Cluster Domain

[IngmarStein]

Hi,

I've been running Technitium DNS on my homelab for a while and now want to use clustering so that rebooting the homelab for updates doesn't cause a DNS outage for the local network.

The web UI is currently accessible as dns.example.com with a valid TLS certificate and I use this for remote administration through a Cloudflare tunnel. The "DNS Server Domain" setting is therefore also set to dns.example.com.

I've set up a forwarder zone for example.com to implement split horizon for local services (see #1065).

Looking a the clustering documentation, I can see some problems:

• I can't use example.com as the cluster domain because that would create a primary zone for example.com, right? Or can this work with the existing forwarder zone as well?
• If I can't use example.com, I'd have to use a dummy domain like dns.internal, but that would change the web UI to use a self-signed certificate so that the HTTPS communication between the cluster nodes works, right? If I'm not mistaken, this would break the dns.example.com use case.

[ShreyasZare]

Thanks for asking.

I can't use example.com as the cluster domain because that would create a primary zone for example.com, right? Or can this work with the existing forwarder zone as well?

Yes, the clustering requires a primary zone which will be DNSSEC signed too. Using forwarder zone is thus not possible.

If I can't use example.com, I'd have to use a dummy domain like dns.internal, but that would change the web UI to use a self-signed certificate so that the HTTPS communication between the cluster nodes works, right? If I'm not mistaken, this would break the dns.example.com use case.

You can use something like dns.<any-subdomain>.example.com (e.g. dns.cluster.example.com), and configure valid TLS certificates. The DNS Server Domain name would change but you still will be using public domain name with a proper TLS certificate. While your existing example.com forwarder zone will stay as-is.

[IngmarStein]

Ah, that's a good idea!

So just to clarify, I could get a certificate with alternate names *.cluster.example.com and dns.example.com, use cluster.example.com as the cluster domain, and the DNS Server Domain name would become something like dns1.cluster.example.com?
The HTTP service doesn't check the host header and would be reachable under both dns.example.com and dns1.cluster.example.com?

[IngmarStein]

So I went ahead with that and everything is working as expected. Thank you, once again, @ShreyasZare!

[ShreyasZare]

You're welcome. Good to know it worked out.

[IngmarStein]

I think I'm running into a small issue after all: failed NOTIFY messages.

The primary's log contains:

[2026-02-08 00:07:09 Local] DNS Server failed to notify name server 'xxxx:xxxx:xxxx::119' (RCODE=Refused) for zone: private.example.com

The secondary has this:

[2026-02-07 23:07:09 UTC] [192.168.1.10:50205] [UDP] DNS Server received a NOTIFY request for secondary zone: cluster-catalog.cluster.example.com
[2026-02-07 23:07:09 UTC] [[xxxx:xxxx:xxxx:0:xxxx:xxxx:xxxx:xxxx]:50898] [UDP] DNS Server refused a NOTIFY request since the request IP address was not recognized by the secondary zone: cluster-catalog.cluster.example.com

Each cluster node is configured with static IPv4 and IPv6 addresses. The static IPv6 addresses look like xxxx:xxxx:xxxx::119, but the address picked for the outgoing UDP packet was a different one assigned to the host (a temporary one). Is there a way to configure which will be used? The temporary privacy addresses can change over time, so I'd rather avoid adding them somewhere. Or can I manually change an ACL to allow NOTIFYs from the whole subnet?

[ShreyasZare]

Ya, this issue comes with IPv6. You can fix that by using the "Notify Allowed Networks" in Setting > General section to allow /64 network.

The other option is to use "DNS Server IPv6 Source Addresses" to set the static IPv6 address as the source address for all outbound requests. This will cause the DNS server to use the specified address for all outbound requests and thus fix the issue you see with notify.