid cloud DNS infrastructure Read article
Deeper read

Cloud DNS: Benefits and obstacles for hybrid networks

Unsure about cloud DNS services and hybrid-cloud enterprises? Learn more with BlueCat, including why it isn't so simple for managing networks.

8 min Blog
Read more

· 02 — How can teams tell when free or bundled DNS is no longer enough?

How can teams tell when free or bundled DNS is no longer enough for enterprise networks?

Free or bundled DNS is no longer enough when ad hoc configurations, undocumented workarounds, and reliance on a few experts turn DNS into a fragile, hard-to-scale dependency. At that point the operational risk and maintenance burden outweigh any license savings.

Relying on free DNS tends to produce non-standard configurations, custom scripts, and device-specific tweaks that only a handful of engineers fully understand. As hybrid initiatives, new applications, or acquisitions arrive, every change on that foundation requires more workarounds, raising the odds of misconfiguration, outages, and slow incident response because critical knowledge stays trapped in individuals.

The true cost of free Microsoft DNS combines administrator labor for DNS, DHCP, and IPAM changes, time spent firefighting unexpected issues, and the business impact of outages. A single disruption can cost hundreds of thousands of dollars, and at scale can lead to multi-million-dollar monthly losses. Treating those events as an unavoidable side effect obscures a measurable, recurring cost that can be modeled against modernization options.

3 cost categories

The true cost of “free” Microsoft DNS is the sum of administrator labor, firefighting time, and the business impact of outages — not the license price.

Two network engineers review complex DNS configuration code on multiple monitors in a dim operations room Read article
Deeper read

Deciding when free or bundled DNS is no longer enough

Wondering when to replace Microsoft DNS or other free DNS services? Learn the real costs, risks, and how to get more from Microsoft DNS without replacing…

6 min Blog
Read more

· 03 — Why does integrating cloud provider DNS with enterprise DNS change your architecture?

Why does integrating cloud provider DNS with enterprise DNS change your architecture?

Cloud provider DNS is a different beast than enterprise DNS. Each provider abstracts underlying detail but implements DNS features and limits differently, which can quietly break existing enterprise DNS architectures if you assume they behave the same.

In hybrid designs the differences surface around role-based access, service tags and labels, provider-specific routing, and how DNS integrates with cloud-native load balancers and identity. These constructs change how traffic, telemetry, and incidents appear, because ephemeral IPs and identity-based policies alter how traffic looks the moment it crosses into on-prem networks — which matters for monitoring, source-IP tracking, and incident response.

Teams should adopt metadata-driven policy models based on identity, tags, and labels alongside legacy IP-based controls, and combine cloud fundamentals with hands-on labs to observe behavior. Organizationally, avoid a silo where legacy teams keep the lights on while a separate cloud group builds independently; involve DDI and firewall SMEs in cloud projects to share ownership of hybrid design.

Banner for Critical Conversations on Critical Infrastructure episode about cloud provider DNS with five network expert paneli Read article
Deeper read

5 IT pros on joining enterprise and cloud provider DNS

Networking pros explore integrating enterprise and cloud DNS during the fifth Critical Conversation on Critical Infrastructure hosted in Network VIP.

67 min Blog
Read more

· 04 — Can encrypted and modern DNS standards hold together across a hybrid estate?

Can encrypted and modern DNS standards hold together across a hybrid estate?

Only with centralized policy. DNSSEC and DNS over HTTPS solve different problems — DNSSEC provides origin authentication via a chain of trust, while DoH encrypts DNS transport for privacy — so they are complementary, not competing. Holding either together across a hybrid estate depends on consistent policy that spans otherwise fragmented platforms.

DNSSEC adoption has been slow primarily due to operational complexity and legacy compatibility concerns: administrators must manage signed zones, key material, and ongoing key rotation, while backward compatibility requirements bloated DNS and added more to break. DNS Flag Day was essentially a wake-up call to DNS providers to remove older, broken, non-compliant systems and support modern extensions like EDNS.

Encrypting DNS with DoH improves end-user privacy but hampers traditional enterprise monitoring that relies on plaintext DNS to detect threats, route traffic, and apply controls. It also concentrates resolution in a small number of public resolvers. Retaining visibility across a hybrid estate therefore requires a centralized layer that applies consistent controls, including DNSSEC, across what would otherwise be separate platforms.

25 years

DNSSEC has existed for roughly 25 years, yet adoption stays slow because signing zones, rotating keys, and debugging broken trust chains remain operationally hard.

Seven headshots and avatars of IT professionals featured in an IT pros debate on network silos and cross-team collaboration Read article
Deeper read

DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?

We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.

50 min Blog
Read more

Send us a message and start your assessment today.


· 05 — What should teams look for in an approach to unify hybrid DNS management workflows?

What should teams look for in an approach to unify hybrid DNS management workflows?

Teams should look for an approach that adds a centralized management layer over existing DNS rather than replacing it — one that delivers unified visibility, role-based delegation, workflow-based change control, and an incremental path to automation, while the DNS services teams already trust keep running underneath.

DNS rarely fails on technical merit; the strain is operational. As servers, zones, sites, and cloud services multiply, management fragments across native tools, spreadsheets, scripts, tickets, and the institutional knowledge of one or two senior admins. Adding more DNS infrastructure compounds this rather than solving it, so the right approach attacks the operating model instead of the platform.

Centralizing services, zones, records, and IP address data behind a single interface gives teams visibility into what exists and what changed, lets them delegate access by role without handing out full control, and applies consistent workflows to every change. Because the layer sits on top of existing services, there is no migration event. From that stabilized baseline, automation becomes a choice — codified incrementally through a REST API and infrastructure-as-code tooling such as Ansible and Terraform.

BlueCat e-book banner titled “Getting more from Microsoft DNS” with woman working on laptop on a dark, geometric background Read article
Deeper read

Getting more from Microsoft DNS

Simplify, automate, and gain visibility across your Microsoft DNS environment—without replacing what already works.

3 min Blog
Read more

· 06 — How do lean teams centralize on-prem and edge Microsoft DNS without a rip-and-replace?

How do lean teams centralize on-prem and edge Microsoft DNS without a rip-and-replace?

Lean teams centralize on-prem and edge Microsoft DNS by overlaying it with a management layer that consolidates DNS zones, records, and IP address assignments into a single interface. BlueCat Micetro does this without replacing existing Microsoft DNS and DHCP servers, making it as easy to manage them at branch and edge sites as in the data center.

Fragmented management across on-prem servers and separate consoles makes consistency hard and lets IP conflicts and overlapping allocations accumulate — problems spreadsheets and disparate tools cannot track in real time. Micetro consolidates records and address assignments from on-premises infrastructure into one management interface, so teams see all zones, records, and allocations in one place and cut the risk of misconfiguration.

Micetro automates the workflows that eat engineering time: IP address assignments, subnet management, and DNS updates, plus automatic discovery of new zones and allocations as resources change. It enforces uniform DNS policies and provides audit logging to prevent unauthorized changes, giving lean teams centralized visibility, governance, and operational efficiency across on-prem and edge without disruptive migration.

1 management interface

Micetro consolidates DNS zones, records, and IP address assignments from on-premises and cloud infrastructure — including Microsoft Azure and AWS — into a single management interface.

Micetro_ Hybrid Cloud Integration Blog Read article
Deeper read

Micetro simplifies hybrid cloud DNS and IP address management

Learn how Micetro can help you simplify and streamline DNS and IP address management across hybrid and multicloud environments.

4 min Blog
Read more
Visual showing how you can regain control and visibility over your network infrastructure with BlueCat Micetro. Read article
The Overlay Approach

Micetro

With Micetro, integrate, orchestrate, and automate your current DNS, DHCP, and IPAM network infrastructure via a single web interface.

