RFC 2182
Selection and Operation of Secondary DNS Servers
RFC 2182: Selection and Operation of Secondary DNS Servers 🎀
okay bestie, this one is a Best Current Practice (BCP 16) from July 1997 🦋 It's written by R. Elz (University of Melbourne), R. Bush (RGnet, Inc.), S. Bradner (Harvard University), and M. Patton (Consultant). Its title block doesn't list anything it obsoletes or updates.
Status of this Memo 📋
this doc is a Best Current Practices spec for the Internet Community 💖 it's asking for discussion and suggestions for improvements, and anyone can share it freely (distribution is unlimited) 🌸
Abstract ✨
DNS needs multiple servers for every delegated domain (zone) 💅 this doc talks about how to pick secondary servers for zones. Both where a server sits physically and where it sits topologically matter a LOT when you're choosing one 😭 It also covers how many servers a zone should have and some general upkeep stuff for secondary servers 🫶
Contents 🗂️
Abstract ................................................... 1
1 Introduction ............................................... 2
2 Definitions ................................................ 2
3 Secondary Servers .......................................... 3
4 Unreachable servers ........................................ 5
5 How many secondaries? ...................................... 7
6 Finding Suitable Secondary Servers ......................... 8
7 Serial Number Maintenance .................................. 9
Security Considerations .................................... 11
References ................................................. 11
Acknowledgements ........................................... 11
Authors' Addresses ......................................... 111. Introduction 🌈
ok so a bunch of DNS problems come down to bad picks for secondary servers 😤 where a zone's servers are placed geographically, and how diverse their network connections are, can boost reliability and make the network faster to access 🚀 But other choices can quietly make things LESS reliable or pile extra demand onto the network 💀
this doc goes through the stuff you should think about when choosing secondary servers for a zone ✨ it gives guidance on picking the best servers to serve a given zone 🫶
2. Definitions 📖
for this doc (and only this doc) these are the definitions 🧚
DNS The Domain Name System [RFC1034, RFC1035].
Zone A part of the DNS tree, that is treated as a
unit.
Forward Zone A zone containing data mapping names to host
addresses, mail exchange targets, etc.
Reverse Zone A zone containing data used to map addresses
to names.
Server An implementation of the DNS protocols able to
provide answers to queries. Answers may be
from information known by the server, or
information obtained from another server.
Authoritative Server A server that knows the content of a DNS zone
from local knowledge, and thus can answer
queries about that zone without needing to
query other servers.
Listed Server An Authoritative Server for which there is an
"NS" resource record (RR) in the zone.
Primary Server An authoritative server for which the zone
information is locally configured. Sometimes
known as a Master server.
Secondary Server An authoritative server that obtains
information about a zone from a Primary Server
via a zone transfer mechanism. Sometimes
known as a Slave Server.
Stealth Server An authoritative server, usually secondary,
which is not a Listed Server.
Resolver A client of the DNS which seeks information
contained in a zone using the DNS protocols.3. Secondary Servers 🎀
the big reason to have multiple servers per zone is so the zone's info is available everywhere, reliably, to clients all over the Internet (like, the whole world 🌍) even when one server is down or unreachable 💖
multiple servers also spread out the name resolution load, and they make the system more efficient by putting servers closer to the resolvers ⭐ we're not digging into those reasons here though 🙈
usually you've got one primary server and the rest are secondary servers 🍓 some weird setups use multiple primaries, but that can cause data inconsistencies, so it's not advisable 💅
the primary vs. secondary split only matters to the servers for that zone 🌸 to the rest of the DNS, they're all just multiple servers. at first, everyone treats them equally, even the parent server that delegates the zone 👑 resolvers often measure how well each server performs, pick the "best" one (for whatever "best" means to them), and stick with it for most queries 🦋 that happens automatically and isn't what this doc is about.
the primary server holds the master copy of the zone file 🧚 that's where the data gets entered into the DNS from some source outside of it. secondary servers grab their data for the zone using DNS protocol mechanisms, pulling the zone from the primary 🫶
3.1. Selecting Secondary Servers 💅
when you're picking secondary servers, you've gotta think about the failure modes that are likely to happen 🔥 servers should be placed so that for any likely failure, at least one server is still available to every significant part of the Internet ✨
so putting ALL your servers at the local site might be easy to set up and easy to manage, but it's not a good policy 😭 if one link goes down, or there's a site, building, or even just a room with a power failure, that setup can leave every server cut off from the Internet 💀
secondary servers MUST be placed at both topologically and geographically dispersed locations on the Internet, so a single failure can't take them all out 👑
so yeah, secondary servers SHOULD be at geographically distant locations, so events like power loss won't knock out all of them at once 🌈 they should also connect to the net over pretty diverse paths. that way, if one link fails, or routing breaks inside some part of the network (like a service provider), the servers won't all become unreachable 🦋
3.2. Unsuitable Configurations 🙈
I know it's super common, but servers for a zone should NOT all be on the same LAN segment, in the same room, of the same building, or anything like that 😤 that setup basically defeats the whole point of having multiple servers. the only redundancy it usually gives you is for when one server is down, but there are lots of other failure modes to think about, like power failures (even long ones) 🔌
3.3. A Myth Exploded 💀
there's this argument that floats around sometimes: the domain name servers for a domain don't need to be reachable if the hosts in that domain are unreachable 🙅♀️ this argument is totally fallacious, bestie.
