Running your own DNS
Running authoritative DNS yourself gives you control and a new way to take your whole estate offline. Both halves are worth understanding.
Authoritative is not a resolver
Two different jobs that the same software can do, and conflating them is the classic mistake.
- Authoritative answers for zones you own, to anyone who asks.
- Recursive (a resolver) looks things up on behalf of clients. It must never be open to the internet.
An open resolver is used for DNS amplification attacks, which is explicitly forbidden by our acceptable use policy. Test yourself from outside after every configuration change:
dig @yourserver google.com — from another network. If that
answers, fix it today.
Two nameservers, genuinely separate
Registries require at least two, and the point is diversity. Two nameservers on the same machine, or in the same rack on the same uplink, satisfy the letter and none of the purpose.
Put the second somewhere else — another of your servers, another building, another provider. If DNS goes, everything goes: mail stops, certificates fail to renew, and nobody can reach anything you run.
Which software
- BIND
- The reference. Does everything, configuration is dated, documentation is vast.
- PowerDNS
- Zones in a database, a proper HTTP API, easy to automate from your own panel. The usual choice for resellers — see API access for resellers.
- Knot or NSD
- Authoritative only, fast, small attack surface. An excellent secondary.
Zone transfers, restricted
The secondary pulls from the primary with AXFR. Allow it only from your secondary's address and sign it with a TSIG key. An open AXFR hands your entire internal naming layout to anyone who asks, which is reconnaissance you have no reason to provide.
And increment the serial on every change. A zone edited without a serial bump never reaches the secondary, and you are then serving two different answers depending on which server a resolver happens to ask. That failure is maddening to diagnose because it works half the time.
DNSSEC, if you commit to it
DNSSEC signs your records so resolvers can detect tampering. Modern software automates key rolling and it is far less frightening than its reputation.
The caution: a broken signature makes your domain completely unresolvable for validating resolvers, which is most of them. An expired signature is a total outage. Monitor expiry dates as carefully as you monitor certificates.
Before you cut over
- Serve the zone from the new servers and query them directly before changing the delegation at the registrar
- Check that glue records are right if your nameservers are inside the zone they serve
- Keep TTLs short during the change, raise them afterwards
- Set reverse DNS for the nameserver addresses too
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base