I want to setup a Hidden Primary DNS server, i.e. I host the zone files on my own server, but all requests should go to Secondary DNS servers hosted by a dedicated DNS company. My own DNS server should not be used by recursive resolvers or end users. Said company will copy the zone files with a zone-transfer from my server. Ideally, nobody should even know that my server exists in this DNS setup.
Of course all
NS records in such a setup will point to the nameservers of the DNS company. But I am unsure about the
According to my understanding this setup would mean that my server is the "start of authority" and thus I would have to specify it in
SOA - which would make it public knowledge that my server is the real primary server. According to another answer on serverfault MNAME has to be set to "the
<domain-name> of the name server that was the original or primary source of data for this zone."
If it's possible without much trouble, I would prefer not to list my NS server in SOA and instead point SOA to my nameserver hosting company.
What are the consequences if I actually set
company.example.com as SOA instead of my own server
- Will I violate the RFC?
- Will some parts of the DNS system not work anymore? (I read that the entry of SOA is used for dynamic updates, but I do neither plan to accept dynamic updates from foreign people nor do I plan to send them myself)
- Will my nameserver hosting company come to me, because I wrongly specify their email address as contact for the primary DNS? (mail address field of SOA)
- Can I maybe mix different hostname and mail address in SOA to solve some issues? E.g. point to
company.example.comas SOA server, but to
email@example.com mail contact?