Network Services and Infrastructure (DNS, DHCP, Load Balancing, WAN)
DNS
Authoritative servers hold zone data; resolvers recurse. Common records: A and AAAA for addresses, CNAME as an alias (never at a zone apex), MX for mail with preference values, NS for delegation, SOA for serial and negative-caching timers, TXT for SPF/DKIM/verification, SRV for service location, and PTR for reverse lookup. TTL governs cache lifetime; lower it a day before a migration so stale answers expire quickly. DNSSEC signs records for integrity but does not encrypt queries.
DHCP
The exchange is Discover, Offer, Request, Acknowledge. A client broadcast cannot cross a router, so a relay agent (ip helper-address) forwards it as unicast and fills in giaddr, which selects the pool. Option 82 carries relay/port information for snooping and policy. Plan scopes larger than the current host count and align lease times with churn.
Load balancing
Algorithms include round robin, weighted round robin, least connections and source-IP hash. Persistence (sticky sessions) keeps a client on one member and can hide a failing node. Health checks must test the real service, not just a TCP handshake, or a broken application stays in rotation. TLS can terminate at the balancer, be re-encrypted, or pass through.
WAN
MPLS L3VPN gives any-to-any private connectivity with provider-managed QoS; SD-WAN overlays encrypted tunnels across mixed transports with policy-based path selection; IPsec and DMVPN build tunnels over the internet. Watch tunnel overhead when sizing MTU.
Worked example
Clients on 10.20.0.0/24 receive no address from a server on 10.20.5.0/24. Broadcasts from the clients stop at their gateway. Adding ip helper-address 10.20.5.10 to the client gateway interface converts the request to unicast with giaddr set to 10.20.0.1, so the server can choose the correct pool - and the server must have a route back to 10.20.0.0/24.
Traps that cost marks
Placing a CNAME at the zone apex, raising TTL before a cutover instead of lowering it, forgetting the return route for DHCP relay, and letting sticky sessions mask a dead backend.