Creating a cloudflare fallback server

phper

4/25/24, 11:24 AM

I would like to create a fallback DNS server for my cloudflare account.
It accord to me that I have over 70 domains hosted by CloudFlare and my entire business relays on a mostly free service, It has happen before that CloudFlare was down.
I would like to have a backup plan for such an event.
I thought I can simply add a 3rd DNS server to my NS records on each domain like this

foo.ns.cloudflare.com
bar.ns.cloudflare.com
ns.mydoamin.com

My first question is, will this work as expected (if cloudflare does not respond, the browser will query ns.mydomain.com).

My second question is how?
I thought I might find a docker that pulls my CloudFlare zones VIA API and updated a local bind9 or similar, But I could not find such a docker does it exist?
If not I can manage exporting the records myself via the API, but how should I setup my server, all tutorials I can find are for internal networks as a recursive server, I think I would need to configure a authoritative server.

Thank you for any information.

1 + 0

domain-name-system

dns-hosting

cloudflare

Score:1

Server

Patrick Mevzek

4/25/24, 2:46 PM

My first question is, will this work as expected

No. You can't use multiple DNS providers together by just putting the union of NS records in your zone and all nameservers at registry and hope it works.

All providers concerned need to cooperate to make sure to serve the exact same zone in the exact same way. Which most of the time means either an hidden primary distribution nameserver that feeds both providers, or one provider fetching zone from the other one (which case lessens tremendously the usefulness of having multiple providers).

If you do throw DNSSEC into the mix, then providers cooperation is absolutely mandatory if you hope your domain to resolve properly.

So, instead of trying things in random, you should first start by approaching any single DNS provider and ask it what solution does it have for a multi-provider setup, either hot/hot or hot/cold scenario and things like that.

I thought I might find a docker that pulls my CloudFlare zones VIA API and updated a local bind9 or similar

That seems the second scenario and seriously lowers the interest of the setup. Why do you think this is useful or more important what kind of problems you think you are solving with this? Is it maybe "oh Cloudflare might have DDOS and hence me having a backup nameserver will help"? If so, and if Cloudflare has a DDOS you really think your lone nameserver will be able to handle the load too? I doubt it.

I think I would need to configure a authoritative server.

If you are at this level of questioning, and hence not yet fully understanding the difference between a recursive and authoritative nameserver, I strongly recommend, even if you won't like that answer, to just stay off DNS for now. Use any decent DNS provider for your important production zones, WHILE you can on your side play with other non important zones, set up things on your local network, debug things, try options, etc. After which you should get a better understanding on how DNS work and then maybe work towards more advanced scenario.

In the meantime your efforts should be more spent towards basic securing like:

testing your zones with DNSViz online and making sure you have no warnings
enabling DNSSEC on your zones and making sure all cases are accounted for (keys rotation, etc.).

+ 2

phper

4/27/24, 6:33 AM

Thank you for your much appreciated and detailed response, I do use DNSSEC on most of my domains (a few the register does not support it), I did not think of that. If I replicate the exact settings via the api (including DNSSEC keys) would't that be good? also thank you for pointing me to DNSViz, it's seems like a very good tool

Patrick Mevzek

4/27/24, 7:46 PM

"If I replicate the exact settings via the api (including DNSSEC keys) would't that be good?". No, absolutely not. RRSIG records in DNSSEC can be fully dynamic and computed at query time, hence you can't replicate them. Cloudflare also use DNSSEC lies for full dynamic DNSSEC, so no, don't attempt to "copy" their content and use 2 DNS providers like that. Guaranteed problems. Contact them and express your needs and see what they can offer, if anything, as proper multi-provider solution (very few providers do that, for obvious complexity reasons, so expect to pay a premium for that)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Creating a cloudflare fallback server

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.