up vote 2 down vote favorite
share [g+] share [fb]

I'm a Sysadmin and am responsible for our external DNS servers. We're trying to make our DNS more resilient.

We have our own DNS servers (Bind). We have one running on each of our two ISP's.

Their IP's are public IP's on the internet, and one is configured as a master, as one as a slave (this is all working).

The question I have.. when one of our ISP's goes down, we tend to lose DNS completely. From what we can tell, this is because our TLD DNS servers are issuing both nameserver's IP's even though one is down.

How do we get around this?

link|improve this question
50% accept rate
2  
That's correct operation. Resolvers will move on to the other if one of name servers times out. – Rob Olmos Nov 2 '10 at 16:15
Thanks for the reply..It took approx 15 minutes before requests went to the other server. Does that sound right to you? Our TTL is 5 minutes. – Samuurai Nov 3 '10 at 14:51
feedback

3 Answers

up vote 1 down vote

Your parent domain will always keep dishing out all of your name server addresses, that's by design.

The real question is why you apparently are losing DNS when one of the ISPs goes down. That shouldn't happen. Whilst you should expect to see some delays resolving domain names when that happens it shouldn't actually stop working altogether.

Can you provide more information? What do you actually mean by "losing DNS completely"?

link|improve this answer
I've been given some more information about what happened.We have two nameservers NS1 and NS2. External clients were unable to retrieve records from our nameservers for a full 15 minutes before NS2 started responding to DNS requests. – Samuurai Nov 3 '10 at 14:33
that shouldn't happen - external clients should spot the broken DNS server almost immediately (i.e. seconds, not minutes). – Alnitak Nov 3 '10 at 15:27
feedback
up vote 1 down vote

You have a pretty reasonable setup that should be resiliant, at least gathering from your description. You need to collect more information (and/or give us the domain).

Do you lose "dns" immediately after your isp goes down? Do you normally see queries arriving at both nameservers?

It's just a hunch, but is only one of the two isp's critical? It could be incomplete/faulty glue records.

link|improve this answer
1  
I suspect this is it, probably only one of the DNS servers have glue records. I made this mistake when I was young, green and keen. – DJ Pon3 Nov 2 '10 at 16:34
I've not heard of glue records before! I'll investigate this. Thanks! – Samuurai Nov 3 '10 at 14:34
What it boils down to is the registry (com, net, us, be) always refers to nameservers, and those are always located in a domain. In a lot of domains this just refers to someone else (like your hosting provider). For people who (usually) want to be independant and run their own nameservers, there must be some extra information to bootstrap this process: the IP's of the nameservers (in this domain) to start resolving this domain. These are GLUE records. – Joris Nov 3 '10 at 21:58
(continuation) Both your nameservers will be handing out records as long as this information is available. If those glue-records only refer to the IP address of a nameserver on a single provider, your entire setup will fall down as soon as this provider is unreachable. Since DNS has an extensive caching mechanism (that is actually honored by the clients) not everyone will start to experience problems at the same time. Hope this -very abridged- explanation helps. – Joris Nov 3 '10 at 22:03
feedback
up vote 0 down vote

I'd approach it a different way. Why are you going to the hassle of running your own external facing DNS servers when you can hand a DNS company $50 or so a year and just have bulletproof DNS?

There may well be good reasons don't get me wrong, but it seems like one of those that for a lot of people = spend lots and lots of time and effort, or spend $50 and it all goes away.

link|improve this answer
If you're hosting DNS for thousands of domain, like a hosting provider might, the bill would be substantially more than $50/yr. Also if this is a smaller shop, there are free secondary services out there if he needs more resiliency than the two in-house servers. – Chris S♦ Nov 2 '10 at 17:32
Oh of course (got that problem myself), as I said there may be really good reasons for doing it as is, but if the situation is a simple one it might just be a cheaper, more pragmatic and reliable option. – Hutch Nov 2 '10 at 17:44
We used to have external DNS, however we found it easier to manage our own (at least initially), once we installed our BIGIP load balancers, as we had to create a subdomain used for load balacing purposes only. – Samuurai Nov 3 '10 at 14:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.