Hello –
I have my DNS with a cloud provider that I want to stop using, and was considering where to move it (a few domains with a handful entries each). At some point I was wondering if I should run it myself. I have two VPS’ in different data centers with fixed IP addresses, and I read up a bit - seems like this is doable. I am not set on what software to use. I would like it to run in a container. Does anybody have any recommendations, positive or negative?
Thanks :)
You must log in or register to comment.
It’s super achievable - I’ve run my own DNS for ages, there are a few common pitfalls but overall it’s pretty low maintenance.
- Personally I use PowerDNS, but you could also use something like BIND. I find PDNS to be a little easier to configure
- Make sure you are looking at the docs for PowerDNS Authoritative, not PowerDNS recursor
- You install PDNS Authoritative on bother servers, then designate one as a primary (/master) and the other as a secondary (/slave/replica). You create records on the primary, and configure it to replicate the records to the secondary using AXFR
- I’d recommend using one of the database backends for PDNS - personally I use Postgresql. Sqlite is simpler to set up, but I’ve had issues where making multiple updates over the API causes errors due to locking
- DNSSEC is a bit fiddly to set up initially, but doesn’t add much operational overhead once it’s running
- Take a looks at glue records if your want to host the domain that the nameservers themselves use
- Once you’ve got things running, consider something like https://ns-global.zone as a backup
Feel free to ping me if you have questions or need help getting things set up
Kudos for mentionning powerDNS, it’s an amazing software :)
One thing I love with powerDNS is the various backends available, notably the postgreSQL and mariaDB/mysql ones. Only the primary powerdns instance modifies the database records, the secondary instances just read from database (master or replicas). Thus, no real need for AXFR: as soon as you added/modified a record on the primary, the secondary pdns servers will see it in the database.
The
pdnsutilCLI tool is also really convenient, and the powerDNS API is a godsend when you need to automatise stuff for thousands of domains and hundred of thousands of records. There’s also a nice third-party webUI (powerdns-admin, docker image: pdnsadmin/pda-legacy). Bonus, Terraform does have a powerdns provider.At work we use dnsdist (from powerDNS too) to load-balance between our powerdns instances (with caching!), and to filter out/rate-limit/temporary ban bad actors (dns laundering, records enumeration and such for example).
You can use Bind or any other nameserver-server.
But this is one of the things you might want to reconsider. Setup errors might slip in silently and might be hard to diagnose. Complying to the standards like DNSSec and IPv6 on the nameserver might be a challenge without experience.
Next to that, you probably can’t register the domain itself without a third party, and I always advice to not use a different party for nameservers than the party that registered the domain.
Laat point I want to bring up, I would advise against combining name servers with other services, as it is crucial for operating the services, you are creating one giant point of failure. Keep it separated. Seperate hardware
That said, if you accept all these dangers, it’s technically doable. Open the right ports, configure the zone, setup master and slave, read up on glue records, register the name server if needed, setup DNSSec and set the correct name servers in the domain at the party you registered the domain.
and I always advice to not use a different party for nameservers than the party that registered the domain.
Why is that? I register most of my domains at Porkbun, but I usually use Cloudflare’s nameservers as they seem to support more record types, have more features, and have a better UI than most registrars’ offerings.
Check out Unbound. I am sure there is a docker image available for it. Unbound used to be recursive only. Now it has support for both recursive and authoritative DNS. The docs are good for it and there are plenty of examples. But that much said, I am curious why you want to do this. DNS is a really critical service. Chances are your cloud based service will be more reliable with faster resolution times. I am very pro-self hosting and I don’t do it myself. I don’t even do email myself either.