5 min Page
View Micetro

· 07 — How do you orchestrate cloud and multi-cloud DDI from a single SaaS control plane?

How do you orchestrate cloud and multi-cloud DDI from a single SaaS control plane?

You orchestrate cloud and multi-cloud DDI by connecting your cloud DNS, DHCP, and IPAM systems to a SaaS-based control plane that centralizes policy, identity, automation, and reporting while services keep executing locally in each cloud. BlueCat Horizon does this through lightweight, outbound-only agents, so your cloud and multi-cloud environments join one SaaS control plane without migration.

Modern estates spread DNS across multiple cloud platforms, and appliance-bound, siloed cloud DDI introduces operational risk, inconsistent governance, and slow response when issues occur. Horizon connects those cloud systems via lightweight agents and service points, applying consistent identities, policies, and automation while preserving native cloud workflows, local performance, and data sovereignty.

Bi-directional synchronization reconciles changes made centrally or locally, ensuring consistent state and auditable change across heterogeneous deployments. Built-in reporting surfaces IP utilization, DHCP lease activity, and configuration changes from selectively surfaced metadata, without full data ingestion or extra licenses. For estates whose center of gravity is cloud and multi-cloud, Horizon delivers one source of visibility and a path to AI-driven NetOps, without moving on-prem execution.

BlueCat Centralized DDI control datasheet header with branding, headline, and introductory description text Read article
Deeper read

BlueCat Horizon data sheet

BlueCat Horizon is a SaaS-based orchestration and control plane that centralizes DDI policy, identity, reporting, and automation across heterogeneous,…

3 min Blog
Read more
unified-ddi Read article
Cloud-native intelligent NetOps platform

Horizon

BlueCat Horizon is a SaaS-first Intelligent NetOps platform unifying DNS, DHCP, IPAM, security, and observability to automate modern network operations AI

6 min Page
View Horizon

· 08 — Paths forward

Which approach to unifying hybrid DNS management is right for your estate?

The right choice depends on where the immediate pressure sits, on-prem and edge Microsoft-centric operations or cloud and multi-cloud sprawl. Micetro governs the on-prem and edge Microsoft domain, Horizon governs the cloud and multi-cloud domain. The two paths below map to where your pressure sits today, and a true hybrid estate runs each in its own domain.

PATH 01
Lean team, Microsoft-centric on-prem plus branch and edge, no appetite for migration

Overlay on-prem and edge Microsoft DNS

Centralize services, zones, records, and IP address data behind one interface without replacing Microsoft DNS. Introduce role-based delegation and workflow-based change control first, then expand into automation through a REST API and infrastructure-as-code tooling when the time is right.
References: · 02, · 05, · 06
PATH 02
Growing Azure, AWS, or GCP footprint, cloud DNS silos, need visibility without moving operational data

Orchestrate cloud DDI from SaaS

Connect your existing cloud DDI through a SaaS control plane that preserves local execution in each cloud, reconciles changes with bi-directional synchronization, and surfaces built-in reporting for governance. This delivers cross-cloud visibility and a path to Intelligent NetOps without centralizing sensitive data.
References: · 01, · 03, · 07
PATH 03
True hybrid estate with real weight in both Microsoft on-prem and cloud

Run each domain on its own control plane

Use Micetro for the on-prem and edge Microsoft domain and Horizon for the cloud and multi-cloud domain, each governing its own territory. This gives you consistent policy and auditable change control within each domain without forcing on-prem into a SaaS plane or cloud into an on-prem overlay. Start with whichever domain carries the most immediate pressure and add the other when it does.
References: · 04, · 05, · 06, · 07

Frequently asked questions

Common questions from teams unifying DNS across on-premises, cloud, and edge environments.

Every source cited in this analysis

Abstract navy and gray geometric header background for article on low-risk legacy DNS migration
Content Hub

What are the best enterprise strategies for hybrid and multicloud DNS forwarding across on-premises and cloud environments?

Hybrid DNS Multicloud DNS Updated

Public cloud DNS alone cannot span on-premises, cloud, and edge, and as estates grow, forwarder sprawl, overlapping IP space, and provider walled gardens erode visibility and invite outages. This pillar covers why cloud DNS falls short, how to standardize naming across AWS, Azure, and GCP, DNS security trade-offs, and what a centralized forwarding approach needs. Two paths follow, chosen by where your estate lives: Micetro modernizes on-premises Microsoft DNS in place, and Horizon runs cloud DDI with observability.

· 01 — Why public cloud DNS falls short for hybrid estates

Why isn’t public cloud DNS enough for hybrid and multi-cloud environments?

Public cloud DNS services are designed to serve workloads inside a single provider's tenant and do not deliver the cross-tenant, cross-cloud, and on-premises connectivity that hybrid enterprises need, a gap that creates availability, compliance, and security risk.

Cloud DNS is optimized for compute inside its own environment, with limited or conflicting mechanisms for zone delegation, recursion, and forwarding beyond those boundaries, and little name-server interoperability outside the cloud-delivered service. As the analysis notes, “cloud DNS is unlikely to be the only DNS service your enterprise relies on.”

Relying solely on cloud DNS leaves teams guessing at IP allocation, splits DDI into separate silos, and forces complex forwarding rules that invite misconfiguration and outages. “Enterprises need highly available network services that can deploy and scale and across heterogeneous architectures, from on-prem to cloud” which means extending on-premises DDI into the cloud.

Three hanging lightbulbs reflecting clouds, symbolizing ideas and visibility in hybrid cloud DNS infrastructure Read article
Deeper read

Cloud DNS: Benefits and obstacles for hybrid networks

Unsure about cloud DNS services and hybrid-cloud enterprises? Learn more with BlueCat, including why it isn't so simple for managing networks.

8 min Blog
Read more

· 02 — Standardizing DNS naming across the major clouds

How do you standardize DNS naming conventions across AWS, Azure, and GCP?

Standardizing DNS naming across clouds requires involving DDI teams early and enforcing consistency through centralized DDI practices and third-party tooling that span the account, VPC, and provider boundaries the clouds themselves do not bridge, because each public cloud exhibits heterogeneous support for DNS features and readily duplicates names across boundaries.

Self-service adoption creates “islands of cloud”, many teams spin up accounts, VPCs, zones, and records without DDI expertise. “This decentralization fragments DNS management, reduces visibility and control, and increases interoperability issues across heterogeneous stacks,” producing duplicated names and one-off forwarding rules across boundaries.

Providers also differ on supported record types, DNSSEC (AWS and GCP support it; Azure does not), and hosted-zone limits, so cross-boundary resolution stays brittle. Because the clouds will not interoperate across their own walls, consistency has to be imposed from outside: “organizations should involve their DDI teams early in cloud adoption to design consistent, enterprise-grade DNS that spans on-premises and multiple clouds,” supported by third-party discovery and management tooling.

10 / 250 / 10,000 hosted-zone caps

AWS, Azure, and GCP cap hosted zones at 10, 250, and 10,000 respectively; one of many inconsistencies that force workarounds and complicate naming across a multi-cloud estate.

dns header Read article
Deeper read

Comparing AWS, Azure, and GCP cloud DNS services

The public cloud presents major challenges for DNS management. Examine various capabilities and limitations of Azure, AWS, and GCP with BlueCat.

14 min Blog
Read more

· 03 — The DNS challenges hybrid and multicloud introduces

What new DNS challenges do hybrid and multicloud networking introduce during cloud migrations?

Hybrid and multicloud networking introduces segmented virtual networks, overlapping IP space, fragmented DNS namespaces, and new security boundaries that make traditional ad hoc DNS stitching unmanageable and push teams toward a brittle patchwork of conditional forwarders.

