How clients find DNS · Lattice DDI

Lattice does two DNS jobs and never mixes them in one process:

Update names after a lease — the worker writes A/PTR via an adapter. dhcpd does not talk DNS on Ack.
Answer for zones Lattice owns — lattice-dns is authoritative for those zones only. Recursion is off.

Most sites only need (1). (2) is optional. Neither job makes Lattice the resolver the laptop uses for google.com or for the AD forest. Zone modes: Pick one DNS mode.

The laptop is a stub

A Windows / macOS / Linux DHCP client sends every lookup to the IPs in DHCP option 6. It does not walk NS records from the root. It does not read the NS you set on a Lattice zone. It does not discover lattice-dns.

NS records tell other nameservers where a zone lives. Option 6 tells the workstation which server to ask.

Lattice does not fill option 6 when you enable DDNS or embedded. Set it as a subnet DHCP option (code 6, payload {"addresses":["10.0.0.1"]}), or leave the AD/BIND list you already had. Mask, router, and lease-time are built-in. DNS servers are not. Option 15 (domain name) is a suffix, not a server.

The recursive resolver is someone else

Unbound, BIND as a cache, or AD DNS accepts the stub’s query, follows NS / stub zones / slaves, and talks to lattice-dns or a DC for the laptop.

laptop  --option 6-->  Unbound or AD or BIND
                           |
                           +--> lattice-dns   only for office.example.com
                           +--> DCs           ad.example.com, _msdcs
                           +--> the internet  everything else

What to put in option 6

Mode	Option 6	Who talks to lattice-dns
Keep AD / BIND / PowerDNS	Unchanged	Nobody on the query path
Hidden primary	BIND (or Unbound in front of BIND)	BIND slaves, AXFR
Published lattice-dns	lattice-dns VIP only if that zone is all they query	The laptop

Published as the site resolver: google.com and dc01.ad.example.com get REFUSED. For a real site, put Unbound in option 6 and conditional-forward only Lattice zones. Leave AD on the DCs.

Do not set embedded and an external adapter on the same zone. DNS modes. After Ack, missing names are outbox, not a DHCP failure.

Why not Unbound inside Lattice

Recursive lookup, forwarding, RPZ, public DNS, DNSSEC, and hosting _msdcs are not the product. Unbound already recurses. AD already is the forest. Day one does not mean “repoint every workstation.” lattice-dns.