# DNS

> DNS resolution, authoritative zones, and ad-blocking via Unbound on a redundant pair of LXC containers.

Status: active · Kind: snapshot · Last verified: 2026-07-20 · Date: 2025-12-01

> Status: active
> Last verified: 2026-07-20 (against the current DNS service and resolver host records)
> Scope: public resolver architecture and policy; changing counts remain approximate

## Purpose

Network-wide recursive DNS with DNSSEC validation, authoritative zones for `home.arpa`, and ad-blocking.

## Current Shape

| Server | Role | Host | OS | Container |
|--------|------|------|----|-----------|
| ns1 | Primary resolver + authoritative | Proxmox host A | Debian 12 | LXC |
| ns2 | Secondary resolver + authoritative | Proxmox host B | Debian 12 | LXC |

| Feature | Detail |
|---------|--------|
| Resolver | Unbound (pure recursive) |
| DNSSEC | Validation enabled |
| Authoritative | home.arpa zone |
| Ad-blocking | OISD Big + StevenBlack (~395K domains) |
| DoH blocking | DNS-over-HTTPS bypass attempts blocked |
| Access control | RFC 1918 + localhost only |
| Cache priming | 3x/day + hourly dynamic list (ns2) |
| Config | Ansible-managed |

## Migration

Both servers migrated from VMs to unprivileged LXC containers in April 2026 for reduced overhead and faster startup (1-2 seconds vs 15-30 seconds). Old VMs decommissioned after confirmation.

## Backup

Protected by Proxmox Backup Server with daily snapshots and a same-rack secondary copy.

## Constraints

- Config is Ansible-managed; local changes are overwritten
- RFC 7706 local root zone mirror configured
- `pam_systemd` workaround required (unprivileged LXC limitation)

## Drift / Unknowns

- Exact blocklist count fluctuates with daily updates
- Cache priming schedule may have drifted since last verification