How do I setup stealth DNS on an Ecessa device?
Stealth DNS allows the Ecessa appliance to manage inbound redundancy while having an external DNS hosting service handle DNS requests. The following diagram illustrates the example networks for this article.
The Ecessa appliance will be configured as a DNS server and will behave as a hidden master. The secondary server(s) will behave as a slave and will answer DNS requests based on the provided zone data from the master. This configuration allows the DNS servers to receive updated zone information based on the Ecessa’s WAN monitoring and dynamic updating of DNS records.
The Ecessa appliance will only listen for DNS traffic on the IP addresses configured as name server addresses. In this scenario, the ecessa.test domain will not include the Ecessa’s WAN IP addresses as name servers so another domain stealth.local is created. Inside this domain, the Ecessa’s WAN IP addresses are set as name servers which will cause the Ecessa to listen for DNS traffic on the configured addresses. This step is important as zone transfers will not work properly otherwise.
Setting Authoritative DNS Servers – Typically, if the Ecessa appliance has DNS configured, it is set as the authority for the domain. In a stealth DNS configuration, the Ecessa appliance will not be configured as an authority (the secondary server(s) will be) nor will it be included as a name server for the domain.
The following diagram shows how stealth DNS configuration handles the process of DNS resolution.
1. The client machine wants to resolve www.ecessa.test so the request is sent to the root DNS servers and follow the lines of authority.
2. The client receives a list of DNS servers responsible for the domain ecessa.test.
3. The request is then sent to one of the authoritative servers for resolution.
4. The given response is based on the zone data provided by the Ecessa (the request is never sent to the Ecessa appliance directly).
5. Once the client receives the appropriate IP address(es) for the host name it can establish a connection to the web server.
Click on Configure for the domain to update. Confirm that the “Enable zone transfers to” setting is enabled and the text field has the appropriate IP address(es) for the backup DNS server (s). Click the Activate button to save the changes.
The secondary DNS servers should receive a zone transfer for each of the configured domains and will answer accordingly. The Refresh value in the SOA Record section will determine how frequently the zone will be transferred. The default Refresh value is set to 360 seconds which may be reduced to minimize potential downtime and expedite the propagation of changes.
ecessa.test. 900 IN NS ns1.dnshost.test.
If one of the WAN lines is not available, the Ecessa appliance will update the affected DNS records. Once the Refresh expires, the secondary DNS server will request another zone transfer at which point the server will begin answering requests with the updated information.