1

Inspired by this question: Using two separate DNS servers on the same domain

When you have multiple nameservers that resolve your domain, when is e.g. the ns2 used? Only when ns1 is offline?

  • 1
    It is a live spare (backup) in case one or the other fails. Often NS servers are taken in list order depending upon how a system is configured, however, some systems will pseudo load-balance by using all NS servers in a list. – closetnoc Aug 14 '15 at 16:05
  • @closetnoc I already thought they would be contacted by order on 'regular' systems. If you could put that in answer I'll accept it. Thanks :) – William Edwards Aug 14 '15 at 16:08
1

I worked as a network engineer during the earliest days of the Internet until I retired from that work. As well, I was a web host at one point and understand the original intent of having more than one DNS for hosting domain names. I am working off of older rules in this answer. Some of them may have been relaxed.

In the very early days, it was not uncommon for downtime and connectivity problems to effect resolving domain names. As a result, any DNS that is a SOA (statement of authority) was required to be hosted on two live systems. However, the problems did not stop there. It was further required that both name servers operating as a SOA reside on separate physical networks and that any domain name SOA not reside on a DNS that is a sub-domain of the domain itself.

In otherwords, example.com cannot have it's SOA on ns1.example.com and ns2.example.com. It was required that the example.com SOA to exist somewhere else such as ns1.examplednshost.com and ns2.examplednshost.com. Ns1.examplednshost.com and ns2.examplednshost.com would have to be on separate physical networks to remove any single point of failure. After that, ns1.example.com and ns2.example.com can be anything.

In my case when hosting sites, my domain name SOA was externally hosted by two other companies on two separate networks, however, the master DNS was on my domain. This means that the SOA DNS servers pulled from my master to populate their records. As well, my DNS servers were also an SOA for my domain (for simplicity- and not to be confused as my SOA as being official for my domain) and for many others that I hosted. Each DNS server resided on their own frame network. There were actually 5 DNS servers hosting my domain name and 4 of them pulled from the master in a cascading topology.

Having two NS servers is for fail-over. Often NS servers are taken in list order depending upon how a system is configured, however, some systems will pseudo load-balance by using all NS servers in a list.

  • The last paragraph is slightly wrong. If we are talking about authoritative nameservers they are a set (not a list). Typically nameservers will reply with them ordered (because bytes are ordered on the network) differently at each reply. The client is free to use any of them. Many recursive clients will try both, record the time they take to reply and try to stick with the fastest one, with the random probes of the other ones from time to time in case it would be good to switch to one of them instead. So it is by default load-balancing, all of them are used. – Patrick Mevzek May 22 '18 at 17:26
  • If we speak about recursive nameservers, like in /etc/resolv.cong then it is a list, the system only and always uses the first one... except if it does not reply at all for a given query and then it tries the second one, and so on. This is per request, so next request starts again with the first one. – Patrick Mevzek May 22 '18 at 17:27
  • @PatrickMevzek Your are talking about a resolver and not a name server. These are two entirely different systems. Name servers are client/server models that are primarily designed to be public and queried externally where a resolver is designed to resolve names on the machine it resides on and expected to be private. The function of each is different and the behaviors are intentionally different. While both are simple, resolvers are especially simple by design to make resolution more user accessable. Resolvers also have build in limitations by design. Cheers!! – closetnoc May 22 '18 at 17:54
  • A resolver is a nameserver, a nameserver is a resolver. The dichotomy you create does not exist in real life. Resolvers (as in recursive nameserver to be precise) can be public, see 8.8.8.8, 1.1.1.1 or 9.9.9.9. A nameserver role (authoritative or recursive) is mostly orthogonal to which clients can query it. The only existing separation is between the authoritative and the recursive roles. It can be the same code base: bind can act as both! recursive is not necessarily simpler than authoritative. The question was not clear on this point and your answer partially wrong. – Patrick Mevzek May 22 '18 at 18:36
  • @PatrickMevzek I agree there is overlap, of course, because in part, a resolver does some of the same function as a name server, however the two are clearly not equivalent. Yes Bind can be queried by the same machine it resides on, however the methods of query between a resolver and DNS is decidedly different. One is internal to the OS function, the other is not. I am a retired system internals engineer and core networks engineer who wrote OSs, protocol stacks, device drivers, etc. including IP. While it has been a while since I had to get into the details, I do get the concept. – closetnoc May 22 '18 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.