Can I run both a primary and secondary DNS server using the same public IP?

Question

I need to set up a DNS server to manage the DNS for my domain name.

According to the guide I am following, I need to have both a Primary and Secondary DNS server. I easily created two VMs on my machine to accomplish this. Everything was going well when I came up with a realization in my head.

If I am running two servers, each serving DNS on port 53, how can I forward both servers to my single public IP address, while keeping everything on port 53?

It is my understanding that I must use port 53 for both servers, and also that you cannot "overlap" ports, or merge the traffic of the two ports into one.

I am not in the market to buy another IP from an ISP, so if this is not possible to do without getting another IP, I will just deal with it.

---

Important info on my network + situation:

I am doing this on my home network, and do not have access to ipv6. I have one physical server, but can create as many VMs as I want. High Availability is not a concern for me, as I have basically zero clients (save for myself) and can easily recover from an outage.

Answer 1

When it comes to primary and secondary DNS servers, from the viewpoint of any external entity it is actually irrelevant whether they run on a single machine, in separate VMs or on separate physical machines.

What is important - is that they need to run on separate IP addresses and even better - on separate independent networks, so that they have independent infrastructure.

This requirement helps to ensure that at least one DNS server will remain on-line even if an entire subnet of one of the servers goes down for any reason.

How to get a secondary DNS server if you only have one IP address:

You do not have to run both DNS servers yourself, or any DNS servers, actually, because many domain name registrar companies offer the DNS service for their customers.

By subscribing to this service you will have access to a Web based interface where you will be able to manage your DNS zones.

If you still prefer to run your own primary DNS server, then often you can subscribe to the "Secondary DNS server" service where the registrar will provide you with a secondary DNS server and you won't need to buy a separate IP address.

Ask your domain name registrar whether they provide this service.

Answer 2

The primary objective of having two separate DNS servers is so that if one goes down the other will remain up for those who are using it, not because (as one might be-- albeit potentially while half-asleep!-- falsely led to believe) there are two boxes to type DNS servers in, as is often the case, or for "verification", "confidentiality", some other strange concept forced by those who blindly believe in the Internet.

Given that you are running both daemons on one machine, this purpose is effectively NaN'd. However, you could still theoretically prevent your whole DNS system from going down by, say, a DoS attack by using both virtual machines. To completely implement this, you would most likely need to set up port forwarding from your router to both virtual IPs, but, as you speculate, this may get confusing for machines that are located outside of your local network.

Answer 3

Purely from a protocol perspective, you don't need 2 NS records at all for any delegation, including one from a TLD or GTLD like .com.

In practice, the majority of registration sites will require 2 DNS servers and IPs. They will each have their own 'error checking' to prevent you from entering the same name or IP twice.

If they do allow you to enter the same IP twice, I can see just one problem there.

• You probably can't and shouldn't have two NS records that are exactly the same. This might cause actual issues in DNS error checking.
• However, you can very easily just have 2 different NS records but both pointing to the same IP (glue records). That should be perfectly valid

Answer 4

It is highly unwise to run 2 nameservers from a single machine (and outside if spec for DNS) and it is likely not possible to do if you only have a single IP address and a registrar that requires it.

Its likely not worth the difficulty, but DNS supports the idea if slave servers, and has mechanisms for you to have the primary on your computer and secondary elsewhere (e.g. swap services with someone else).

Also - and again technically inadvisable - you could run a VPN with a static IP, do some source routing and address the technical requirements that way, or simply lie about the second server (i.e. point it at something you know will not answer). That will slow down some queries, but would work.

Answer 5

You can’t make two DNS servers reachable over a single IP since they both would use the same port (which is not configurable for the global DNS). But even if you could most registrars won’t accept two times the same ip (and some even don’t like two times the same network).

But what you can do is p, most registrars/Hosters provide you with a DNS, either fully hosted with a web front end or the option to have one or three of the provider servers as your secondaries (or even fake primary where you run a single-ip hidden primary).