- clients react differently to not being able to resolve a name than to not being able to connect, and their reactions to the first one aren't always as desirable 😬
- if the zone resolves but a particular name doesn't, a client can just give up on the transaction instead of retrying and piling load onto the network 🫠
- positive DNS results are usually cached, but a lack of result is NOT cached 🙃 so unnecessary resolution failures add an undesirable load to the net 💅
wait it gets worse 😭
- not every name in the zone may resolve to addresses inside the detached network, and that gets more likely over time 💀 so the basic assumption behind the myth often stops being true 🥀
it's important that there be nameservers that can be queried and are always available for all forward zones 🫶
4. Unreachable servers 🌸
another kind of problem comes from listing servers that can't be reached from big parts of the network 🙈 like listing the name of a machine that's completely cut off behind a firewall, or just a secondary address on a dual-homed machine that can't be reached from outside. the names of servers listed in NS records should resolve to addresses that are reachable from the region the NS records are being returned to 💖 including addresses most of the network can't reach doesn't add any reliability, and it causes several problems that can end up lowering the zone's reliability 😭
first off, the only way for resolvers to figure out that these addresses are actually unreachable is to try them 😩 they then have to wait out a no-response timeout (or sometimes an ICMP error response) to know the address can't be used. that's also basically indistinguishable from simple packet loss, so they have to repeat the process several times to get any real evidence of an unreachable server 🌀 all this probing and timing out can take so long that the original client program or user decides no answer is available, which makes the zone look like it failed 💀 on top of that, the whole thing has to be redone from time to time to tell a permanently unreachable server apart from a temporarily unreachable one 🔁
and finally, all these steps could end up being done by resolvers all over the network 😵 that jacks up traffic and probably the load on the filters at whatever firewall is blocking access. all of this extra load just ends up lowering the reliability of the service 🫠
4.1. Servers behind intermittent connections 🌧️
a similar problem happens with DNS servers in parts of the net that get disconnected from the Internet as a whole pretty often 🔌 for example, servers that connect over an intermittent connection that's often down. these servers should usually be treated as if they were behind a firewall, and as unreachable to the network at any time 🙅♀️
to be continued... 🧚💖
4.2. Other problem cases 🧚
okay so these problems get even messier when a Network Address Translator (NAT) [RFC1631] sits between a resolver and a server 😭 Despite what [RFC1631] suggests, NATs in practice don't translate addresses embedded in packets, only the ones in the headers 💀 As [RFC1631] suggests, this is kind of a big problem for the DNS 🙈 It can sometimes be fixed if the NAT comes with, or gets replaced by, an Application Layer Gateway (ALG) 💅 An ALG actually understands the DNS protocol and translates all the addresses as needed while packets pass through, which is iconic ✨ Even with an ALG though, it's likely better in any of these cases to go with the solution in the next section 🫶
4.3. A Solution 🌸
ngl the fix is to make sure the NS records for a zone, in any response, only list servers that the resolver asking for the info is likely to be able to reach 💖 Some resolvers are also servers doing lookups for other resolvers, so the NS records should be reachable not just by the one who asked, but by any other resolver that might get the info forwarded to it 🦋 Every address of every server returned must be reachable 🔥 Each server's addresses form a Resource Record Set [RFC2181], so they all have to be returned (or none of them), which means you can't leave out the unreachable addresses, or return them with a low TTL while the others get a higher TTL 😭 not me trying to be sneaky with TTLs 🙃
Now, when some servers are behind a firewall, an intermittent connection, or a NAT that blocks DNS queries or responses (or has problems with them), their names or addresses should not be returned to clients outside the firewall 🧱 Same vibe the other way: servers outside the firewall shouldn't be made known to clients inside it, if those clients couldn't query them anyway 🙅♀️ Doing this usually means a dual DNS setup, one for internal use and one for external use 👑 Honestly, that setup tends to fix a bunch of other problems in environments like this too 🌈
When a server sits right at a firewall boundary and can be reached from both sides, but uses different addresses on each side, that server should get two names, each with the right A records, so that each name only looks reachable from its own side of the firewall 🎀 Then you treat it just like two servers, one on each side of the firewall 💜 An ALG-implemented server is usually this exact case 🧚 It needs special care so it returns the correct responses to clients on each side, meaning it only shares info about hosts reachable from that side, plus the correct IP address(es) for the host as seen from that side ✨
