DNS
Status: active Last verified: 2026-07-20 (against the current DNS service and resolver host records) Scope: public resolver architecture and policy; changing counts remain approximate
Purpose
Network-wide recursive DNS with DNSSEC validation, authoritative zones for home.arpa, and ad-blocking.
Current Shape
| Server | Role | Host | OS | Container |
|---|---|---|---|---|
| ns1 | Primary resolver + authoritative | Proxmox host A | Debian 12 | LXC |
| ns2 | Secondary resolver + authoritative | Proxmox host B | Debian 12 | LXC |
| Feature | Detail |
|---|---|
| Resolver | Unbound (pure recursive) |
| DNSSEC | Validation enabled |
| Authoritative | home.arpa zone |
| Ad-blocking | OISD Big + StevenBlack (~395K domains) |
| DoH blocking | DNS-over-HTTPS bypass attempts blocked |
| Access control | RFC 1918 + localhost only |
| Cache priming | 3x/day + hourly dynamic list (ns2) |
| Config | Ansible-managed |
Migration
Both servers migrated from VMs to unprivileged LXC containers in April 2026 for reduced overhead and faster startup (1-2 seconds vs 15-30 seconds). Old VMs decommissioned after confirmation.
Backup
Protected by Proxmox Backup Server with daily snapshots and a same-rack secondary copy.
Constraints
- Config is Ansible-managed; local changes are overwritten
- RFC 7706 local root zone mirror configured
pam_systemdworkaround required (unprivileged LXC limitation)
Drift / Unknowns
- Exact blocklist count fluctuates with daily updates
- Cache priming schedule may have drifted since last verification