• Internal DNS service for NAS and S3
  • Overview
  • Why use it? (Use cases)
    • Primary use case
    • Secondary use case
  • How it works
  • Setting up the Internal DNS Service
    • Step 1: Enable the service (Admin only)
    • Step 2: Configure a DNS name for the NAS network space
  • Monitoring: New Events
  • Configuring clients to use the InfiniBox DNS
    • Windows clients
    • Enabling Kerberos authentication for SMB over the DNS FQDN
    • Linux clients
  • Setting up a DNS delegation
  • InfiniShell Commands

Internal DNS service for NAS and S3

Overview

The InfiniBox Internal DNS Service allows the array to act as its own DNS server for a network space. The service returns a round-robin set of IP addresses for a single DNS name. With this service, customers do not need to manually track and distribute NAS IP addresses across client groups. It eliminates "spreadsheet-based" IP balancing.

Why use it? (Use cases)

Primary use case

Customers who have no external DNS server on the NAS network and want to avoid manually balancing client connections across multiple IP addresses.

For example, a backup network with no DNS services.

• Hundreds of clients write backups to an InfiniBox NAS share.
• Without round-robin DNS, administrators must manually track which group of clients is using which NAS IP address to mount the backup shares.
• By enabling the Internal DNS Service, InfiniBox handles this distribution on its own, removing that operational overhead.
• Clients (Linux/Windows) are simply configured to query InfiniBox for the NAS FQDN.

Secondary use case

Customers who already have an external DNS server but want InfiniBox to manage its own round-robin behavior.

• This requires setting up a DNS delegation to the InfiniBox (see below).
• Recommendation: The Internal DNS Service is best suited for environments without an external DNS server. Where possible, customers should use an external DNS server.

How it works

• Once configured, any NAS IP address in the network space will respond to DNS queries for the configured name.
• Each DNS response round-robins across all IP addresses in that network space.
• The round-robin automatically adjusts as IP addresses are added, removed, disabled, or enabled. Manual DNS record maintenance is not required.
• The default TTL is 1 hour (3600 seconds). TTL controls how long a client may cache a given DNS response before querying again.

Setting up the Internal DNS Service

Step 1: Enable the service (Admin only)

The Internal DNS Service must be enabled by an administrator. Once enabled, it cannot be disabled.

admin@infinibox> config.nas.dns_service.enable
DNS service has been enabled. It cannot be disabled.

Step 2: Configure a DNS name for the NAS network space

1. After enabling the Internal DNS Service, log out of an active CLI/GUI sessions and log back in.

2. Navigate to  Settings → Network Spaces.

3. Right-click the NAS network space and select DNS Service Settings.

   • This option is only available for NAS network spaces.
4. Enter the DNS Name and a TTL value.
5. Click Update.

Monitoring: New Events

The feature introduces two new informational events that are included in the system event log:

Configuring clients to use the InfiniBox DNS

Windows clients

To configure Windows clients to use the Name Resolution Policy Table (NRPT) to route only queries for the InfiniBox domain to the appliance:

1. Add an NRPT rule (run as Administrator):
   

    PS> Add-DnsClientNrptRule -Namespace "infinibox-nas.ia.lab" -NameServers "172.20.33.173"

   This can also be deployed at scale via Group Policy.
   
   
   
2. Test the name resolution:
   

   PS> Resolve-DnsName -Name infinibox-nas.ia.lab
   
   Name                  Type  TTL  Section  IPAddress
   ----                  ----  ---  -------  ---------
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.166
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.167
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.168
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.173
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.158
   infinibox-nas.ia.lab  A     5    Answer   172.20.33.165

The round-robin behavior changes the order of returned IP addresses changes on each subsequent query.

Enabling Kerberos authentication for SMB over the DNS FQDN

An Active Directory Service Principal Name (SPN) must be registered for an InfiniBox DNS FQDN (e.g., infinibox-nas.ia.lab) before clients can mount SMB shares using that FQDN and authenticate via Kerberos. If the SPN is not registered, Windows clients will typically fall back to NTLM authentication instead of Kerberos when accessing shares by the DNS name.

To register the SPN against the computer or service account associated with the InfiniBox NAS network space:

1. Use setspn from an elevated command prompt on a domain-joined machine (or a Domain Controller):
   setspn -S cifs/infinibox-nas.ia.lab <ComputerObjectName>
   • Replace <ComputerObjectName> with the AD computer object or service account that the InfiniBox NAS network space uses to join the domain.
   • The -S flag checks for duplicates before adding the SPN. This prevents conflicting registrations.
   • If the InfiniBox NAS also needs to be reachable via a short (NetBIOS) name, register that as well:
     setspn -S cifs/INFINIBOX-NAS <ComputerObjectName>
2. Verify that the SPN was registered:
   setspn -L <ComputerObjectName>
   This should list cifs/infinibox-nas.ia.lab (and cifs/INFINIBOX-NAS, if added) among the registered SPNs.

DNS round-robins across multiple IP addresses. The SPN is bound to the FQDN, not to any individual IP address.

Kerberos ticket validation works correctly regardless of which IP address a client is directed to.

Linux clients

Option 1: Add the InfiniBox as a nameserver in /etc/resolv.conf:

nameserver 172.20.33.173

⚠️ Caveat: This makes the InfiniBox a resolver for all DNS lookups on the client (or at least the first one tried), not just the InfiniBox FQDN. Additionally, multiple nameserver lines act as failover, not as a merged/aggregated resolution.

Option 2 (recommended): Use systemd-resolved per-link DNS routing so that only queries for the InfiniBox domain are sent to the appliance:

resolvectl dns eth0 172.20.33.173
resolvectl domain eth0 ~infinibox-nas.ia.lab

The tilde (~) marks this as a routing-only domain. General internet and other lookups continue to use the normal resolver. Only queries under infinibox-nas.ia.lab are routed to the InfiniBox.

Setting up a DNS delegation

For customers with an existing external DNS (e.g., Windows DNS) who want InfiniBox to manage round-robin resolution for its own subdomain, configure a DNS delegation:

1. In DNS Manager, right-click the parent zone (e.g., ia.lab) and select New Delegation…
2. Enter the Delegated domain (e.g., infinibox-nas), forming the FQDN infinibox-nas.ia.lab.
3. Add the Name Server entry that points to one of the InfiniBox NAS network space IP addresses (e.g., 172.20.33.158).
4. Complete the wizard.

Once delegated, queries sent to the external DNS server for infinibox-nas.ia.lab are automatically forwarded to the InfiniBox, which then returns its own round-robin response.

InfiniShell Commands