Servers in this kind of environment often need special setup to get access to the root servers 🍓 This is often done with "fake root" configurations 🤭 In that case, the servers should be kept well isolated from the rest of the DNS, because their unusual configuration could pollute everyone else's 🥺
5. How many secondaries? ✨
The DNS specification and the domain name registration rules both require at least two servers for every zone 💅 Usually that's the primary plus one secondary 🌷 Two carefully placed servers are often enough, but there are plenty of times when two just isn't enough, so we advise using more than two listed servers 🫶 Various problems can knock a server out for long stretches, and during that time a zone with only two listed servers is actually running on just one 😬 Since any server can be unavailable now and then for all kinds of reasons, a zone like this is likely, at times, to have no working servers at all 💀
BUT (lowkey) having tons of servers doesn't add much benefit, while it does add costs 💸 At the simplest level, more servers means bigger packets, which means more bandwidth 🦋 This might seem trivial, and honestly it kind of is 🙄 However, there's a limit to how big a DNS packet can be, and hitting that limit has more serious performance implications 😭 It's wise to stay well clear of it 🫧 More servers also make it more likely that one server gets misconfigured or malfunctions without anyone noticing 👀
For most organisation level zones, it is recommended to provide three servers, with at least one being well removed from the others 🌈 For zones that need even higher reliability, four or even five servers may be desirable 👑 With five, two (or occasionally three) would be at the local site, while the others are not geographically or topologically close to the site, or to each other 🧚
Reverse zones, meaning sub-domains of .IN-ADDR.ARPA, tend to be less crucial, so fewer and less spread-out servers will often be enough 💖 That's because address to name translations are usually only needed when packets are coming in from the address in question, and only by resolvers at or near where those packets are going 🎯 This gives some assurance that servers located at or near the packet source (for example, on the same network) will be reachable from the resolvers that need to do the lookups ✨ So some of the failure modes you'd need to think about when planning servers for forward zones may matter less for reverse zones 🌸
5.1. Stealth Servers 🥷
Servers that are authoritative for the zone but aren't listed in NS records (also known as "stealth" servers) don't count toward the number of servers 🙈
It can often be super useful for all the servers at a site to be authoritative (secondary), but for only one or two of them to be listed servers, with the rest being unlisted servers for all local zones, which means stealth servers 🦋
This lets those servers answer local queries directly, without having to consult another server 💅 If they did need to consult another server, they'd usually have to consult the root servers to follow the delegation tree, because the fact that the zone is local wouldn't be known 😵 That means some local queries might not be answerable if external communications were disrupted 😭
Listing all of those servers in NS records (if there were more than one or two) would make the rest of the Internet waste effort trying to contact every server at the site when the whole site is inaccessible due to link or routing failures 💀
6. Finding Suitable Secondary Servers 💜
Running a secondary server is usually an almost automatic task 🤖 Once it's set up, the server pretty much runs itself, based on what the primary server does 🫶 Because of this, lots of organisations are happy to provide a secondary server if someone asks 🌈 The best approach is usually to find an organisation of similar size and agree to swap secondary zones, so each organisation provides a server to act as a secondary for the other's zones 👯♀️ Note that there's no loss of confidential data here, since the data set being exchanged would be publicly available no matter what servers are used 🔓✨
7. Serial Number Maintenance ✨
okay so this is the part where the secondaries figure out when to update their copy of the zone, and it all runs on the SOA serial number 🔢💖. Serial numbers are basically 32 bit unsigned integers that wrap around from the biggest possible value back to zero again 🌀. If you want the rigorous version, go read [RFC1982] 🤓.
The serial number MUST be incremented every time a change, or group of changes, is made to the zone on the primary server 💅. That's how the secondaries find out they need to update their copies of the zone 🫶. And note that you can't decrement a serial number 🙅♀️. Increments are the only defined modification, periodt 💀.
Occasionally, due to editing errors or other factors, a serial number needs to get smaller 😭. Never simply decrease it 🚫. The secondaries will ignore that change, and they'll ALSO ignore any later increments until the earlier large value gets exceeded 💀🔥. Not me ignoring the whole zone 🙈.
Instead, since serial numbers wrap from large to small, you increment the serial number several times, in absolute terms, until it reaches the value you want 🦋. At each step, you SHOULD wait until all secondary servers have updated to the new value before moving on 🧚. (Yes, that wait is a requirement-level thing 👑.)
