Learning DNS - dnsdist Basics

#Introduction

In episode 6 you got a reliable recursor. Now imagine having to serve thousands of clients with more than one recursor while also blocking attackers. This is where dnsdist comes in: a DNS load balancer that stands in front, receives all queries, picks the best backend, and enforces security rules.

Episode 7 introduces dnsdist's core concepts — frontend, backend, pool, and load balancing policies — then closes with the web dashboard. Advanced features like caching, rate limiting, and Lua scripting await you in episode 17.

#Frontend and Backend Concepts

#dnsdist's Position in the Network

dnsdist sits exactly between clients and backends (recursors or authoritative servers). Clients only see dnsdist; backends are never directly exposed. This gives you a single control point for policy, security, and telemetry.

klien -> dnsdist (frontend) -> pool 1: recursor-a
                              -> pool 2: recursor-b

Backends are grouped into pools. With pools, you can separate traffic: recursive queries from the general public go to the recursor pool, while queries for internal zones are directed to the authoritative pool.

#Initial Configuration

#Creating Servers and Listeners

dnsdist's static configuration is written in dnsdist.yml. The following example creates one frontend on port 53 and two recursor backends:

setLocal:
  - address: 0.0.0.0:53
newServer:
  - address: 192.0.2.11:53
    name: recursor-a
  - address: 192.0.2.12:53
    name: recursor-b
acl:
  - 192.0.2.0/24
  - 127.0.0.0/8

setLocal defines the frontend to listen on. newServer registers backends. acl restricts who may query. After that, start the service and test:

sudo systemctl restart dnsdist
dig @127.0.0.1 example.com A +short

#Verification via the Console

The dnsdist console shows backend status directly:

dnsdist -c
showServers()
quit()

showServers() shows each backend, its up/down status, and the number of queries served. If a backend goes down, dnsdist automatically directs all queries to healthy ones.

#Load Balancing Policies

#leastOutstanding and roundrobin

The policy determines which backend receives the next query:

• leastOutstanding: sends queries to the backend with the fewest outstanding jobs. The best choice for backends with different capacities.
• roundrobin: distributes queries in turn. Simple and fair for uniform backends.
• hash and other custom policies are covered in episode 17.

setServerPolicy:
  leastOutstanding:

With setServerPolicy.leastOutstanding, dnsdist always selects the least busy backend. This prevents one recursor from being overloaded while another sits idle.

#Automatic Health Checks

dnsdist constantly monitors its backends. If a backend fails to respond, its status is marked down and traffic is redirected. The checkTimeout, checkInterval, and maxCheckFailures settings can be adjusted:

newServer:
  - address: 192.0.2.11:53
    checkTimeout: 500
    checkInterval: 30

#ACL and Web Dashboard

#Restricting Query Sources

The ACL in dnsdist works like a firewall in front of DNS: queries from addresses outside the list are rejected immediately. This is mandatory if dnsdist is exposed to an untrusted network.

dnsdist -c
showACL()
quit()

#Web Dashboard

dnsdist has a web-based dashboard for viewing real-time statistics:

webserver:
  - address: 127.0.0.1:8083
    password: ganti-password-ini

Open http://127.0.0.1:8083 in your lab browser. The dashboard shows queries-per-second charts, record type distribution, cache hit rate, and the status of every backend — a first window into observability that we'll deepen in episode 19.

#Conclusion

Episode 7 places dnsdist at the front of your ecosystem: one frontend, many backends in pools, policies that select the least busy backend, automatic health checks, and a dashboard to watch over everything.

Key takeaways:

• dnsdist is a load balancer that hides backends from clients.
• setLocal creates a frontend, newServer registers backends, acl restricts clients.
• leastOutstanding sends queries to the least busy backend; roundrobin distributes evenly.
• Automatic health checks move traffic away from down backends.
• The console (dnsdist -c) and web dashboard display live backend status.

In episode 8, we'll cover basic diagnostic & troubleshooting tools — dig +trace, +short, +dnssec, and +nssearch, comparing drill and kdig, reading logs with pdns_control, and dissecting port 53 traffic with tcpdump.