I am trying to provide a level of failover control (between 2 sites) using DNS (bind9), and I am unsure if what I am planning to do is compliant with the specs and if it will work reliably.

The core of the question (simplified - I know I need more then 1 nameserver in reality and there are better ways of handling the simplified version below - my actual solution will include multiple nameservers, multiple views and other stuff like hooks into an application and additional subdomains) is this -

If I have 2 nameservers (one in LA and one in UK for example), with the server in the UK being the active server, is it acceptable to have the following zone layout:

on LA Server:

                     (SOA Serial 2013013101)

domain.name.   NS    ns1.domain.name.
domain.name.   NS    ns2.domain.name.

ns1.domain.name.     A    LA.server.ip
ns2.domain.name.     A    UK.server.ip
www.domain.name.     NS   ns2.domain.name.
ww2.domain.name.     NS   ns2.domain.name.

on UK server:

               (SOA Serial 2013013101)

domain.name.   NS    ns1.domain.name.
domain.name.   NS    ns2.domain.name.

ns1.domain.name.     A    LA.server.ip
ns2.domain.name.     A    UK.server.ip
www.domain.name.     A    UK.server.ip
ww2.domain.name.     A    UK.server.ip

The idea here being that requests to www.domain.name and ww2.domain.name are always directed to UK.server.IP via DNS. (I want to do this so that if there is an extended outage in the UK, I can change the zone on the LA server and get up and running again - without making changes with the registrar). Of-course, both ns1.domain.name and ns2.domain.name will be provided as IP addresses for the registrar.

My concerns revolve around the SOA serial numbers and if I'm breaking spec by having different answers for the same zones, and if DNS resolution/redirection will work as expected. (I assume this will all work OK if I split the UK server into multiple zones, one like the LA zone, and zone for www.domain.name and ww2.domain.name - but It would be cool if I can avoid this)


What do you mean by "active" server? There is no field in DNS that enables you to set a preference for nameservers (there is only one for MX). So for a client, that has just found out about your zone, both LA and UK are on the same level in the hierarchy. Which of these he chooses is implementation-specific and none of our business. This choice could even change for subsequent requests (again, implementation-specific).

I don't think you will run into problems with this layout, because the servers don't tell different stories, only different parts...

But why are you not using a proper master/slave-schema with Bind (assuming you're willing to use it)? My master nameserver (only in my own hierarchy, not for the registrar) has the only file for the zone, and the slaves ask for copies via a AXFR, and get notified upon updates. The duration in which the slaves keep the zone data is configurable. If you want more details on how to set this up I would be honored to help you.


I propose the following approach (which should be fully conforming to specs):


  • UK1:
  • UK2:
  • LA:

Servicing Zone

ns1.serv.com A
ns2.serv.com A
ns3.serv.com A

serv.com NS ns1      <-- 
serv.com NS ns2      <-- this goes to registrar
serv.com NS ns3      <--

(provide long TTLs here, to make full use of caching. It introduces a layer of indirection, but with long TTLs, it shouldn't be that bad).

ans1.serv.com A
ans2.serv.com A

(short TTLs here, these values give the active nameservers for your zone. The shorter the TTL, the faster the use of the other nameservers).

All other Zones

example1.com NS ans1.serv.com.  <-- this goes to registrar
example1.com NS ans2.serv.com.  <--          

anything you want to put in here...

In case of failover, LA will replace the active nameservers in the servicing zone, and will subsequently get all requests to your other zones.

  • Thank you for your response. By Active Server I mean the server that is answering requests - there will be a cold standby in LA. As far as MX goes I'm not worried about that (and can add more MX's - as I said, this is a simplified picture). Part of the missing bits is that there will actually be 3 actual nameservers spread across 3 connections (1 in "LA" and 2 in "UK"), with 5 IP addresses (split views in UK), and 4 different zones, handled in a similar way but with different IP's. I don't want to start getting invovled with Master and Slaves because it causes lag...cont – davidgo Feb 1 '13 at 9:10
  • and difficulties if UK is wiped out. It is also easier for me to programatically replicate files between nameservers then to set up Slaves and reduces delay in recovery. The key thing I'm wanting to achieve is to have "LA" forward all requests down to "UK" (and I need to use nameservers to balance the 2 UK circuits including failure of one link). If I can take a shortcut and combine the subdomains into a single zone it will make things easier to read and modify - but I'm worried it won't work due to the NS record processing and/or SOA issues. – davidgo Feb 1 '13 at 9:15
  • (Sorry, its late here - Active Server = Web Server) [ And BGP or some such is not an option. I also don't want to add a Web Server in "LA" to proxy to "UK" because of limitations on the platform I have to work with.] – davidgo Feb 1 '13 at 9:16
  • well, you could use one zone as a "service" zone that only includes your nameservers, and the other zones "reference" these nameservers. In normal use, all these "referenced" nameservers will be in UK, in failover not. You will give your registrar the nameservers in your servicing zone for the "content"-zones, and if one of the servicing nameservers stop, the others are still denoted as fully authoritative for the content zones. Did I express myself understandable enough? – thriqon Feb 1 '13 at 9:37
  • Thank you - I think so - If you are, in effect saying that I should remove the A records from "LA", and all requests for the zone will forward down to "UK" and this will work and is in spec, then if you provide that as an anwer I'll mark it up (and accept it once Im satisfied it meets the specs). My question is will that actually work if I have (for example) an A record for domain.name. [ I suspect it should, but I'm not totally sure if it is in spec) – davidgo Feb 1 '13 at 18:42


I set up a test system and nameservers across the Internet did not correctly resolve the domain name when they hit the nameserver which only had DNS (and associated glue records)

  • Vote manipulation through editing is not recommended. If you upvoted an answer by mistake or later found it to be incorrect, editing it simply to undo your "locked in" vote is not the right thing to do IMO. – Karan Feb 4 '13 at 1:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.