Dedicated DNS server: performance, security and control of your zones
Host your own DNS servers on a Kimsufi dedicated server: an authoritative DNS server for your domain names, a private resolver for your teams, or both. Unshared resources, full root access and Anti-DDoS protection included: you stay in control of every DNS zone, every record and every query.
What is a dedicated DNS server?
DNS (Domain Name System) is the directory of the Internet: it translates a domain name into an IP address. When you type an address into your browser, your computer sends a DNS query to a resolver. The resolver queries a root server, then the DNS server for the extension (.fr, .com…), then the authoritative DNS server for that domain, which returns the associated IP address. The browser can then connect to the site. This DNS resolution takes a few milliseconds, on every visit, every email sent, every API call: its speed and reliability determine how all your online services perform.
A dedicated DNS server lets you install and administer this service yourself, on a physical machine, instead of handing it over to your registrar or relying solely on a public DNS service. It is the choice of teams that want to:
- control every DNS zone and every record, without the limits of an interface;
- automate updates from their own tools (API, Ansible or Terraform, for example);
- use a private DNS for their servers, workstations or VPN, with their own filtering and privacy rules;
- store query logs in-house, rather than with a third-party provider.
The Kimsufi server is unmanaged: with root access, you choose the DNS software, then manage the configuration, updates and monitoring.
Why choose a Kimsufi dedicated server for your DNS?
Full control
With root access, you choose your operating system (Debian, Ubuntu, AlmaLinux…), your DNS software, your open ports, your firewall rules and the entire configuration.
Anti-DDoS included
DNS is a frequent target of denial-of-service attacks. Anti-DDoS protection is included with all Kimsufi offers, and our datacenters are ISO 27001 certified: a solid foundation for the security of your service.
Reserved resources
CPU, RAM and storage are not shared with anyone: your DNS cache stays in memory and resolution speed doesn't depend on a resource-hungry neighbor.
Geographic redundancy
Spread your DNS servers across several locations (France, Germany, United Kingdom, Poland, Canada, India, Singapore, Australia) to bring responses closer to your users and spread the risk.
Chargement du catalogue…
Authoritative DNS server or resolver: understanding the roles
Two families of DNS servers coexist, and they don't meet the same needs:
- The authoritative DNS server hosts a domain's DNS zone and its records: A (IPv4 address), AAAA (IPv6 address), MX (mail server), CNAME, TXT (SPF, DKIM, DMARC), NS and SOA. It answers queries from all over the world, but only for the domains assigned to it. Software used: BIND, PowerDNS Authoritative, Knot DNS, NSD.
- The resolver (or recursive DNS server) starts from the root and follows the chain until it finds the right server, then keeps the result in its DNS cache for the duration of the TTL. It serves the clients on your network: computers, servers, routers, connected devices. Software used: Unbound, Knot Resolver, PowerDNS Recursor, or Pi-hole and AdGuard Home to filter ads and malicious domains.
A public DNS service, such as Cloudflare, Google Public DNS or Quad9, is a resolver open to everyone: convenient, but every DNS query goes through a third party. A private DNS, on the other hand, only answers your own IP addresses: it also resolves your internal names and applies your privacy policy. Finally, a registrar's shared DNS hosts you among thousands of other customers, with only the options its interface provides.
Keep these two roles on separate services: a single piece of software acting as both a public authoritative server and an open recursive resolver complicates security and makes abuse easier.
How do you choose your dedicated DNS server?
DNS is a lightweight service: a response weighs a few hundred bytes. What matters is consistency, memory and proximity to your users. A few guidelines:
- Processor: a DNS server that publishes a few records needs little power. A heavily loaded recursive server, DNSSEC signing for many zones or advanced filtering benefit from multiple cores.
- Memory: RAM holds the DNS cache and, for many DNS software packages, all the loaded data. The more queries you serve, the more it matters: a larger cache avoids repeating the same lookups.
- Storage: an SSD is more than enough to store zone files, the PowerDNS database and logs.
- Network: connectivity ranges from 100 Mbps to 1 Gbps depending on the model, with unmetered traffic included. Here, latency to your users matters more than raw bandwidth.
- Location: choose datacenters close to your users, and at least two sites, so two distinct IP addresses, for your name servers.
For example, to host your own domains or run a private DNS for a team, the KS range offers an affordable starting point. For a recursive server serving many clients, a large volume of records or DNS hosting offered to your own customers, the SYS and RISE ranges provide more memory and power.
What is a dedicated DNS server?
It is a machine reserved for your use, on which you run your own DNS service: an authoritative DNS server for your domains, a private DNS for your networks, or both. You choose the software, the configuration and the security policy.
Do you need an authoritative server or a resolver?
The first publishes the DNS records of your domains to the entire Internet. The second finds the requested IP address for your own clients and keeps it in cache. To host your domains, you need a name server; to control DNS resolution for your teams, a private DNS.
How many DNS servers should you plan for?
At least two per domain, each with its own IP address, on different sites. Many registries require it, and it is what keeps your names resolving if a server becomes unavailable.
How do you fix a DNS server that isn't responding?
Check that the service is running and that port 53 is open over UDP and TCP, then query the server directly with dig, specifying its IP address. Check the zone syntax, the SOA serial number and the NS delegation at the registrar. On the user side, clear the system or browser DNS cache, for example.
What is the most reliable DNS?
For resolution, the major public DNS services (Cloudflare, Google, Quad9) are reliable, but they see your queries. Using a private DNS on your dedicated server keeps you in control of privacy. For your domains, reliability comes mainly from redundancy: several DNS servers, on several sites.
How do I enable DNSSEC on my dedicated DNS server?
Generate the keys (KSK and ZSK) with your DNS software, sign the zone, then publish the DS record at your registrar. PowerDNS, BIND and Knot DNS let you automate signing and key rollover.