Cloud networking replaces familiar Layer 2 domains and clear public/private boundaries with VPCs, peering, gateways, and private endpoints across providers. Microservices and Kubernetes multiply DNS names, while multi-cloud designs “create overlapping IP space and fragmented namespaces that outstrip typical cloud team skills.”

Manually maintained conditional forwarders and stub zones become a “wild west” that erodes visibility and security as the environment grows. DDI teams regain control by establishing a single, authoritative source of truth for DNS, DHCP, and IPAM, because “single source of truth is necessary to drive any level of automation with success.”

1,000s conditional forwarders

Hybrid cloud environments routinely accumulate thousands of conditional DNS forwarding rules, concentrating risk and operational burden on a small group of DNS experts.

City skyline at dusk with glowing blue light trails arcing like data streams over the streets Read article
Deeper read

Hybrid and Multicloud Networking Strategies for Cloud Migrations

Hybrid multicloud DNS should centralize DDI, governance, and cloud integration to avoid brittle forwarding and restore visibility.

6 min Blog
Read more

· 04 — DNS security and threat detection in hybrid DNS

What are effective strategies for DNS security and threat detection in hybrid environments?

Effective DNS security for hybrid environments combines integrity and visibility: DNSSEC provides origin authentication through a chain of trust, while preserving enterprise visibility into plaintext DNS queries remains essential for threat detection; the reason many organizations approach DNS over HTTPS cautiously.

DNSSEC and DoH solve different problems. DNSSEC signs DNS data so resolvers can validate that responses are authentic and untampered; DoH encrypts DNS transport for privacy. They are complementary, not competing but “DNSSEC provides origin authentication via a chain-of-trust but is hard to configure and maintain.”

Encrypting DNS with DoH “hampers traditional enterprise monitoring that relies on plaintext DNS,” reducing the visibility security tools use to detect malware and route traffic, and concentrating resolution in a few public resolvers. That trade-off is why hybrid threat-detection strategies prioritize retaining query-level visibility.

Seven headshots and avatars of IT professionals featured in an IT pros debate on network silos and cross-team collaboration Read article
Deeper read

DNSSEC, DNS over HTTPS & DNS Flag Day – What’s the Difference?

We rounded up industry experts to discuss the intersection of networking, cloud, storage, and virtualization. Here is their conversation.

50 min Blog
Read more

· 05 — What to look for in a hybrid DNS forwarding approach

What should teams look for in a hybrid DNS forwarding approach?

Teams should look for a centralized approach that treats each data source as a namespace with ordered, prioritized forwarding, maintains a single source of truth across on-premises and every cloud, works across all major providers, and automates DNSSEC rather than requiring manual command-line work.

“Decentralized or parallel management of DNS infrastructure can result in a situation where automation becomes harder to achieve.” The first criterion, then, is centralized, intelligent resolution: when the resolver is the first hop, it checks each namespace in the administrator’s chosen priority order and forwards only if the previous source returned no answer.

The second is cloud neutrality and low-toil security, resolution certified across AWS, Azure, Google Cloud, and private clouds so DNS is managed consistently wherever assets live, plus DNSSEC that propagates across parent and child zones automatically instead of manual key generation and trust-anchor redistribution.

Stylized network diagram showing cloud linking server, desktop, laptop, tablet and smartphone over binary code background Read article
Deeper read

Secure, cloud-managed network services through DNS

DNS can be a major headache in the cloud, but it doesn't have to be. When centrally managed with tools for intelligent routing, DNS can be an asset.

3 min Blog
Read more

Send us a message and start your assessment today.


· 06 — Modernizing on-prem DNS and DHCP without rip-and-replace

How do lean, Microsoft-centric teams modernize on-premises DNS and DHCP without rip-and-replace?

Lean teams modernize on-premises DNS and DHCP by orchestrating migration in place with BlueCat Micetro, which replaces manual exports and late-night cutovers with wizard-driven, transactional workflows across Microsoft, BIND, Kea, and Cisco IOS, reducing effort while preserving a one-click rollback path.

Micetro treats every migration as a secure transaction using the same object model as its REST API, so data stays consistent and pre-flight verification catches configuration conflicts and missing dependencies before any change is applied. “Pre-flight verification eliminates change risk,” with automated halt-on-error and instant rollback removing the cutover anxiety.

It can even recover DNS zones and DHCP scopes from offline or decommissioned hardware using cached metadata and backups, so legacy Microsoft servers retire without being brought back online. Because every function is exposed via REST API, bulk migrations integrate with Ansible and Terraform for gradual, on-premises modernization.

60–80% less migration effort

Wizard-based migration with built-in validation reduces migration effort by an estimated 60 to 80% compared with manual export-and-script processes, with fewer post-migration incidents.

Flock of geese flying in formation across a blue sky, framed by a pink graphic border, symbolizing coordinated network migrat Read article
Deeper read

Automate your DDI modernization path by migrating with Micetro

Automate cross-platform DNS and DHCP migration with Micetro to reduce risk, eliminate manual effort, and modernize infrastructure faster.

4 min Blog
Read more

· 07 — Unifying cloud DDI with observability as SaaS

How do teams unify cloud and multi-cloud DDI with network observability as SaaS?

Teams whose center of gravity is cloud-first and multi-cloud unify DDI with observability through BlueCat Horizon, a SaaS platform that brings DNS, DHCP, and IPAM together with network observability so addressing and resolution data can be correlated with live telemetry for faster incident response. It is the cloud-domain choice, selected by estate, distinct from the on-premises modernization path, not layered onto it.

Horizon functions as a common control and integration layer across SaaS-based offerings, providing shared API gateways, authentication, and centralized AI analytics. EMA identifies unifying DDI and observability as a strategic shift, because it enables cross-product workflows, context-driven operations, intelligent traffic steering, and closed-loop security responses that were previously siloed.

Its architecture separates cloud-based control from local data and service residency: the control plane, AI, and orchestration run in the cloud while protocol services and high-volume telemetry can remain in the customer’s chosen cloud environments. Adding new services becomes less disruptive because integrations and data flows already exist within the platform.

BlueCat Horizon brochure cover titled "A SaaS Platform that Unifies DDI and Network Observability" with EMA and BlueCat logos Read article
Deeper read

EMA Impact Brief: BlueCat Horizon

EMA evaluates BlueCat Horizon, highlighting unified DDI and observability, SaaS control architecture, and AI-driven integration benefits.

1 min Blog
Read more

· 08 — Paths forward

Which hybrid DNS forwarding path is right for your estate?

The right path depends on where your estate's center of gravity sits and what your immediate priority is: gaining visibility, modernizing on-premises without disruption, or running cloud-first DDI with observability. Most organizations progress iteratively, but the products divide cleanly by domain; choose the one that matches where your workloads and your risk actually live.

PATH 01
When hybrid sprawl has outpaced centralized awareness

Establish visibility and a single source of truth first

Consolidate DNS, DHCP, and IP data across on-premises and cloud into one authoritative system and enable query-level visibility before automating anything. This reduces IP conflicts and forwarder risk and creates the foundation for safe modernization.
References: · 01, · 03
PATH 02
Microsoft-centric estate, lean team, no appetite for rip-and-replace

Modernize on-premises in place with Micetro

Orchestrate cross-platform DNS and DHCP migration with wizard-driven, transactional workflows and pre-flight validation. Retire legacy Windows infrastructure gradually — even recovering scopes from offline hardware — while keeping a one-click rollback path.
References: · 05, · 06
PATH 03
Cloud-first or multi-cloud center of gravity, pursuing NetOps observability and automation

Run cloud and multi-cloud DDI with Horizon

Unify DDI and network observability on a SaaS platform so resolution data correlates with live telemetry for faster incident response. Keep control in the cloud while protocol services and telemetry stay in your chosen environments.
References: · 02, · 07

Frequently asked questions

Common questions from teams designing hybrid and multi-cloud DNS forwarding.

