Running your own resolver
Every lookup your servers make tells someone which services you talk to. Running your own recursive resolver keeps that query stream private, makes repeat lookups fast, and removes a dependency on someone else’s DNS.
A recursive resolver is what actually answers “what is the address for this name” by asking the DNS hierarchy on your behalf. Most servers use their provider’s or a public resolver; running your own — Unbound is the usual choice — keeps those questions to yourself.
Recursive is not authoritative
Two different jobs share the name DNS. An authoritative server publishes your domain’s records to the world. A recursive resolver looks up other people’s names for your machines. Do not mix them in one service open to the internet — that is how you become an open resolver used in attacks.
Why bother
- Privacy — your lookups do not flow to a third party who can log them
- Speed — a local cache answers repeat queries instantly
- Independence — you do not go dark when someone else’s resolver does
- It can validate DNSSEC itself, so answers are checked
Close it to the outside
A recursive resolver must only answer your own machines. Leave it open to the internet and it will be abused to amplify attacks against others — and you will get the abuse notices. Bind it to your internal network or firewall it to known clients. See a firewall that does not lock you out.
Keep the cache honest
A resolver’s value is its cache, but a stale cache serves old answers after you change a record. Respect TTLs rather than overriding them too aggressively — see choosing DNS TTLs — and the cache stays both fast and correct.
It is now a dependency to watch
If your resolver dies, your servers cannot resolve anything and everything looks broken at once. Run it reliably, and consider a second one — see monitoring your own server.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base