Welcome to masochist-city
… that is what my buddy said, when I told him i was “playing around with DNS”.
It’s not that bad. Then again, maybe I’m a sucker for punishment. Why? You may ask, well, because, why not (and really have nothing better to do). I already had the VPS servers. It also gives great insight into how DNS really works. What I’m showing here is thus, external DNS.
So, what’s needed? You need preferably two stable DNS servers (static IPs). A couple of low cost VPS servers will do.
Setup your “glue” records.
These are the records that tell the world where to find your name servers. You will typically do this in your domain provider’s web UI. Then you also configure the two NS servers you want to use.
Let’s say we have two DNS servers named:
ns1.mydomain.tech 10.0.0.1
ns2.mydomain.tech 10.0.0.2
If bind isn’t installed already, make sure to do so (milage varies on distro). On archlinux.
$ sudo pacman -S --noconfirm bind
Ubuntu (depending on version, named in 20.04, bind9 in 18.04.
$ sudo pacman -S --noconfirm bind9
On the ns1 server (master), edit /etc/bind/named.conf.local (ubuntu, arch /etc/named.conf) add the following:
zone "mydomain.tech" {
type master;
file "/etc/bind/db.mydomain.tech";
allow-transfer { 10.0.0.2; };
};
zone "10.0.0.in-addr.arpa" {
type master;
notify no;
file "/etc/bind/db.10";
allow-transfer { 10.0.0.2; };
};
This tells bind we’re ‘da masta’ (and must focus powa!). Here we also allow transfer to the slave (yeah, sorry, bind is still politcially incorrect). File points to its respective zone files, which comes next.
Now edit /etc/bind/db.mydomain.tech
in your favorite editor (if you say notepad, you lose a testicle). But we all
know it’s ed.
Jokes aside, hostmaster.mydomain.tech below, is actually the email for the domain contact.
$TTL 4800
; mydomain.tech
$ORIGIN mydomain.tech.
@ IN SOA ns1.mydomain.tech. hostmaster.mydomain.tech. (
2021102001 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
IN NS ns1.mydomain.tech.
IN NS ns2.mydomain.tech..
ns1 IN A 10.0.0.1
ns2 IN A 10.0.0.2
Restart bind (typically systemctl restart bind9
, or named
). Check the journal for any issues.
Next, setup the secondary nameserver config on the ns2 server. Edit /etc/bind/named.conf.local
:
zone "mydomain.tech" {
type slave;
file "/var/cache/bind/db.mydomain.tech";
masters { 10.0.0.1; };
};
zone "10.0.0.in-addr.arpa" {
type slave;
notify no;
file "/var/cache/bind/db.10";
masters { 10.0.0.1; };
};
The master will then transfer the zone files to the slave, which caches it in the named files above. Restart
the bind (or named) service, and check if the transfer was successful (ls /var/cache/bind
), and/or check
the journal for the service.
Examples:
$ ls -l /var/cache/bind/db.*
-rw-r--r-- 1 bind bind 197 Oct 19 19:12 db.10
-rw-r--r-- 1 bind bind 464 Oct 19 18:50 db.mydomain.tech
sudo systemctl status named --no-pager -l
Oct 19 19:12:26 someservername named[3951182]: transfer of '10.0.0.in-addr.arpa/IN' from 10.0.0.1#53: Transfer status:
successful
Firewall
If your servers are behind a firewall (I hope so), then you need to open port 53. Make sure you open both TCP and UDP ports. Since I often run ufw, it would be something like:
sudo ufw allow from any to any port 53 proto tcp
If you like torture (iptables):
sudo iptables -A INPUT -p tcp --source 0.0.0.0/0 --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --source 0.0.0.0/0 --dport 53 -j ACCEPT
Depending on the time-to-live on the records, It may take serveral hours before the glue entries have propogated around the internet. But you can check your own servers by digging a bit.
dig @10.0.0.1 ns1.mydomain.tech
dig @10.0.0.2 ns2.mydomain.tech
If that works, you’re probably good to go.
Now you can edit some more entries in your zone file (remember to increase the version number) and reload bind, and make sure everything transfers properly to the other server.
ns1 IN A 10.0.0.1
ns2 IN A 10.0.0.2
mydomain.tech. 3600 IN A 10.0.0.1
mydomain.tech. 3600 IN MX 10 mail.mydomain.tech
mydomain.tech. 3600 IN MX 20 mail2.mydomain.tech
mail 3600 IN A 10.0.0.98
mail2 3600 IN A 10.0.0.99
www IN CNAME mydomain.tech.
Recursion
You might want to disable recursion (lookups for domains you aren’t authorative for).
Look for an options
section in your configs, likely in /etc/bind9/named.conf.options
recursion no;
Reload bind.
rndc
This is the named control util, and is quite handy. You can ie, check the status of a zone, retransfer zones, and a whole lotta stuff I won’t get into here.
$ rndc zonestatus <zone>
Congratulations, you just caused yourself more headaches and admin work. But hey, we all know you love it!
Cheers,
=Jinxd=