Every source cited in this analysis

Podcast

How AI is changing enterprise software development

How AI Is Changing Enterprise Software Development (Sponsored)

HS136 – Sponsored Bluecat

[John Burke] (0:00 – 0:05)

Hi, I’m John Burke, CTO of Nemertes, here with my co-host.

[Scott Robohn] (0:05 – 0:14)

 I’m Scott Robohn, CEO of Solutional and host of Total Network Operations, a sibling show here on Packet Pushers.

[John Burke] (0:16 – 0:28)

And you’re listening to Heavy Strategy, the show that tries to ask the right questions, not give the right answers. Joining us today is Andrew Wertkin, Chief Strategy Officer at BlueCat Networks. Andrew, thanks for joining us.

[Andrew Wertkin] (0:28 – 0:30)

Thank you for having me. I’m looking forward to it.

[John Burke] (0:30 – 0:52)

And on today’s show, we’re going to be talking about just what a network management company is going to talk about, the challenges of using AI for enterprise network automation, because we all know IT folks are bending AI to the task of speeding up network automation efforts. Why isn’t that as simple as it sounds? Why can’t we just take Claude’s word for it 99% of the time?

[Andrew Wertkin] (0:54 – 2:08)

Yeah, just put it in a permissive mode and just click go. Done. Yeah, you know, it’s interesting because, you know, I’ve been in, well, I’ve been developing software since I can remember.  You know, there’s a reason I can’t write. I’ve been typing my entire life. And I’ve enjoyed the craft very, very much. But you know, it’s been interesting on the network side because the teams have been doing a really good job. And by the teams, I just mean network engineers out there driving automation, like, you know, pre-code generation, pre-LM, and really trying to sort of, you know, mature the methodology of developing software akin to how software development companies develop software. And with AI and with LM-driven or generated code, without those best practices, it’s kind of scary to think about what might happen on the network. So, you know, it comes down to probably a further transformation in those teams to sort of more sophisticated processes around software development, because the faster stuff can be created, the more stuff can break, probably.

[Scott Robohn] (2:09 – 3:24)

You have a thesis that really resonates with me, right? I would say, you know, one of the other hats I wear is a co-founder of an organization called the Network Automation Forum. And as of recording today, I’m coming off our last meeting, AutoCon 5 in Munich, Germany.

And, you know, we started that discussion on the attenuation against the adoption of network automation before AI entered the room, right? And so there’s always been a certain level of resistance to letting automation go full throttle. And now, you know, the bots and the agents are walking into the room and, you know, the eye rolls are happening and the skepticism is strong. I would love to use that as part of our conversation here to say, I agree with you. We need to see great best practices develop in software engineering and software development, because a lot of what we do in network operations is downstream from that. So I know I’m throwing a little maybe taking a little too much time here up front, but just that’s my perspective. And I’m really interested to have this dialogue with you.

[John Burke] (3:24 – 3:42)

Yes, super. And I think you’re spot on. The distrust issue of automation in the network shop runs 25 years deep. I mean, we have been hurt. We have been hurt badly by trusting automation too far, too fast, many times.

[Andrew Wertkin] (3:43 – 6:00)

Yeah, what I always hear is trust, trust more so for repeatable, templated actions. Yep. If it’s outside of sort of simple, repeatable, templated, then, yeah, that’s where that sort of lack of trust starts, starts coming in pretty heavily. And, you know, as we know, our brethren, a vendor coming by saying just point and click, simple, easy automation is probably the worst way to gain trust with end customer. You know, the more sort of opaque it is, the more concern there usually is, which, yeah, is, you know, drives, it just sort of accelerates potential that distrust in the world of AI, you know, and I don’t know, well, we can talk about ways to sort of approach it and drive more trust, but, you know, it’s not just in networking and network, you know, it’s obviously across the board. You know, many of us have lived in environments where source code control wasn’t being used, where, you know, reviews weren’t done appropriately, where code was copy and pasted from somewhere else without being scrutinized for current environment, where I could just go on and on and on.

And you can trip like, you know, 10 of those major issues and like within a day if you’re if you’ve only accelerated it, but it does bring a tremendous amount of promise. And but it’s not just it’s not just software development, right? It’s debugging what’s going on and trying to figure out what’s going on in live environments and why it’s not working in some of those areas. As long as you stay, you have somebody with the right expertise and you stay critical of what you’re being told, the amount of work that be done in a short amount of time is just it’s it’s amazing, just absolutely amazing. As long as you’re not just like, oh, you said it’s that it’s that, OK, I should do this, I should do this. That’s where the concern is, because we know the LM’s, you know, tend to as hard as you prompt them otherwise tend to get pretty black and white about, you know, they think they found the root cause.

[John Burke] (6:01 – 6:43)

I like with the idea of accelerating automation, the idea that you’re going to be able to help people accelerate better practices if they’re using better practices with AI, they’ll get to the end of their automation project more frequently. They won’t leave it half finished or three quarters finished, never fully debugged, never fully documented. Right.

And then move on to the next emergency. There’s more chance that they’ll be able to in a single day or two days or a week or two weeks get all the way through and leave something behind that they can actually use again confidently as opposed to, you know, with some fear and trembling.

[Andrew Wertkin] (6:44 – 6:58) 

Yeah, yeah. It’s a lot of it’s just about architecture. A lot of it’s about. Well, one is that, you know, the appropriate developer mindset, which is I’m writing this for the people that will maintain in the future, so let me keep that in mind.

[Scott Robohn] (6:58 – 7:02)

Which is automatic, right? Every developer thinks about that from day one.

[Andrew Wertkin] (7:02 – 9:15)

Yeah, yeah, yeah, yeah, yeah. Especially when it started with, oh, you know, we need a quick script to try to solve this issue. And and, you know, and then somebody finds that six months later or. So a lot of it comes down to architecture, you know, like a lot of what is going to be in that automation will be repeated, right? Like how do we authenticate or what are standards around logging or how do we want to log or, you know, just how are we going to interface with with our devices? How are password faulted and how do we get those out of the vaults and, you know, how do we want to test or how should we think about backing out changes or whatever the case might be? Almost everything I just listed off is something that is repeatable and in this appropriate methodology. Well, now you just need to go sort of add your business logic, not necessarily all these other pieces. And and therefore all the code stays fresh and it’s being tested and on and on. But, you know, it’s it’s it’s really easy to build something quickly. And everything I just listed off also sounds like it’s going to take longer than just having eight people reel off a different, fully functional, you know, A to Z scripts, applications, you know, whatever we’re building. And so it’s just there’s there’s, you know, it’s probably more important than ever to sort of start with the right foot forward and start thinking about how we’re going to make this sustainable and and, you know, where humans will be in the loop and where they, you know, it’s critical they’re in the loop.

And, you know, what what sort of practices are we going to bring forward to do this safely? All of these things are just, you know, it’s many of these are the same things we’ve always considered or we’re concerned about as building software over, you know, the last several decades. Right. Some of it’s just how rapidly it can be done now. And and it’s not like just people copying and pasting stuff off of Stack Exchange.

[Scott Robohn] (9:16 – 10:33)

Like anybody can have code generated that works in that environment, you know, like that’s easy to do, it’s, you know, and that it was not the case two years ago, like I think like we you were in the middle of this fast changing and experimental time, right, where if you go back just a couple of years, you know, people had their their initial experiences with chat based tools and got widely varying results. You know, the whole nondeterminism of LLMs thing that was that was our first experiences. And then, you know, we see we see the advent of vibe coding and what an enabler it is for prototyping and but what a spaghetti mess it can produce for an enterprise code base to now emergent methodologies like spec driven development and test driven development. Like, I think we’re seeing the emergence of, OK, here’s how I use the tools, you know, and here’s how I can actually build trust in the technologies versus my first, you know, chat GPT three dot X experience. Right. What are you seeing on those fronts, you know, in the emergence of these strategies and repeatable tools that are coming up?

