Ask HN: DNS redundancy, how to do it right?
<i>Is it a good idea to setup my own nameserver which basically just &quot;copies&quot; the entries from my current provider and specify it (wherever that may be). By doing this I won&#x27;t have to maintain 2 different NS, only the one from the provider since the &#x27;secondary&#x27; will simply be a copy of the primary?</i><p>Do you mean authoritative secondary replicas?  If so, that is not uncommon.  If your DNS provider is being targeted and your company is not then your DNS servers will still respond and a percentage of clients will try them.  While root servers allow 10 records, anything beyond 4 will become less useful as different resolvers cap the number of NS records they will try.  You can look up which OS&#x2F;resolver has what behavior and then make a decision based on what OS most of your customers use.  Amazon for example uses batches of 5 anycast records.  If your commercial DNS provider is also Anycast, theny one could use 2 of those records and 2 of your own company hosted DNS just fine.<p>Look into how your commercial DNS provider handles zone transfers then set up a couple decent servers that uptake all the zones you want redundancy for.  Just know there is no concept of priority <i>meaning what order they are listed in the root servers does not matter</i>.  Whatever servers you set up will need to take a percentage of the traffic your commercial provider is absorbing.  If doing this on a VPS provider I would suggest Vultr as they support Anycast meaning you can spin up many VM&#x27;s to handle the load and still only have a couple public IP addresses without any load-balancer bottlenecks.<p><i>Is it a good idea to simply increase the TTL of the important A&#x2F;MX-Records? Will for example, 1.1.1.1 still resolve my domain correctly, even if my providers nameserver is down for an hour? (assumed I have a TTL of 3 hours for example)</i><p>There are pros and cons to high TTL&#x27;s depending on how your organization handles changes, failovers, etc... There are some discussions on the web about these pros and cons, too many to name here.  It is also important to understand how clients actually cache high TTL&#x27;s.  For example, some clients will cap NS TTL to 86400 seconds regardless of how high they are and some clients will cap A TTL to 1 or 3 days.  Then there is the factor of recursive server memory and end-users.  ISP caches will expire records much faster regardless of TTL due to memory pressure.  Each ISP and public DNS server handles this a little differently.  So a high TTL <i>can sometimes</i> help assuming your infrastructure does not depend on being able to fail over things fast and that you are not planning on changing MX end-points.  This requires some foresight into how one architects their infrastructure to fully recognize the benefits from higher TTL without incurring operational risk.<p>I am testing 1.1.1.1 right now and it took many requests to finally get my records cached on all their nodes, so if your domain is popular enough they may be useful.<p>I suppose that was a long-winded way of saying, <i>&quot;It depends&quot;</i>.  You should meet with your infrastructure team and think through what systems depend on having a low TTL and keep those low.  For anything else a higher TTL is probably fine.<p>[Edit] It sounds like maybe you were just asking about recursive servers so most of this doesn&#x27;t even apply.<p>Some places to browse for more detailed answers would be StackExchange [1] ServerFault [2] SuperUser [3]  Just be sure to lurk a long time before asking questions.  They are particular about how questions are formatted, how on-topic they are for the particular forum and if one has done an exhaustive search for existing answers.<p>[1] - <a href="https:&#x2F;&#x2F;unix.stackexchange.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;unix.stackexchange.com&#x2F;</a><p>[2] - <a href="https:&#x2F;&#x2F;serverfault.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;serverfault.com&#x2F;</a><p>[3] - <a href="https:&#x2F;&#x2F;superuser.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;superuser.com&#x2F;</a>