Cloudflare DNS Secondary Servers can easily prevent outages which usually occur with single DNS servers. Bobcares, as part of our Server Management Service, responds to all your DNS inquiries, large or small.

Cloudflare Secondary DNS

Cloudflare secondary DNS is a replica of the primary DNS records on Cloudflare. The secondary DNS nameservers were specially built as a backup to the primary nameserver. So both of the DNS can serve the DNS records at all times. Thus decreasing the latency of DNS requests, distributing the load between DNS servers, and adding resiliency to the infrastructure.

The communication between a primary server and a secondary nameserver is possible by zone transfer. The transfer of DNS zones takes place unidirectionally from the primary DNS server to the secondary DNS server via secondary DNS. In order to keep track of any zone updates, a primary DNS server may have any number of secondary DNS servers with which it must communicate.

How Does Cloudflare Secondary DNS Works?

Several large businesses grow their DNS infrastructure. A managed DNS service is increasingly being used by users in place of two or three on-premise DNS servers or several DNS vendors. This will boost redundancy in case a DDoS attack manages to bring down one of their providers.

With more than 200 data centers spread around the world, all of which run the DNS software, Cloudflare’s DNS Servers customers may take advantage of DNS lookups that take on average just 11 milliseconds worldwide. Therefore, this is a good option for clients who want to utilize multiple DNS providers or who find it too difficult to abandon their on-premise DNS server.

Cloudflare initially implemented Secondary DNS using Mesos Marathon. The separation of each service into several different marathon apps also makes individual scaling of apps possible. All of these services live in Cloudflare’s core data centers.

1. Zone Transferer: The service in charge of attempting IXFR; if IXFR fails, it attempts AXFR.
2. Zone Transfer Scheduler: The service in charge of verifying zone SOA serials for modifications regularly.
3. Rest API: The service for registering new zones and primary nameservers.
4. Notify Listener: This service lies external to the cluster, in addition to marathon apps. The service listens for notifies from primary servers and tells the Zone Transferer to initiate an AXFR/IXFR.

The inter-service communication was through Apache Kafka. After the zone transferer finishes the AXFR/IXFR, the zone is then sent on to the zone builder before being pushed out to the edge at each of the 200 sites. Although this architecture performed great at first, it exposes numerous vulnerabilities and scalability problems later.

Now Cloudflare migrated all of the core data center services to Kubernetes, moving away from individually managed apps and Marathon clusters. The Marathon-based services and the NOTIFY Listener are now with Kubernetes.

Performance Of Cloudflare Secondary DNS

Cloudflare leads in global performance for Secondary DNS. Let’s see how well each component of the Cloudflare Secondary DNS performs.

• Primary Server to Notify Listener: Most accurate measurement is only precise to the second, but the UDP/TCP communication is likely much faster than that.
• NOTIFY to Zone Transferer: This is negligible.
• Zone Transferer to Primary Server: 99% of the time the average latency for a zone transfer is ~800ms.
• Zone Transferer to Zone Builder: It takes ~10ms to build a zone most of the time.
• Zone Builder to Quicksilver edge: 95% of the time, it takes less than 1s propagation.
• End to End latency: The approximate time is less than 5 seconds on average.

[Looking for a solution to another query? We are just a click away.]

Conclusion

Cloudflare Secondary DNS provides users with custom DNS solutions, be it on-premise or some other DNS provider. Additionally, it also allows users to take advantage of Cloudflare’s DNS performance, proxying, and security capabilities through Secondary Override. To conclude, our Support team explains briefly how the secondary DNS works along with analyzing its performance.