[Andrew Wertkin] (10:34 – 11:59)

Yeah, no, we’re we’re we’re seeing them for sure and have been experimenting and adopting a couple. I think we’re we’re. We my company and also me personally have had the most success is interestingly, like the part I spent probably the least time about in my career, not the company, but me personally, which is that upfront spec development and working with the LM on trade offs, and that’s where I can bring in my experience and how should we approach this and spending that time up front, breaking it down into reasonable chunks and and then, you know, putting the appropriate guardrails in place and, you know, that that sort of stuff has been transformative and versus, you know, trying to type out a prompt describing exactly what you want, just the sort of iterative spec and test development that really starts with, OK, I want to create a high speed TCEBF logger. Right. I’ve never done that before. Right. And and so I don’t even know what the trade offs are. And so, you know, I’m not I’m not, you know, so how much can I trust, you know, whatever? But I can start at a very high level. I want to do this. What don’t I know?

[John Burke] (11:59 – 12:47)

Intent. You got it. Yeah. I think there’s a really important point, sort of one level underneath that, which is that stating your intent and need very clearly is crucial because when you’re having software twiddle the settings on hardware out in your network, twiddling the wrong settings shuts down the traffic flow or overburdens the processors so much that you get, you know, terrible performance drops as it as it maybe devotes all of its time to generating logs and sending them. So, you know, you’re in a space where infrastructural mistakes can happen and can happen at automation speed and have really huge consequences.

[Andrew Wertkin] (12:47 – 14:57)

Yeah. Yeah. I mean, in our world of DNS, I mean, just on the public side, if you look at the last several major outages that were announced by huge public corporations, I think, you know, 80 percent of them were automation driven change to DNS that took everything down, you know, and and now that I’m not going to remotely blame an LLM for that. That’s just but but you just, you’re well more likely the faster you can come up with the solutions and the more especially the more certain your your coding partner or your debugging partner, your performance partner, whatever the use case might be, the more certain they are, the more likely you’re going to be like, OK, you know, and then and then, you know, they’re everybody suffers from permission fatigue and. You just your fingers over enter and you just keep pressing it, you know, and so, you know, that comes down to also like, how do we how do we appropriately supervise the behavior and make sure those things don’t happen?

But, yeah, and, you know, so the more successful that sort of more successful express intent includes those things. You know, what do you know could potentially go wrong? What are you concerned about? What do you make sure is actually tested? What does load actually mean here? How should it behave? Now, you don’t need that stuff up front, but having the right experience to know what sort of the categories of things that you should probably be considering are good, you know, but what what you don’t need to do, and I think this is really matured in both tooling, but also process over the last six months, insanely small period of time, is just that you don’t need to start by writing a four page prompt on exactly what to deliver, right? You you do if you’re using like a, you know, less expensive, more run rate type model, like not a frontier model, but but just have a frontier model, write the spec for the run rate model. You know, you don’t need you’ll never be as good as an LLM in generating prompts.

[Scott Robohn] (14:58 – 15:55)

Right. Well, I I so I’ve layered in a technique where I basically ask the LLM to interview me where I’ll bring, you know, a page, page and a half of intent that’s reasonably detailed. And if you’re using it, using the process to develop all the all the all the right markdown files for SDD, number one, it’s it’s cheap. I know there’s token cost here, but, you know, I’m creating human readable documents that I can validate and verify after I’ve gone through an interview process. And I heard a great comment last week. You know, the code is free in a sense where, you know, we’re used to thinking about us, you know, laboring to get the code just right. But now we’re asking agents to write the code and we can iterate and we can throw away stuff that looks like garbage. And you still have to have enough domain knowledge to know that it’s actually garbage, right?

[Andrew Wertkin] (15:56 – 16:32)

Exactly. And that last point is, well, on the personal side, sort of my fear, what everything looks like in 10 years, but but also the most critical thing now without the domain knowledge and the sort of experience and expertise of how things can fail and how things should work and how they should gracefully fail and on and on, then then you’re you’re asking for trouble. But but yeah, I like that sort of and I do that to probably less regiment than you do. But that sort of like, you know, what what am I not thinking about here? Exactly. What else could go wrong here?

[John Burke] (16:33 – 16:53)

And when the LLMs are just as happy to bring you the, you know, deadly poisonous mushroom as the tasty and edible mushroom, and they look the same to a casual inspection. Yeah, that kind of domain expertise becomes irreplaceable and absolutely necessary.

[Andrew Wertkin] (16:54 – 20:08)

Yeah. And here’s what happens and why process is so important here is people sit down and they think they’re on the same page with the LLM. And, you know, over a couple of weeks, it seems to be true, like it’s seemingly remember stuff. And then, you know, on day seven, you start a new session and seemingly it forgot everything it ever knew. And it’s been sort of degrading over the week because you haven’t been documenting this. You haven’t been having, you know, saving the appropriate memories and making sure you’re updating your prompts and everything else. And then it makes a decision that is unbelievably naive. And you, because we humanize these things, have this thought of like, you know, you’re you’re working with a doppelganger or who is this person I’m working with? Like, how is it possible they forgot this? And so there’s a lot of errors that occur in those moments when operator, developer, network operator, whoever’s using it, is unclear of the state of the memory of the session and assumes some not necessarily something deterministic, but something at least informed by things we’ve done in the past is about to happen. And then, you know, surprise, you know, and and what do we call that? Like, you know, part of it is rediscovery tax. So, you know, I’m going to spend a lot of money as in tokens or credits or whatever in rediscovering the same thing over and over and over again because it’s not appropriately documented. And and these are things that the LMs in general, but, you know, depending on the coding tool. But, you know, I tend to use Claude a lot, but but regardless of you, several. But, you know, they’re really good at, you know, every time I end a session, like, what did we do? What did you have to rediscover and what that you had to rediscover? Should we should we appropriately document so you have to rediscover it again? And that’s not everything, because, you know, experimentation works. Sometimes you learn a ton when you make mistakes, you know, and maybe going back to the personal side is still professional side of sort of hardened software, like software that works, as we say, like works in anger, doesn’t just work in the lab. It doesn’t just work in the happy cases like it works, put pressure on it and still works. And, you know, getting getting to that point is, you know, it takes takes experience of having done it, but specifically having failed at doing it like it’s like, you know, something smells bad because you once made that error before, you know, or you around when that happened. And that kind of learning, which is, you know, very specific to the very large context sizes of our brains, you know, like is like you don’t even have to go review your notes. You’ll spot that pattern immediately if you’ve had the experience of failing, it just it’s wired in and those are things I just don’t know how they’re going to happen, you know, without purpose, without purpose.

[John Burke] (20:09 – 21:10) And I sometimes hear people saying it won’t be too long now when, you know, we won’t even be having AI develop these scripts or these programs for us. We’ll just tell it what we want to have happen. It’ll spin up a program in the background, send it off and get the thing done. And the next time we need it done, it’ll generate a program and send it off to get executed and we’ll be done. So it’s like it will be creating automation for us. It’ll be the automation. Sure. And for me, I think what you’re saying right now is the pushback on that. It’s like, OK, but the second time it sees this problem and it’s time to generate a program to solve it, is it going to remember how it solved it the last time?

Is it going to remember what went wrong and how it got fixed? Maybe, maybe not. I think until that problem is resolved and resolved by stuff that works in anger, as you say, like no matter how mad I am when I type the prompt to the AI, it’s still going to give me the right answer and the good answer. Then it’s not solved.

