Manage your own DNS

Let’s say that a client (a browser) needs to access cloud.example.org. For this, it needs to find out the address (IP) of the server. Assuming that it knows nothing about it, the client can follow these steps:

This diagram tries to show the hierarchy of the nameservers.

Let’s try to follow these steps manually for a real domain, for example ocw.fs.al. We can use the command dig to make DNS queries.

Let’s say that the nameservers of the domain example.org are:

These nameservers need to be synchronized with each-other. How do we achieve that? One of these nameservers (for example the first one) can be primary, and the others secondary. Modification of the records is always done on the primary nameserver, and the secondary nameservers will eventually synchronize their content with the primary one.

The primary nameserver can also be another one, that is not on the list, and all the nameservers of the domain with retrieve the content from it. This is a better approach because the primary nameserver can be placed behind a firewall, forbidding access to everyone, except the secondary nameservers.

When a modification on the records of the primary NS is done, it notifies the secondary NSs about it. When the secondary NSs get this notification, they send a synchronization (AXFR) request to the primary NS, in order to retrieve from it an updated list of records. Upon receiving this list, they replace the old list of records with the new one.

Notice that the clients do not send any requests to the primary NS, but only to the secondary ones, because only these are published as nameservers for the domain. They don’t even know the address (IP) of the primary NS. Only the secondary nameservers know its IP. But even if a client knows the IP of the primary NS and tries to access it, it will be prevented by the firewall, because the firewall allows only the secondary nameservers to access the primary one on port 53, in order to send AXFR (synchronization) requests. Even if there was no firewall, the primary server is configured to reply only to synchronization requests from the secondary nameservers.

Instead of building and maintaining our own secondary nameservers, we can use services that are available either for free or for a small price. You can do a quick search and find some that may suit your needs.

I am listing here some of them that offer a free service:

We will install the primary nameserver with an NSD container.

Assuming that you have already installed ds, you have to:

The NSD container that we tried to install above needs access to the port 53 of the host. If this port is already being used by something else, there will be a conflict and the container will fail to start.

To check whether there is something listening to this port, use the command lsof -i :53. On the systems that use systemd, usually there is a service named systemd-resolved which is listening on port 53. Let’s see how to prevent systemd-resolved from using port 53.

The default settings on the config file settings.sh look like this:

The variable SECONDARY_NS is used by the installation scripts to create the configuration file config/secondary.ns, which looks like this:

This file is included in a zone configuration with a directive like this:

The variable AXFR_SERVERS is used to create the files config/notify.conf and config/provide-xfr.conf, which look like these:

Both of these are used to define the pattern axfr-servers in the main config file config/nsd.conf:

This pattern is included in the definition of a zone like this:

The IP list on AXFR_SERVERS is also used to open the port 53 on the firewall for the secondary servers:

To customize the secondary nameservers, we should edit the constants SECONDARY_NS and AXFR_SERVERS on settings.sh. Then run again ds make, which will rebuild the container and will regenerate the configuration files mentioned above (config/secondary.ns, config/notify.conf, config/provide-xfr.conf), as well as update the firewall rules.

It might help to have a look at the URLs provided as comments in settings.sh:

Let’s say that you have purchased the domain example.org.

Each time that we modify some records on the file zones/example.org.db, we should also update the serial number.

Then we notify the secondary nameservers that there are some updates with ds notify. After reloading the zones and sending notifications, it starts to trace the logs. So, it is OK to stop it with Ctrl-c after a few seconds.

Alternatively, a ds restart will also reload the zones and send notifications to the secondary nameservers.

To migrate the container of the primary nameserver to another host, we should transfer (with scp or rsync) the content of /var/ds/nsd/ from the old host to the new one. Then on the new host we should run:

Now the public IP of the master nameserver has been changed (to the IP of the new host), so we should update it on the configuration of each secondary nameserver, for each domain.

If you need to modify the list of secondary nameservers, for example add ns1.1984.is on the list, or remove one from the list, you should also make sure to update these things: