Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to provide a level of failover control (between 2 sites) using DNS (bind9), and I am unsure if what I am planning to do is compliant with the specs and if it will work reliably.

The core of the question (simplified - I know I need more then 1 nameserver in reality and there are better ways of handling the simplified version below - my actual solution will include multiple nameservers, multiple views and other stuff like hooks into an application and additional subdomains) is this -

If I have 2 nameservers (one in LA and one in UK for example), with the server in the UK being the active server, is it acceptable to have the following zone layout:

on LA Server:

                     (SOA Serial 2013013101)   NS   NS     A    LA.server.ip     A    UK.server.ip     NS     NS

on UK server:

               (SOA Serial 2013013101)   NS   NS     A    LA.server.ip     A    UK.server.ip     A    UK.server.ip     A    UK.server.ip

The idea here being that requests to and are always directed to UK.server.IP via DNS. (I want to do this so that if there is an extended outage in the UK, I can change the zone on the LA server and get up and running again - without making changes with the registrar). Of-course, both and will be provided as IP addresses for the registrar.

My concerns revolve around the SOA serial numbers and if I'm breaking spec by having different answers for the same zones, and if DNS resolution/redirection will work as expected. (I assume this will all work OK if I split the UK server into multiple zones, one like the LA zone, and zone for and - but It would be cool if I can avoid this)

share|improve this question

What do you mean by "active" server? There is no field in DNS that enables you to set a preference for nameservers (there is only one for MX). So for a client, that has just found out about your zone, both LA and UK are on the same level in the hierarchy. Which of these he chooses is implementation-specific and none of our business. This choice could even change for subsequent requests (again, implementation-specific).

I don't think you will run into problems with this layout, because the servers don't tell different stories, only different parts...

But why are you not using a proper master/slave-schema with Bind (assuming you're willing to use it)? My master nameserver (only in my own hierarchy, not for the registrar) has the only file for the zone, and the slaves ask for copies via a AXFR, and get notified upon updates. The duration in which the slaves keep the zone data is configurable. If you want more details on how to set this up I would be honored to help you.


I propose the following approach (which should be fully conforming to specs):


  • UK1:
  • UK2:
  • LA:

Servicing Zone A A A NS ns1      <-- NS ns2      <-- this goes to registrar NS ns3      <--

(provide long TTLs here, to make full use of caching. It introduces a layer of indirection, but with long TTLs, it shouldn't be that bad). A A

(short TTLs here, these values give the active nameservers for your zone. The shorter the TTL, the faster the use of the other nameservers).

All other Zones NS  <-- this goes to registrar NS  <--          

anything you want to put in here...

In case of failover, LA will replace the active nameservers in the servicing zone, and will subsequently get all requests to your other zones.

share|improve this answer
Thank you for your response. By Active Server I mean the server that is answering requests - there will be a cold standby in LA. As far as MX goes I'm not worried about that (and can add more MX's - as I said, this is a simplified picture). Part of the missing bits is that there will actually be 3 actual nameservers spread across 3 connections (1 in "LA" and 2 in "UK"), with 5 IP addresses (split views in UK), and 4 different zones, handled in a similar way but with different IP's. I don't want to start getting invovled with Master and Slaves because it causes lag...cont – davidgo Feb 1 '13 at 9:10
and difficulties if UK is wiped out. It is also easier for me to programatically replicate files between nameservers then to set up Slaves and reduces delay in recovery. The key thing I'm wanting to achieve is to have "LA" forward all requests down to "UK" (and I need to use nameservers to balance the 2 UK circuits including failure of one link). If I can take a shortcut and combine the subdomains into a single zone it will make things easier to read and modify - but I'm worried it won't work due to the NS record processing and/or SOA issues. – davidgo Feb 1 '13 at 9:15
(Sorry, its late here - Active Server = Web Server) [ And BGP or some such is not an option. I also don't want to add a Web Server in "LA" to proxy to "UK" because of limitations on the platform I have to work with.] – davidgo Feb 1 '13 at 9:16
well, you could use one zone as a "service" zone that only includes your nameservers, and the other zones "reference" these nameservers. In normal use, all these "referenced" nameservers will be in UK, in failover not. You will give your registrar the nameservers in your servicing zone for the "content"-zones, and if one of the servicing nameservers stop, the others are still denoted as fully authoritative for the content zones. Did I express myself understandable enough? – thriqon Feb 1 '13 at 9:37
Thank you - I think so - If you are, in effect saying that I should remove the A records from "LA", and all requests for the zone will forward down to "UK" and this will work and is in spec, then if you provide that as an anwer I'll mark it up (and accept it once Im satisfied it meets the specs). My question is will that actually work if I have (for example) an A record for [ I suspect it should, but I'm not totally sure if it is in spec) – davidgo Feb 1 '13 at 18:42
up vote 0 down vote accepted


I set up a test system and nameservers across the Internet did not correctly resolve the domain name when they hit the nameserver which only had DNS (and associated glue records)

share|improve this answer
Vote manipulation through editing is not recommended. If you upvoted an answer by mistake or later found it to be incorrect, editing it simply to undo your "locked in" vote is not the right thing to do IMO. – Karan Feb 4 '13 at 1:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.