I have a PowerDNS server where I'm trying to create NS records. That is what I have for domain example.com:

cluster                 NS          node1.cluster.example.com
cluster                 NS          node2.cluster.example.com
node1.cluster           A 
node2.cluster           A  and are external name servers.

What I want is:

  • dig cluster.example.com
  • Have my DNS request transferred to one of node1 or node2
  • Have DNS request resolved there

What I have:

  • dig cluster.example.com

    ;cluster.example.com.   IN  A
    cluster.example.com.    3600 IN NS  node2.cluster.example.com.
    cluster.example.com.    3600 IN NS  node1.cluster.example.com.
    node2.cluster.example.com. 3600 IN A
    node1.cluster.example.com. 3600 IN A

I get no answer from dig.

Though dig cluster.example.com @ works fine.

I have no much comptence at DNS, so the help is really appreciated.

  • Start by providing the true domain name involved, there is no need to obfuscate it. – Patrick Mevzek May 24 '17 at 22:56

If you are inventing syntax, it won't work.

What comes before the NS is the domain name; if you do not put there, it defaults to the current one e.g. example.com. .

As per the DNS default behaviour, it adds the current domain name to the object (e.g. cluster), and it becomes cluster.example.com. which is not defined.

If you want to define a DNS based-cluster, it would be:

                  NS          cluster.example.com.

cluster           A 
cluster           A 

or to further illustrate my comments:

example.com.      NS          cluster.example.com.

cluster           A 
cluster           A 

Please note I have defined cluster intentionally for both hosts, and have not used node1 and node2, as NS records should not point to a CNAME.

From In DNS can an IN NS point to a CNAME?

Having NS records pointing to a CNAME is bad and may conflict badly with current BIND servers. In fact, current BIND implementations will ignore such records, possibly leading to a lame delegation. There is a certain amount of security checking done in BIND to prevent spoofing DNS NS records. Also, older BIND servers reportedly will get caught in an infinite query loop trying to figure out the address for the aliased nameserver, causing a continuous stream of DNS requests to be sent.

Or if you still want to have node1 and node2 names:

example.com.      NS          cluster.example.com.

cluster           A 
cluster           A 
node1             A 
node2             A 

As a side note: there are implications on using DNS-based clustering methods, in which often the desired results when one of the nodes are down could not be the intended because it will be the clients choosing the node which they want to talk.

There are also more advanced (and more reliable) methods for creating DNS clusters, namely DNS anycast, which are out of the scope of this answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.