Clustering
Several nameservers that stay in sync.
With a cluster, a change made on any server is passed to all the others, so every nameserver gives the same answers and keeps answering when another one is down. Each node keeps its own database.
How the nodes keep in sync
Each node is configured with its own id and the addresses of its peers. Nodes prove themselves to each other with a shared secret, and the traffic between them is encrypted. A change on one node is sent to the others.
Setting it up
Clustering is turned on with environment variables on each DNS server, then a restart. The console’s cluster page shows the exact values for each node, so you do not have to work them out by hand.
- CLUSTER_NODE_ID: a different id on each node
- CLUSTER_SECRET: the same 32-character or longer secret on every node
- CLUSTER_PEERS: the other nodes’ API addresses
- API_BIND: the node’s private address, so the others can reach its API
Health and serials
The cluster page shows the state of each node. Zone serial numbers are kept per node and rise with every change, so a node that is behind is visible on the page.
Network requirements
Each node needs a network path to the API port of the others. Keep that port off the public internet: put the nodes on a private network or a VPN, or put TLS in front of the API.
Plan your nameservers
Start with one node, then add the others once the first is running and serving your zones.