[Andrew Wertkin] (21:11 – 24:34)

And yeah, then it’s not solved. And the only thing I was going to add to that is you run into the opposite problem of, of, um, you know, cause the elements are matching patterns basically. Uh, and so something looks like it fits this pattern. It doesn’t mean that’s the answer. And ironically, like if you only have a couple of cases of this sort of like, you know, something failed, here’s why I know the pattern, like then the more likely something’s going to get sort of, you know, force fit into that, like, you know, pound the, the, the round peg into the square hole if it almost fits, you know? And, uh, and it’s just, I think there’s a, still a bit of a chasm between, um, especially in the world of Brownfield, but, but, uh, between, right, I’m just going to state my intent and the scripts will be written, stuff will be done. I’ll never have to look at this twice. Um, for that actually being done in an enterprise network where, um, you know, you don’t have all the tools today to get that done. Um, you don’t necessarily have the budget today to get that done. Um, and you have history. And that history includes things that are not good in the world of AI, which are things like tribal knowledge and one-offs. And, you know, this was done for a very specific reason, but there’s like yellow tape around it. Nobody knows why, but we just know if we change it, everything breaks. So, so we’re not changing anymore. You know, it just, this was never documented that wasn’t documented. So, um, you know, I, I just go back to, um, one of the sort of, um, really well-known, um, foundation books in software development that, that, you know, tools and tactics have changed, but this book is as true as it ever been was, uh, Martin Fowler’s refactoring, which, which I think in the forward, like the first, in the first couple of paragraphs, it says, if you can’t test, put this book back on the shelf, um, paraphrasing something, something close to that, like you can’t change it unless you can test it. And in this world of like, um, you know, tribal knowledge and one-offs and not everything following a pattern, um, how, how are you going to, how are you going to approach that, um, especially if there’s nothing to test against your lab, doesn’t have those one-offs, your lab, you know, it’s how do we actually test this appropriately? And, and, and that’s what causes all of this, you know, longer change management process. They know the organization’s learned if we touch that, it’s going to break. So that’s only going to happen on like this type of change window where we have three and a half hours and nothing else can be scheduled during that change window and like they’ve, they’ve never fixed the underlying problem, but they’ve, they’ve wrapped it around process. And so, you know, companies also enterprise is going to have to look at, you know, where to start with this stuff. Um, and, and stating the obvious, um, uh, net new is, uh, you know, build this way to begin with great, um, changing something exists, whether that’s software or a network architecture, um, that’s way harder for humans and LLMs, uh, but on the L at least the humans hopefully have some of the tribal knowledge.

[Scott Robohn] (24:35 – 26:08)

One of the, so another exciting thing that I think is in front of us here is, you know, to your point of everything you’ve just laid out. Um, you know, if I have an LLM, everything looks like a prompt, right. And we’re, I think many of us are figuring out that, you know, not everything is a problem for an LLM. And, and we have, we have this really interesting and potentially useful set of new computational techniques in front of us, and we haven’t gotten rid of all the others. Like machine learning is still really useful for other things in the, in the AI space, statistical regression last I checked doesn’t really cost me any tokens. Right.

Right. So I’m adding to the tools in my toolbox and the really fun puzzle that’s going to be in front of us all is like using the right tools for the right job here. LLMs where they make sense, ML where it makes sense, regression where it makes sense, um, maybe for the, the, the problem that you called out of, you know, reinventing the wheel every time the question’s asked, maybe part of my constraints are, okay, I’ve solved a problem and I’ve put it into my IT service catalog. And if there’s something in my service catalog that is a 90% or better match for this prompt, use what’s in the service catalog and don’t spend tokens on creating another solution for it. And I’m, I’m riffing here, right? But I think these are all like approaches we need to put on the table as we collectively all figure this stuff out.

And I’m, I’m much more positive about it than I am cynical about it. Um, check in with me in a year and see if I say I feel the same way.

[Andrew Wertkin] (26:08 – 30:11)

So, no, it’s interesting on that sort of service catalog side. I mean, it’s in the good news is just have the LM check to see if you solve the problem before, you know, and, uh, and they’re again, super good at matching patterns, they’ll find something. And that’s actually like of all the sort of techniques I’ve developed, uh, over the last year, let’s say, um, that sort of tight link between, uh, documentation of what I did and what I actually did is, um, is, is, is super both from the perspective of, you know, it’s, it’s, it’s quick story. I years and years ago, I was CTO of a company in the application lifecycle management space. So we built software to help build software and we specifically, um, like part of our, like ideal customer was in, uh, embedded software that was safety relevant where, um, a defect could cause harm to the operator, for instance, um, like automotive or, you know, you name it. And so, um, there in, in that world, there’s all sorts of standards like ISO 26000 and, and, uh, automotive SPICE and on and on. And part of the standards around, like there must be traceability between requirements and code. Right. Um, and if the requirements change or the code changes, that trace becomes, um, you know, potentially problematic. And I’m going to go in and look for any of those impacts and I’m going to have to say in this change, by the way, I changed the code, the requirement still, you know, is correct. The test case is still correct. The architecture is still correct.I’m going to have to go do that for all these suspect traces. Um, and that like, you know, you’re not going to convince somebody building, um, B2B software that they need that level of traceability. Right. But like I do that when I’m doing LLM based development, cause it’s amazing, you know, one and mostly, well, I enjoy it, but, but also because the LLM then goes and traces. Um, and the LLM can quickly figure out why we did something the way we did it, because it can trace back to the documentation and, and, and the LLMs writing that documentation and the LLM knows to write the documentation for itself, which is something that, you know, like, um, uh, even if I, sometimes I will say, write this for a human, sometimes I’ll write it like, you know, write this document for a customer that may or may not be aware of software development, how software development works, or may never have installed Python before, whatever the case might be. Um, but oftentimes with those docs, I’ll be like, um, either include an addendum just for an LLM or just write this for an LLM and, um, and one, it’s more terse, but two, like, you know, LLMs are pretty good at writing documents for them to read and, uh, and, um, you know, both from an efficiency and cost standpoint, reading it, right. You know, like, um, the human version is, is more expensive, but regardless of that, um, that also like goes to this, um, okay, now I’ve included in the right software for the next person to maintain to also write software for the next LLM to maintain. Um, and given it, you know, the capability obviously to pull in and parse a lot of text rapidly, um, yeah, I’ve never had better documentation in my code or outside of my code. Um, would never have done this much documentation as a human. Um, ever, uh, you know, with the assumption, like most humans have, like while you’re writing it, uh, yeah, I’ll remember this. Yeah, this is pretty easy to read. Like I’ll just read the code, like it’s obvious or anybody would understand what I meant by that. Yeah, exactly. Yeah. I said, sorting, I’m sorting here, you know, and, um, and that, that those things lead to a tremendous amount of defects, but so does, um, uh, that, you know, even worse sometimes, I mean, what’s the old adage? Like the only thing worse than, um, no internet connectivity is crappy internet connectivity. That’s right.

Yes. Yeah. It same thing with documentation.

[John Burke] (30:11 – 30:48)

So in a way, um, you’re both mentoring your AI to improve its domain expertise. You’re teaching it more about what it means to run a physical network of physical devices and what the risks are and, uh, what the limits of experimentation are and so forth. Uh, and at the same time, you’re mentoring it on being a good team member by doing things like documenting its code and explaining itself for sure.

