Learning DNS - High Availability & Redundancy

#Introduction

One downed DNS server can make an entire service feel dead, even though your applications are healthy. High availability DNS ensures there's no single point of failure: every role runs on more than one instance, and when one dies, the others take over immediately.

Episode 18 covers redundancy patterns for all three daemons: authoritative with a hidden primary and public secondaries, recursor layered behind dnsdist, plus anycast techniques for global scale and resilience.

#Authoritative Redundancy

#Hidden Primary and Public Secondaries

The most common production pattern: a hidden primary that writes data (not answering public queries), and several public secondaries that hold copies and serve all clients. If a secondary breaks, others keep serving; if the primary breaks, secondaries keep answering from their last copy.

hidden primary (menulis data)
   | NOTIFY + AXFR
secondary A (publik)   secondary B (publik)
   \                    /
    klien memakai NS A dan NS B

The primary is hidden from NS records and client firewalls. All changes happen on the primary, then spread to the secondaries listed in the zone's NS.

#Geographic Distribution

Secondaries should be spread across multiple locations and ASes (Autonomous Systems). That way, an outage in one provider doesn't paralyze resolution elsewhere. Location choice is based on where most clients are and the connection paths between data centers.

#Reliable NOTIFY

So changes arrive quickly, secondaries shouldn't rely only on the refresh interval:

also-notify=192.0.2.21,192.0.2.22,2001:db8::21

also-notify holds all secondary addresses. Every serial change immediately triggers NOTIFY to the entire list, speeding synchronization from minutes to seconds.

#Recursor and dnsdist Redundancy

#Multi-Instance Recursor

The recursor should run at least two instances, all gathered behind dnsdist. If one recursor goes down, dnsdist directs load to the remaining ones:

newServer({ address="192.0.2.31:53", name="rec-1" })
newServer({ address="192.0.2.32:53", name="rec-2" })
setServerPolicy(leastOutstanding)

setServerPolicy(leastOutstanding) splits load across the two recursors while keeping balance if one of them slows down.

#ECMP and Anycast

For larger scale, ECMP (Equal-Cost Multi-Path) divides router traffic across several dnsdist instances on the same address. Anycast publishes the same address from many locations: clients automatically head to the nearest instance, and when one location dies, routes shift to another.

ip route show

In an anycast setup, the same DNS address appears from multiple points. Global routing steers clients to the nearest, healthiest instance — redundancy without any change on the client side.

#Disaster Recovery

#A Simple Runbook

A recovery plan must be written down and tested. The basic principles:

• Secondaries can answer without the primary, as long as data remains on disk.
• Promoting a secondary to primary temporarily is possible by turning it into a NATIVE zone.
• Always keep off-site database backups (episode 11).

sudo systemctl stop pdns
dig @192.0.2.21 example.com SOA +short
dig @192.0.2.22 example.com SOA +short

If both secondaries still answer with the aa flag, you've just proven that clients feel nothing when the primary dies.

#Toward a Production Architecture

#Assembling All Patterns

Combine all patterns into one coherent architecture:

hidden primary
   -> secondary A (site 1)  -> NS publik
   -> secondary B (site 2)
dnsdist (anycast, site 1) -> rec-1, rec-2
dnsdist (anycast, site 2) -> rec-3, rec-4

Every role is redundant, there's no single point of failure, and clients don't need to know about any changes. Architectures like this are the foundation we'll fully build in episode 21.

#Conclusion

Episode 18 makes your DNS infrastructure immune to single failures: a hidden primary with geographically spread public secondaries, recursors layered behind dnsdist, and anycast for global scale.

Key takeaways:

• The hidden primary writes data; public secondaries answer all client queries.
• Geographically spread secondaries reduce the impact of provider outages.
• also-notify speeds up synchronization to all secondaries at once.
• Multi-instance recursors behind dnsdist remove single points of failure.
• ECMP and anycast divide traffic and shift routes when one location dies.
• Test disaster recovery regularly by stopping the primary and watching secondaries keep answering.

In episode 19, we'll cover performance tuning and observability — tuning packet and record caches, thread counts, cache-ttl and negative-cache-ttl, LMDB tuning, plus modern observability with structured logging, OpenTelemetry tracing, the Prometheus endpoint, and webserver API stats.