Let's do an example 🎀. Say a zone's serial number was 10, but it got accidentally set to 1000, and you want it back to 11 🥺. You can't just change 1000 to 11. A secondary that has seen the 1000 value (and in practice, there is always at least one 😩) will ignore that change and keep using the zone version with serial number 1000, until the primary's serial number goes past that value. This could take forever 💀. Honestly the secondary often expires its copy of the zone before the zone is ever updated again 😭🌸.
So instead, for this example, set the primary's serial number to 2000000000 and wait for the secondaries to update to that zone 🌈. The value 2000000000 is chosen as a value a lot bigger than the current value, but less than 2^31 bigger (2^31 is 2147483648) 🧮. That makes it an increment of the serial number [RFC1982] ✨.
Next, once all servers that need updating have the zone with that serial number, you can set the serial number to 4000000000 💜. 4000000000 is 2000000000 more than 2000000000 (fairly clearly 🙄), so it's another increment, since the value added is less than 2^31 🦋.
Once this copy of the zone file exists at all servers, you can finally just set the serial number to 11 👑. In serial number arithmetic, going from 4000000000 to 11 counts as an increment 🔥. Serial numbers wrap at 2^32 (4294967296), so 11 is the same as 4294967307 (4294967296 + 11) 🧠. And 4294967307 is just 294967307 greater than 4000000000, and 294967307 is well under 2^31, so yep, that's an increment 💖.
When you follow this procedure, you MUST verify that all relevant servers have been updated at each step, and you MUST NOT assume anything 🙅♀️🚨. Skipping this can cause a worse mess than existed before you tried to fix it 😱. Also, beware that it's the relationship between the values of the various serial numbers that matters, not the absolute values 🫠. The values used above are only correct for that one example 🎀.
In essentially all cases, you can correct the serial number in two steps if you're more aggressive about choosing the serial numbers 🏃♀️. This makes the numbers less "nice" though, and it requires considerably more care 🧐.
Also, not all nameserver implementations correctly implement serial number operations 🙃. With servers like that as secondaries, there's typically no way to make the serial number smaller, other than contacting the administrator of the server and asking them to purge all existing data for the zone 🗑️. Then the secondary needs to be loaded again from the primary, as if for the first time 🔄.
It's still safe to carry out the procedure above, since the malfunctioning servers need manual attention anyway 🛠️. After the sequence of serial number changes described above, conforming secondary servers will have been reset 💅. Then, once the primary server has the correct (desired) serial number, contact the remaining secondary servers and ask them to have their understanding of the correct serial number manually corrected 📝. You might also suggest they upgrade to a standards conforming implementation 🦋.
A server that does not implement this algorithm is defective, and you can detect it like this 🔍. At some stage, usually when the absolute integral value of the serial number becomes smaller, a server with this particular defect will ignore the change 🙈. To find these servers, wait at least the time specified in the SOA refresh field, then send a query for the SOA 📬. Servers with this defect will still have the old serial number 😤. We are not aware of other means to detect this defect 🤷♀️.
Security Considerations 🔐
It is not believed that anything in this document adds to any security issues that may exist with the DNS, nor does it do anything to lessen them 🫶.
Administrators should be aware, however, that compromise of a server for a domain can, in some situations, compromise the security of hosts in the domain 🚨😱. Care should be taken in choosing secondary servers so that this threat is minimised 🛡️💜.
References 📚
[RFC1034] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987
[RFC1631] Egevang, K., Francis, P., "The IP Network Address Translator (NAT)", RFC 1631, May 1994
[RFC1982] Elz, R., Bush, R., "Serial Number Arithmetic", RFC 1982, August 1996.
[RFC2181] Elz, R., Bush, R., "Clarifications to the DNS specification", RFC 2181, July 1997.
Acknowledgements 🎀
Brian Carpenter and Yakov Rekhter suggested mentioning NATs and ALGs as a companion to the firewall text 🧚. Dave Crocker suggested explicitly exploding the myth 💅.
Authors' Addresses 🦋
Robert Elz Computer Science University of Melbourne Parkville, Vic, 3052 Australia.
EMail: kre@munnari.OZ.AU
Randy Bush RGnet, Inc. 5147 Crystal Springs Drive NE Bainbridge Island, Washington, 98110 United States.
EMail: randy@psg.com
Scott Bradner Harvard University 1350 Mass Ave Cambridge, MA, 02138 United States.
EMail: sob@harvard.edu
Michael A. Patton 33 Blanchard Road Cambridge, MA, 02138 United States.
EMail: MAP@POBOX.COM
📦 where this page comes from
- ietf: rfc2182 1997-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms