Alternatives to EfficientIP SOLIDserver for ISP DNS/IPAM with Anycast?

[u/network-n-voice]

We've been using EfficientIP SOLIDserver for over 20 years. EfficientIP recently informed us that support for our perpetual licenses will end in August 2027. Their replacement subscription quote triples our annual cost (a 200% increase), with no protection against further increases at renewal.

We're evaluating alternatives and would appreciate recommendations from others with similar environments.

Our requirements include:

• Recursive and authoritative DNS with geographically distributed BGP anycast (currently three nodes, expanding to five).
• IPv4/IPv6 IPAM, including customer allocations and reverse DNS management.
• Self-hosted deployment on our own infrastructure.
• Reliable commercial support, strong APIs, and predictable long-term licensing costs.

We're considering Micetro, PowerDNS with NetBox, and BIND/Unbound-based solutions, but are open to other options.

Has anyone migrated away from SOLIDserver or operated these alternatives in an ISP anycast environment? Particularly interested in reliability, IPAM integration, migration experience, and ongoing costs.

Appreciate any firsthand experience or recommendations.

[u/southafricanamerican]

!remindme 2 days

[u/karafili]

Powerdns

Get 3 zones, get at least 2 dnsdist servers per zone. Assign them one or both the anycast IPs. Then behind the scene put at two powerdns auth servers as slaves. Then in your secured perimeter install a cluster of two powerdns masters and allow AXFRs with TSIG auth between the masters and the slaves.

Put powerdnsadmin in fron if you like a gui

[u/under_shart]

We just moved to EIP because Infoblox did the same trick to us and EIP was at least cheaper while using the same Oracletastic pricing model.

If you have a network tools team who are pretty expert at DDI, I would go BIND/Kea for the actual DNS and DHCP server, and whichever IPAM you prefer (Micetro, DNSbox, Netbox, IPAM-only EIP deployment, etc) to manage them centrally. All these pricey products like EIP and Infoblox are just running BIND and the predecessor to Kea, dhcpd, under the hood.

[u/Anakin19901]

agree with the PowerDNS route, and for your list it's the one i'd pick: auth + recursor + dnsdist from one vendor with paid support available, and NetBox for IPAM, which also has a commercial support option. you'd be glueing the reverse DNS sync together through the APIs yourself, but both APIs are decent.

two things nobody mentioned yet. first, tie the BGP announcement to a real health check on each node (bird or exabgp running a local query against the resolver and withdrawing the route on failure). with 5 nodes, the outage you'll actually hit isn't a dead box, it's a box that's up and still announcing while the daemon is wedged, so it blackholes its whole catchment.

second, keep recursive and authoritative on separate anycast IPs and separate processes, even if they share hardware. it makes rate limiting and failure domains much easier to reason about than one combined service.

[u/network-n-voice]

Thanks for the thoughtful responses. PowerDNS is emerging as a strong candidate, particularly with separate authoritative and recursive services and DNS-aware anycast health monitoring.

My biggest remaining question is IPAM integration. SOLIDserver is currently our system of record for all IPv4/IPv6 allocations, customer assignments, and reverse DNS.

For those using PowerDNS with NetBox (or another IPAM), how are you handling PTR creation, reverse delegations, and synchronization between the two? Are you maintaining custom integration code, using existing plugins, or managing DNS separately?

Also interested in real-world experience with commercial support for PowerDNS and NetBox.

[u/StatureDelaware]

Obelinf works fine for IPAM

[u/1a2b3c4d_1a2b3c4d]

!remindme 2 days

[u/exekewtable]

Powerdns but with the lightning stream s3 backend. Some batteries are included here: https://github.com/sol1-ansible/sol1-powerdns-lightningstream

Netbox python script to manage powerdns updates and you have pdns auth servers with a distributed database backend. I would still put dnsdist in front of the auth server, for rate limiting, and brute force mitigation. Dnsdist and pdnsrecursor is of course the way forward too.

[u/dwm]

The hard part of a DNS/IPAM solution is the management interface. EfficientIP have one, but there's also Bluecat Integrity, Infoblox, PowerDNS + Zonecontrol, Netbox with netbox-dns, and so on.

You may want a system where you can support inline authenticated dynamic DNS updates as well as out of band updates via web/API, if only for ACME DNS_01 challenges.

But once you've got the actual data, setting up replica authoritative DNS servers that use your core system as a hidden primary is relatively straightforward. You can even have a diverse set of implementations if you have the capacity and desire, e.g. BIND, Knot, NSD.

Setting up separate recursive servers that act as hidden secondaries for your core zones can also really help resilience. The use of catalog zones can also really help keep the configuration simple and effective.