NS Redundancy

# Check current nameservers
dig yourdomain.com NS
nslookup -type=NS yourdomain.com

# Check from registrar
whois yourdomain.com | grep -i "name server"

# Verify all nameservers respond
for ns in $(dig +short yourdomain.com NS); do
  echo "Testing $ns:"
  dig @$ns yourdomain.com SOA
done

# Minimum configuration (2 nameservers)
ns1.yourdnshost.com
ns2.yourdnshost.com

# Recommended configuration (3-4 nameservers)
ns1.yourdnshost.com
ns2.yourdnshost.com
ns3.yourdnshost.com
ns4.yourdnshost.com

# Best practice: Use different providers/networks
ns1.provider1.com
ns2.provider1.com
ns3.provider2.com
ns4.provider2.com

# Test each nameserver individually
dig @ns1.yourdnshost.com yourdomain.com A
dig @ns2.yourdnshost.com yourdomain.com A
dig @ns3.yourdnshost.com yourdomain.com A
dig @ns4.yourdnshost.com yourdomain.com A

# Verify DNS propagation globally
nslookup yourdomain.com 8.8.8.8
nslookup yourdomain.com 208.67.222.222

# BIND primary nameserver configuration (ns1.example.com)
zone "example.com" {
    type master;
    file "/var/named/example.com.zone";
    
    # Allow zone transfers only to authorized secondaries
    allow-transfer { 
        192.0.2.20;    # ns2.example.com
        192.0.2.30;    # ns3.example.com  
        192.0.2.40;    # ns4.example.com
        2001:db8::20;  # ns2 IPv6
        2001:db8::30;  # ns3 IPv6
        2001:db8::40;  # ns4 IPv6
    };
};

    # Notify secondary servers of updates
    also-notify {
        192.0.2.20;    # ns2.example.com
        192.0.2.30;    # ns3.example.com
        192.0.2.40;    # ns4.example.com
    };
    
    # TSIG authentication for secure transfers
    transfer-source 192.0.2.10;
    notify-source 192.0.2.10;

# BIND secondary nameserver configuration (ns2.example.com)
zone "example.com" {
    type slave;
    file "slaves/example.com.zone";
    masters { 192.0.2.10; };           # Primary nameserver
    transfer-source 192.0.2.20;        # Source IP for transfers
    max-transfer-time-in 60;           # Transfer timeout
    max-retry-time 300;                # Retry interval
};

#!/bin/bash
# DNS nameserver monitoring script - run every 5 minutes via cron

DOMAIN="example.com"
NAMESERVERS=("ns1.example.com" "ns2.example.com" "ns3.example.com" "ns4.example.com")
LOG_FILE="/var/log/dns-monitor.log"
ALERT_EMAIL="admin@example.com"

for NS in "${NAMESERVERS[@]}"; do
    echo "$(date): Testing $NS" >> $LOG_FILE
    
    # Test basic A record resolution
    if dig +timeout=10 @$NS $DOMAIN A | grep -q "NOERROR"; then
        echo "$(date): $NS - A record: OK" >> $LOG_FILE
    else
        echo "$(date): $NS - A record: FAILED" >> $LOG_FILE
        echo "ALERT: $NS failed A record test" | mail -s "DNS Alert: $NS Down" $ALERT_EMAIL
    fi

    # Test SOA record for zone authority
    if dig +timeout=10 @$NS $DOMAIN SOA | grep -q "NOERROR"; then
        echo "$(date): $NS - SOA record: OK" >> $LOG_FILE
    else
        echo "$(date): $NS - SOA record: FAILED" >> $LOG_FILE
        echo "ALERT: $NS failed SOA test" | mail -s "DNS Alert: $NS SOA Failure" $ALERT_EMAIL
    fi

    # Test response time (should be under 500ms)
    RESPONSE_TIME=$(dig +time=1 @$NS $DOMAIN A | grep "Query time:" | awk '{print $4}')
    if [ "$RESPONSE_TIME" -gt 500 ]; then
        echo "$(date): $NS - Slow response: ${RESPONSE_TIME}ms" >> $LOG_FILE
        echo "ALERT: $NS slow response time: ${RESPONSE_TIME}ms" | mail -s "DNS Alert: $NS Slow" $ALERT_EMAIL
    fi
done

# PowerDNS with backend database failover configuration
-- Create nameserver status tracking table
CREATE TABLE nameserver_status (
    id SERIAL PRIMARY KEY,
    nameserver VARCHAR(255) NOT NULL,
    ip_address INET NOT NULL,
    status VARCHAR(50) DEFAULT 'active',
    last_check TIMESTAMP DEFAULT NOW(),
    response_time INTEGER DEFAULT 0,
    failure_count INTEGER DEFAULT 0
);

-- Populate with nameserver information
INSERT INTO nameserver_status (nameserver, ip_address) VALUES
('ns1.example.com', '192.0.2.10'),
('ns2.example.com', '192.0.2.20'),
('ns3.example.com', '192.0.2.30'),
('ns4.example.com', '192.0.2.40');

-- Automated failover trigger function
CREATE OR REPLACE FUNCTION update_ns_records()
RETURNS trigger AS $
BEGIN
    -- If nameserver fails, remove from parent zone
    IF NEW.status = 'failed' AND OLD.status = 'active' THEN
        DELETE FROM records 
        WHERE name = 'example.com' 
        AND type = 'NS' 
        AND content = NEW.nameserver;
        
        -- Log the failover action
        INSERT INTO log_entries (action, nameserver, timestamp) 
        VALUES ('FAILOVER_REMOVE', NEW.nameserver, NOW());
    END IF;
    
    -- If nameserver recovers, re-add to parent zone
    IF NEW.status = 'active' AND OLD.status = 'failed' THEN
        INSERT INTO records (domain_id, name, type, content, ttl) 
        VALUES (1, 'example.com', 'NS', NEW.nameserver, 300);
        
        -- Log the recovery action
        INSERT INTO log_entries (action, nameserver, timestamp) 
        VALUES ('FAILOVER_RESTORE', NEW.nameserver, NOW());
    END IF;
    
    RETURN NEW;
END;
$ LANGUAGE plpgsql;

-- Create trigger for automated failover
CREATE TRIGGER nameserver_failover_trigger
    AFTER UPDATE ON nameserver_status
    FOR EACH ROW
    EXECUTE FUNCTION update_ns_records();