Lattice is DDI. IPAM and DHCP are always on. DNS is a choice per zone. Pick one row and stay on it.
| Mode | NS records | Clients query | Subnet ddns_adapter |
|---|---|---|---|
| Keep AD or BIND | Your DCs or BIND/PowerDNS | Unchanged | ad_gsstsig / bind_tsig / powerdns_http |
| Published lattice-dns | lattice-dns VIP | lattice-dns | embedded |
| Hidden primary | BIND/Knot secondaries | Those secondaries | embedded; slaves AXFR from lattice-dns |
Do not set embedded and an external adapter on the same zone.
Keep AD or BIND
Workstations keep querying the nameservers they already have. Lattice writes A/PTR after Ack via the outbox.
Ack never waits. A dead BIND delays names, not leases. Stuck outbox.
Published lattice-dns
Lattice owns the zone. Run two identical lattice-dns processes, UDP/TCP :53, VIP like dhcpd. Recursion is off. Unknown zone → REFUSED. Not a cache. Not ad.example.com / _msdcs.
Lab compose already publishes lattice-dns on host 5354. Production: lattice-dns.
Hidden primary
Public NS records stay BIND (or Knot). Lattice is the hidden master: allow_transfer = the slave IPs, also_notify = those IPs, optional transfer TSIG. Slaves AXFR; IXFR if their serial is the previous compiled snapshot.
Parent NS set should be the BIND servers, not Lattice, if you want Lattice hidden. Recipe: lattice-dns.
After first subnet
Leave DDNS off until this choice is made. Then set the subnet adapter and zones. First subnet.