[Andrew Wertkin] (30:48 – 32:30)

No, it’s a good, it’s a good analogy because, um, that’s what I usually, uh, advise people is like, um, yeah, especially if they’re, they’re senior, like, um, yeah, just imagine you’ve got four junior to intermediate software developers working with you and, um, and that are pretty self assured, you know, like that, that are convinced they’re correct, you know? And, and so if one of them said to you, no, no, this is the best way to do it. You would say, why, what evidence do you have? Do we have enough evidence? You know, like what alternatives did you pursue before you came to the solution? And if you think about your interactions like that, then, then you’ll always think about what the right question, even though from a ability to generate code that works rapidly, you know, this is not a junior or intermediate software developer, but in terms of thought process, um, yeah, in many cases, intermediate software developers is, is, is, you know, is, is better thought process, you know, in other words, cause it’s thought process, it’s not, it’s not pattern matching and, and, you know, the other magic of LMs. Um, and so like that, I think that’s the biggest mistake, uh, people, you know, whether it’s, it’s bias, you know, confirmation bias or otherwise, like, um, uh, people are looking for, um, that sort of positive, this is how we’re going to do it. And, uh, and if they say, Hey, I was thinking about this, this is a good idea. We all know. Um, that’s the worst way to interact with an LLM because it’s going to happily come back and tell you brilliant. Wow.

[Scott Robohn] (32:31 – 32:39)

Yeah. You are so smart. That’s the best way I’ve ever heard. Yeah. Just, just include no sycophancy in every one of your problems.

[Andrew Wertkin] (32:39 – 33:53)

Yeah, no, a hundred percent do that. Cause I, I, I don’t need that from my peers, my employees and my parents. I definitely don’t need from an LLM, but, um, I do like it for my wife every once in a while. Um, but, but regardless, and my kids definitely, but regardless of that, yeah, no, it’s, but that idea that you’re like, you are the expert here and you’re working with, um, uh, something with less knowledge than you do of what you want to create and how it should work and what success looks like and how it’s failed in the past. And just keep that mindset, keep that mindset, keep that mindset. And then at some point you feel like, this is like, I’ve got the four best interns in the world working for me because that to me with the LLM, maybe five, sometimes seven, but like, it’s, you know, um, uh, the, the acceleration of being able to get this done tonight, please launch 10 parallel agents.

I wouldn’t say please, by the way, launch 10 parallel agents and run through our blitz testing protocol. And then I wake up in the morning and a whole team has been doing work all night and, uh, I, I don’t feel guilty. I don’t feel, you know, I, I have my coffee and read through the results and very powerful.

[John Burke] (33:53 – 34:32)

And you’re sort of, I think by implication saying what vendors like you can do to support this kind of work in enterprise network shops, and that is, you know, basically building the power tools that those AIs can wield with appropriate safety features. So, you know, the, the, uh, circular saw has the automatic shutoff, so you can’t cut your own fingers off as easily as you used to be able to things like that. Uh, you want to help them not crash the network by failing to do the obvious things with your power tools.

[Andrew Wertkin] (34:32 – 39:51)

Yeah. No, it’s interesting. Cause like, you know, like, um, most, uh, software vendors today, one of the things that we, we produce our, our MCP servers for our backend products.

And we have several backend products and, and, um, and I think like a lot of vendors out there, like initially that was just, okay, let’s wrap up our open API tools and this new protocol. And we’ll just expose that and, you know, uh, LM will figure it out. And you realize pretty quickly that, um, that’s not the right approach at all. You’re just going to waste a ton of tokens. It can be a ton of guesswork. You just sit there watching the LM guess and guess and guess. And, um, uh, you know, you’re yes, no, I’m can pretty quickly figure out how to use a rest API. And if it’s wrapped in, in, uh, MCP tools even faster, but that doesn’t mean they understand your domain. And yes, especially the frontier models have been trained on not just your domain, but probably understand more about your product than you might realize. Um, but, but none of them, um, like part of, part of what we deliver, it’s, it’s not just, um, you know, uh, more, uh, domain specific tools than an open API. Like, you know, have more conversation between the MCP server and our backend server than the LM has to see. Don’t don’t send the, uh, there’s a packet capture example. Like there’s no reason to send the LM a 20 megabyte packet capture that that’s, that ain’t going to do anything or send it a whole time series that you should be sending to, uh, ML, not, not in AI, you know, like, and so how do I get the data needs summarized data, maybe even opinionated data, because we know our systems well, so, you know, with, with sort of opinions built in. What does the LM need to answer the user’s question, which might’ve been like, you know, why doesn’t this work and think through that stuff as opposed to just, it’s a bit, I’m going to use the word lazy, but it’s a naive. I think it’s the better word. It’s naive just to assume the LMs will figure this stuff out well. And especially if you want this stuff to be remotely repeatable. Um, so yeah, so we do that, but it’s way more than that. Like, so now, you know, we just went through software development stuff. And, and so like, yeah, our, our customers can now pump out tons of automation scripts and otherwise against our products, super. How do we encode the best practices for doing that? So our customers don’t, you know, automate themselves into, um, downtime. So that, uh, so that they know, and that comes out in things like, you know, uh, network advisors and other things that, that, um, whether through prompts or, uh, specific code or capabilities or training material, like, uh, help our customers succeed at automation, because in our industry, like on the DDI side of our industry, on the, in the world of DNS and IPAM, especially, um, the tailwind of this industry has always been automation. You have to change the stuff faster. And so, um, it, we want our customers to be successful. It, it pains us. Um, we had a customer a few years ago, well before LMs, and it just going back to an example of like, um, the horrors that can happen if there’s no processes around the way you develop software was sort of teaching himself how to script against our product. And he had an administrative user and he wrote a script and went to test it and deleted the entire DNS environment inside this company, which immediately locked him out of systems and active director was down and they’re using that for LDAP and yada, yada, yada glass had to break. And it was, and he’s sitting there, um, like I can imagine I’ve, I’ve had that experience before, you know, like, um, I think once in university, I wrote an endless loop in an application running on a like old IBM PC where there was no, like you couldn’t control seed. You couldn’t like, you know, three hours of work. The only thing I can do is reboot the computer. You know, I know that sort of, that’s one of several examples, some being professional, that sort of sinking feeling of, oh crap. Yeah, we, we got, and I can imagine what was going through that guy’s head, you know? And, um, and so like, yeah, obviously that’s an extreme example, but my point is, um, the more we like, um, we always get asked in software development, like, uh, about metrics and measurements and somebody always goes, well, why don’t you guys just use like lines of code or something? And that’s like, yeah, like the idea for anybody in software engineering that the number of lines of code they wrote, the more, the better is a appropriate metric is, is insanity, right? So we don’t do that and nor do we suggest it. But my point is like, when you start thinking about the right metrics, well, certainly in the world of SAS, but now also in the world of like these scripts, it’s just not about like, the question is, did it work the way we expected it to? Was this a successful automation? Um, and, and what did we learn that didn’t succeed? And, and how do we sort of bring that back into a feedback loop? And like, it doesn’t, um, you know, I mean, I was like, uh, the, the least number of lines of code to solve a problem, the better, but, but mostly did it actually solve the problem?

[Scott Robohn] (39:52 – 40:36)

Well, in going to, you know, least lines of code as, as the other, um, could cause other problems, right? And like, again, one of the things that really jazzed about this whole environment and conversation is like the art of specifying our constraints is becoming much more important, um, probably than it ever has in our careers, right? You know, we’ve got power tools, where are we going to put the right blade guards on? And there were grounding plug. Um, my grandfather made a power tools for Porter cable. And I’ve actually have some of his old prototypes that I would never use to build a deck because there are pieces missing that keep losing digits. Right. So the system’s thinking, um, and there’s tribal knowledge.

[Andrew Wertkin] (40:36 – 40:39)

Cause yeah. Somebody else can, uh, that was right.

[Scott Robohn] (40:39 – 40:44)

For sure, John, this could go so many ways. Like, where do you want to take this?

[John Burke] (40:44 – 41:20)

Well, I think just to, to round it out, I want to follow through on this idea that, uh, folks in the business now need to be thinking about their software portfolio as power tools that will ultimately be wielded by robot hands, not human hands. And, um, how that’s going to change the enterprise software landscape. You know, we’ve talked a bit about how it changes process inside the enterprise, uh, for using it, but what about the rest of it?

