HayamiHayami DTM and BIND 9
BIND has run the internet's DNS for decades, and if your zones live in it, they work. The question is not whether BIND can do the job. It is what it costs you to keep assembling everything around it.
The software was never the problem
A production BIND estate on Azure is rarely just BIND. It is a pair of hand-fed VMs, a replication topology you designed, config files only two people can safely edit, health checking that does not exist at the DNS layer, and a change process that is a text editor. Every piece works. Every piece is yours to run, patch, and remember.
DTM keeps what BIND got right: standards-faithful authoritative DNS, RFC 2136 dynamic updates with TSIG, zone transfers to downstream servers. It replaces the part that was never packaged: a fully meshed self-healing cluster, health-checked and load-balanced answers, a web UI, a REST API and Terraform provider, Entra ID sign-on, and an audit trail, deployed from the Azure Marketplace in minutes.
What changes, what stays the same
| BIND 9 | Hayami DTM | |
|---|---|---|
| Authoritative DNS, standard record types | ✓ | ✓ |
| Dynamic updates (RFC 2136 with TSIG) | ✓ | ✓ |
| Zone transfers to downstream servers (AXFR + NOTIFY) | ✓ | ✓ |
| Health-checked answers (failing backends drop out) | ✗ | ✓ |
| Weighted load balancing and cross-region failover | ✗ | ✓ |
| Self-healing multi-node cluster out of the box | ~ | ✓ |
| Web UI, REST API, and a Terraform provider | ✗ | ✓ |
| Microsoft Entra ID sign-on and a built-in audit log | ✗ | ✓ |
| Split-horizon views per client | ✓ | ✗ |
| Runs anywhere: bare metal, any cloud | ✓ | ✗ |
The last two rows are deliberate. BIND remains the right call for split-horizon views and for estates outside Azure, and the migration guide says so plainly. DTM is built for one place: private Azure networks, done properly.
A migration you can rehearse, and reverse
Your zone files import as they are, previewed with a dry run before anything commits. Run both servers in parallel, compare answers, and cut over by repointing clients. During the soak, BIND stays a read-only mirror of DTM over standard zone transfers, so rolling back is repointing clients back. Nothing is burned until you decommission.
The BIND migration guide, step by step · Zone import mechanics · Dynamic DNS and TSIG
Retire the pet, keep the DNS
Import a zone this afternoon and compare answers side by side.
Questions? Email us.