Self-hosted DNS outage reddit / selfhosted ---------------------------------------------------------------------- iambic_pentangeli · 2023-12-19 15:46 I self-host an email server, web server, and a DNS authoritative server, with secondary DNS hosted through an external service. What settings should I use with the DNS to accommodate brief periods of down time for things like server updates? Currently, taking the server offline for even 30-60 minutes to run an OS update will cause a DNS outage that lasts up to 24 hours, during which time I can't receive email and my web pages can't be reached. I suspect it's the TTL setting, which I set for five minutes back when I was setting up/configuring the DNS service to accommodate frequent changes. Would a longer TTL setting, such as 60 minutes, be better? ---------------------------------------------------------------------- wideace99 · 2023-12-19 16:19 How about a cluster of 2 servers for redundancy & scalability ? ---------------------------------------------------------------------- KD_done · 2023-12-19 16:59 Can you explain a little bit more about how you have your primary and secondary server setup? Or is it a single one? And in what type to network do you have those servers? What you are describing sounds/feels non DNS related, unless something really odd is happening. I'm curious :) ---------------------------------------------------------------------- iambic_pentangeli · 2023-12-19 17:19 Authoritative DNS is an instance of MaraDNS running on the internal server box in my office (alongside the mail server and web server). Secondary DNS is run on [puck.nether.net](https://puck.nether.net), one of the free secondary services, externally. TTL is five minutes. I thought that the secondary DNS would mitigate against the primary DNS going offline, but it returns a "zone has expired" error after just a short period of time. ---------------------------------------------------------------------- KD_done · 2023-12-19 17:31 Okay, so.. 2 things might happen. The zone, for the secondary, checks at a set time if the primary is still available.. if not, it just drops the zone.. or, the SOA has a TTL that lasts as long as little nosebleed, IE: to short. So, lets think about solutions.. Turn it around, and have your primary externally, and the secondary in house. Makes a lot more sense. And this is only relevant for AXFR ofcourse. But that would make your life a lot easier. ---------------------------------------------------------------------- kakovoulos · 2023-12-19 19:06 In my house I use 6 different dns servers - pihole0 - pihole1 - dc - dc2 - dnsfilter - dns filter here's how it works. network 192.168.0.0/22 gw 192.168.0.1 pihole0 - 192.168.0.10 pihole1 - 192.168.0.254 dc - 192.168.0.7 dc2 192.168.0.253 dc and dc2 are running dhcp and dns and ad. they are primary for the network. i configured dc and dc2 in an active directory forest which replicates dns automatically. then i configured dhcp and setup a script to copy the scopes and manually sync them since they don't sync automatically. dc2 is set for upstream root servers of 192.168.3.254 and 192.168.0.10 (pihole1 and pihole0 respectively!. dc is set for upstream of pihole0 and pihole1. pihole0 is upstream to dns filter pihole1 is upstream to dns filter. I had only one dns server until my spouse complained. having 2 is much better. so when a client connects: dc or dc2 will hand out the lease. then they will use the local dns server for ad. then they will use the upstream pihole. then the pihole uses dnsfilter works great. ---------------------------------------------------------------------- adamshand · 2023-12-19 20:43 This is called a "hidden master/primary" and is my preferred DNS setup. Usually in these setups your primary DNS server should be able to go down indefinitely without causing an outage. The secondarys should continue to serve their cached DNS data regardless of whether the primary is available (that's usually the point!). Just to check, I assume that your primary/authoritative DNS server is NOT listed in your whois or NS records? I suspect what you're running into is specific to your secondary provider. For some reason they are "deleting" your domain because your master is down. Read their documentation to see what they expect / require in order to serve your domain. Increasing the TTL might help, but that's not normally required. ---------------------------------------------------------------------- Agile_Ad_2073 · 2023-12-19 22:16 Pihole with gravity sync and keepalived ---------------------------------------------------------------------- zoredache · 2023-12-19 23:02 What does your SOA record look like for your zone? If your zone is expiring too quickly you might have set your values too small. ---------------------------------------------------------------------- mensink · 2023-12-20 00:52 The secondary DNS should normally not just forget zone data when it can't connect to the primary anymore. If it does, I'd check what's going on there first.