Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Does anyone know of a good strategy for DNS failover?


That's one of the easiest thing to do. Just add multiple NS to the domain. As long as they are configured correctly and at least one is up (and for limited time even if none are up) the service is available.

With DNS you actually can achieve 100% uptime.


Well, there's a couple of strategies:

- IP-diverse nameservers

- TLD-diverse nameservers

- BGP anycast

IP-diverse nameservers requires that you expect that your DNS servers will go down rather than start returning bad results - I highly recommend having some sort of mechanism to hard-terminate access to those machines.

TLD-diverse nameservers is just an extra strategy for reducing the risk that an upstream TLD issue will blow up your spot.

And then BGP anycast is the expensive, complicated piece of this - it requires a high level of technical sophistication, lots of moving parts, and the QA/validation piece of it is tricky.

When I built an anycast DNS system, we ended up resorting to tricks like having the DNS servers publish routes to the router for redistribution, so that a down or unresponsive server automatically withdrew the routes. Then you do things like TXT records for your zone that respond with which POP you're hitting in some sort of hashed/obfuscated fashion.

It's hard and complicated, and unnecessary for most folks. Better to outsource to Route 53 or someone similar.


- Implementation-diverse nameservers

Use multiple implementations, e.g. NSD/BIND for authoritative servers and Unbound/BIND for resolvers, to mitigate against implementation-specific bugs and vulnerabilities.


A fair number of providers support zone transfers (AXFR requests) from master to slave name servers. The slaves can be operated by a different entity.

Here's DNSimple's implementation: https://support.dnsimple.com/articles/secondary-dns/

I wrote about moving from 1 to 2+ authoritative DNS providers: http://blog.papertrailapp.com/dns-outage-on-monday-december-.... I think this is just as true today:

> For .. maintainers of mission-critical DNS zones, the solution is to not depend on any single DNS infrastructure for functioning authoritative DNS


I don't know if DigitalOcean's DNS servers allow AXFR, if they do you can use a secondary DNS service to automatically replicate the DNS. You then list the secondary DNS as a NS for your domain.

If they don't allow AXFR -- and after this, they should! -- you can still have a secondary DNS provider but you'd have to duplicate any changes by hand. Not ideal but still doable.


DNS has failover built into the protocol, just have another server listed at your registrar.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: