DNS secondary: who runs their own?

Hi all, sorry for the silly question but my DNS is currently with my registrar and I keep reading about secondary DNS for redundancy. Is this something a small site should worry about? I run a few wordpress shops on a cheap VPS at Contabo (https://contabo.com/en/vps/) and dont want things to break. Would running my own secondary help if the main goes down or is that overkill? I saw someone mention NSD and Knot but I dont even know what those are. Thanks for any advice, just trying to keep my shops online without becoming a sysadmin.

I run a three-node NSD cluster across OVHcloud, Vultr, and a home lab behind a reverse proxy. Docker Compose makes it trivial:

services:
  nsd:
    image: nlnetlabs/nsd
    volumes:
      - ./nsd.conf:/etc/nsd/nsd.conf

The key is NOTIFY from your primary and AXFR allowed only from your secondaries. I did this on a $3/month NAT VPS fleet and its been rock solid for two years. You already run a VPS, so the incremental cost is zero. Just add a docker-compose.yml and youre done.

Anyway I tried running knot on a RackNerd 512mb vps at 3am because idk why I do this

server:
    rundir: "/run/knot"
    user: knot:knot

It ate 180mb resident just for the daemon

Switched to nsd, 12mb. The zone parser is worse though. Had to sed my bind file into submission. Works now. Idk why I do this.

For what it's worth, secondary DNS architecture has minimal direct impact on email deliverability, but OP should be aware: if your secondary is misconfigured and starts accepting mail due to MX pointing at it, you can end up with SPF failures from transient issues. Hot take: most small shops should verify their registrar supports NOTIFY and TSIG before self-hosting anything. A broken secondary that serves stale zones is worse than a single reliable authoritative server. Your SPF/DKIM/DMARC stack depends on consistent DNS resolution more than it depends on redundancy at your scale.

What could go wrong? Let me list it:

• AXFR leaks your full zone to anyone who asks without TSIG
• Open resolvers get abused for amplification attacks
• Your NOTIFY port exposed to the internet
• Zone transfers over plaintext between providers

I run secondaries but every node has fail2ban on 53/tcp, 53/udp, and a strict firewall allowing AXFR only from known secondaries! Also consider running DNSSEC or youre trusting the chain. I dont even trust my own network

Cost me under $8/year total. It actually works!

launch=gsqlite3
gsqlite3-database=/var/lib/powerdns/pdns.db

The anycast bit is the tricky part. I use BGP sessions to a small HostHatch VM that announces my /24. Not production-grade but for my personal infra its been solid. The PowerDNS API makes updating records from my home automation trivial.

I moved my whole anycast setup to three Ampere Altra instances at InterServer and the difference is insane value! Each node runs NSD and BIRD for BGP announcements. Runs circles around my old x86 fleet at half the wattage.

Specs per node:

• 2 vCPU Ampere Altra
• 4GB RAM
• 200GB NVMe
• $6/month

The ARM ecosystem for DNS is underrated. Low memory footprint, high packet throughput. I was pushing 80k qps during a stress test. I used https://www.interserver.net/vps/ for the nodes.

2 vCPU and 4GB for $6? InterServer never lists Ampere that cheap

Has anyone actually tested failover with registrar DNS versus rolling their own secondary?

Most registrars let you add nameservers from different providers already. Point NS1 at your registrar, NS2 at a free secondary service, and you get redundancy without running anything. The tricky part is your registrar needs to allow custom glue records for that to work cleanly.

I ran NSD on a Pi for a year before realising the TTL on my zones meant clients would cache failures longer than any outage anyway. For a shop doing real revenue maybe it matters, but for most sites the registrar staying up is the least of your worries.

Actually that was me misreading the InterServer small print, ignore that. Different region.

Back on topic though,

For a wordpress shop the real question is what "goes down" means. If your VPS dies, secondary DNS just means people still resolve your domain to the dead IP. You'd need failover at the application layer too, which is a whole other project.

If the registrar's DNS goes down that's different, but when did that last happen to you.