Like, does it change licensing? Does it change, uh, you know, how else does things for sure.

[Andrew Wertkin] (41:20 – 44:13)

And I think, I mean, you know, part of it is sort of what you’ve seen in what the, you in, in the private markets in general with, um, with the devaluation of some software companies, which, uh, like, you know, we, well, we all should know the stock market doesn’t is, is it’s own thing. It’s his own thing. Yeah. Uh, but, but outside of that, um, it, for sure, it’s going to change licensing models. Uh, like, you know, if you’re only, if your licensing model is just based on per user and I’m not saying cause everybody’s in a fire, everybody, I’m just going to say, okay, what’s an agent is an agent user. And, and, um, uh, you know, it, it, it, yeah.

Companies are going to have to figure out, um, you know, what, what the right metric is going to be. And, you know, a lot of companies are switching to, okay, it’s going to be credits. And that’s the real value is, you know, how, how much you’ve pushed through this LM or how much, and, and their, you know, enterprises don’t like surprising bills every month.

Um, they, they like consistency, you know? And so, um, I, I think, uh, you know, early companies, especially the, the LM companies themselves, or the AI companies themselves, obviously are very focused on a sort of an opaque credit type, um, model where we all know the price is going to keep going up and up. We won’t be able to do the networking vendors.

Won’t be able to go in there and go up. Sorry, your bill this month is, um, yeah, it’s twice as much this month because yeah, we’ve changed the ratio between, um, credit and token. And, uh, and by the way, uh, we improved our stuff. So it’s better. So you’re going to pay more. Like it doesn’t work that way in our world. And so, yeah, I think licensing models are going to have to change. And, um, uh, uh, but so much, so much more than that, I think there’s going to be, I think we now have the opportunity, you know, how, how we always sort of go back and forth between platform and best of breed and platform and best of breed. I think we’re going to be heading back towards best of breed because sort of interoperability between these vent a lot between different products has become, um, much simpler to solve. Um, especially with things like MCP, like I don’t necessarily think I need a specific integration to, uh, ITSM systems anymore because all the ITSM systems, uh, have the ability to speak MCP. And so, um, that becomes easier, uh, picking a platform versus best of breed, but, but so, so in certain areas, it’s going to be disruptive to businesses where, you know, if their only goal was put as much stuff in our platform as possible, uh, and nobody will be able to compete with us, uh, that’s gonna change. Um, you know, and, uh, and I think should I launch in this? Yeah, I’ll do the 60 second, 30 second version.

[Scott Robohn] (44:13 – 44:13)

30 second.

[Andrew Wertkin] (44:14 – 44:29)

Yeah. Yeah. It used to be like in the world of big, ugly central systems that nobody can change, like the big ERP systems and stuff like that, like where companies would have to, like in their earnings report would be, we missed it this quarter because of a bad upgrade to this massive internal system.

[Scott Robohn] (44:29 – 44:31)

That wasn’t that long ago. 

[Andrew Wertkin] (44:31 – 45:58)

Yeah, it wasn’t that long ago. Yeah. And that was like, that was like the whole Salesforce marketing campaign initially with the no software. And we got that for you and all this greatness about, uh, SAS, um, uh, in that world, how they started getting disrupted was all these like new companies were bringing SAS based systems that were easy to use. They’re still the system of record, but here’s this new system engagement for HR, for travel management, for purchasing, for whatever, any part of that system. And then of course, those large companies in that space would just go buy those companies one after the next, after the next, after the next. And so to some extent, I, outside of the, I’m not quite sure acquisition is going to happen at, at, uh, there can be way too much to acquire.

Um, you’re going to see a lot of companies that, um, are coming up with system of engagement, like value propositions for existing platforms out there to slowly start taking user engagement or system engagement, uh, away. And, um, and that’s going to happen way faster than, than, uh, travel management and, and, uh, you know, goals on the HR side or purchasing or whatever these system engagements were that sort of started doing this with a large internal system. So in that world where it’s simpler to disrupt or at least do better a small part of an existing platform with integration almost laid out for you, I think that’s going to sort of drive this, you know, us back to best of breed.

[John Burke] (45:59 – 46:42)

And I can even, you know, envision taking it, uh, really far down that path. Uh, only the AI’s that work for us really understand what the software portfolio currently is because a new service pops up, they see that if they can do half of what they need to do in functional area X better, faster, cheaper. So now I’ve got two things in that area and it’s the one managing what work goes to which one. And, you know, it’s like a redundant array of software vendors kind of an approach. Uh, I’ll just arbitrage wherever it works best against the criteria that my AI, uh, understands for me matter the most saving time, saving money, better performance, whatever. Yeah. Yeah.

[Andrew Wertkin] (46:43 – 50:10)

Yeah. Cause I, I see like go to some expo floor in tech these days, especially in networking, but, um, you know, pretty much any, any tech related area. And you’re going to see company after company after company, uh, selling your platform for AI, you know, no matter where they came from, they’re now have a platform for AI that’s going to be multi-vendor. Why not? Everybody’s got MCP servers. And, and so what are you going to have as an enterprise, multiple platforms for agentic operations, uh, a single platform, um, uh, you know, one meta agent that manages a bunch of other agent platforms. What if I put the wrong one here? And, uh, and, and how quickly can I change? And, uh, um, and, and we seemingly, and I don’t understand this part cause it’s not the way I work, but people do have easy bias as well.

Oh. Oh yeah. They said they can handle this all for me. So I’m just going to buy that, you know? And, uh, and it comes down to like this theme. It’s funny, you know, earlier I said, I gave a real example. I had never written a EBPF, like, uh, you know, uh, internal space, high-speed logger. And, uh, and now I have, I still couldn’t write one. Um, right.

I use that as an experiment of what if I follow this process in an area that yeah, I’m well aware of how this stuff works, but I’ve never actually written software there. Like what will I learn? What I learned was how rapidly I can do something that I didn’t know how to do ahead of time. Um, and just with establishing the things we’re talking about before, like, you know, criteria and exit criteria and things I’m concerned about, I’m worried about, I have something that works. I don’t know if it’s the best way to solve the problem I started with. I don’t know if like, uh, you know, all I know is it’s maintainable code that, that works.

I mean, you know, I know more than that. That’s really well documented. So, so I guess my point is, um, uh, just like people still need to learn this stuff, you know, to, to sort of bring that experience forward. And that, I mean, like as much as I appreciate this technology, that’s my biggest fear is just, um, the worst mistakes always start when somebody believes they’re right. And people are either too intimidated or too starstruck or too odd or just too lazy to question person who for sure knows how to get something done. And the end result are things that could have been prevented that cause, um, problems. And we, we see that across like, you know, everything from tech to, uh, social environments to everywhere else, you know, and, uh, groupthink or, but, but, you know, it’s, um, that’s what I rely on my experts for, uh, you know, even if they don’t know, even if it sounds right In fact, the more right it sounds to them, the less likely they’ll take that at face value, uh, because there, there must be something wrong with this. What is it? It’s a puzzle. These are, you know, engineers in many cases. And, and, um, um, so as much as I appreciate the technology, use the technology, pushing forward with the tech, like creating value with the tech, uh, there’s part of it that just makes me uncomfortable.

[John Burke] (50:12 – 50:35)

Uh, a solidly cautionary note on which to end the conversation. Yeah. Thank you, Andrew, for joining us today.  This has been fantastically interesting and lots for the enterprise strategist to chew on as they think about how things go next, uh, in their it shops. Uh, Scott, thank you so much for, for joining us today as well. And as always, thanks to everyone watching.

📣  Now live: Explore BlueCat Horizon, our SaaS-first Intelligent NetOps platform.