Secondary DNS different SOA record

dns-zonens-recordsoa-record

we are managing our DNS data at Azure DNS. They provide 4 NS for redundancy, but just two days ago the whole Azure DNS service went down for a few hours, and all of our services with it as well. Now i'm looking for a better redundancy for such a worst case scenario.

Unfortunately Azure DNS does not support outgoing zone transfer to a secondary NS hosted by a different provider. But they provide a tool for exporting all data of a zone into a zone file.

Amazon Route 53 gives me the option, to import such a zone file. But for this i have to recreate that zone for my domain at Amazon first. And this leads to a different SOA record (and also 4 different NS entries).

My plan was to use both services (Azure and Amazon), and take from both two NS:

MyDomain NS1 -> Azure
MyDomain NS2 -> Amazon
MyDomain NS3 -> Azure
MyDomain NS4 -> Amazon

As i synchronize the zone data between the 2 providers over export / import by myself, i don't see a problem in terms of accurate DNS data. But the SOA and the NS records for the domain are not consistent.

What are the implications in such a szenario? Could that lead to problems with spam prevention or other services, who query DNS data for a domain?

Thank you in advance.

Best Answer

I originally wrote this as a comment, but honestly, I think it's really your best course of action.

Your DNS provider lost all its marbles for several hours and it won't support secondary DNS off-premises, and your response is to try to hack around it? I'd be curious to know what Azure would have to do to actually lose your business; shoot your dog, maybe? Myself, I'd be running for the exit so fast no-one would see the blur. It's time to change your DNS provider to one that doesn't suck.

Related Solutions

DNS – How to Find Authoritative DNS for My Domain

You have to understand that DNS is a hierarchic system. This means that whatever DNS-servers the .ru-registry (a-f.dns.ripn.net) means are authoritative for your domain will also be the DNS-servers that will be asked when people try to resolve the domain.

Until the .ru-registry has updated the information regarding the domain to use your new name servers, your old name servers will be used.

What do values in SOA record affect

From RFC 1033 one of the core DNS RFC's (the DNS Wikipedia page has a nice list)

SOA  (Start Of Authority)

           <name>  [<ttl>]  [<class>]  SOA  <origin>  <person>  (
                           <serial>
                           <refresh>
                           <retry>
                           <expire>
                           <minimum> )

The Start Of Authority record designates the start of a zone. The one ends at the next SOA record.

<name> is the name of the zone. (Comment: typically the domainname example.com or office.example.com)

<origin> is the name of the host on which the master zone file resides. (Comment: the primary name server)

<person> is a mailbox for the person responsible for the zone. It is formatted like a mailing address but the at-sign that normally separates the user from the host name is replaced with a dot. (Comment: hostmaster@office.example.com becomes hostmaster.office.example.com)

<serial> is the version number of the zone file. It should be incremented anytime a change is made to data in the zone. (Comment: common is a timestamp like string yyyymmdd(hhmm)

<refresh> is how long, in seconds, a secondary name server is to check with the primary name server to see if an update is needed. A good value here would be one hour (3600).

<retry> is how long, in seconds, a secondary name server is to retry after a failure to check for a refresh. A good value here would be 10 minutes (600).

<expire> is the upper limit, in seconds, that a secondary name server is to use the data before it expires for lack of getting a refresh.

You want this to be rather large, and a nice value is 3600000, about 42 days.

<minimum> is the minimum number of seconds to be used for TTL value in RRs. A minimum of at least a day is a good value here (86400).

There should only be one SOA record per zone. A sample SOA record would look something like:

           @   IN   SOA   SRI-NIC.ARPA.   HOSTMASTER.SRI-NIC.ARPA. (
                           45         ;serial
                           3600       ;refresh
                           600        ;retry
                           3600000    ;expire
                           86400 )    ;minimum

The SOA records can be fitted on a single line.

Best Answer

Related Solutions

DNS – How to Find Authoritative DNS for My Domain

What do values in SOA record affect

Related Topic