What we do · Network
Authoritative DNS and reverse DNS, run as infrastructure
We operate our own authoritative DNS on PowerDNS, across two autonomous systems and two continents, with a hidden primary that never faces the public and a rule that every IP address we assign gets a reverse record. Your zones and ours are served from the same hardened estate.
What it is
Authoritative DNS answers the question "where does this name live" for your domains, and reverse DNS answers the opposite question for your addresses. We run both as core infrastructure, with the same redundancy, monitoring and change discipline as our routers.
How we build it
- A hidden primary. It replicates over an internal-only network to public secondaries in Athens, on different autonomous systems, and in Toronto, on separate virtualisation platforms as independent failure domains.
- dnsdist in front of every public server. PowerDNS listens only on localhost; dnsdist holds the public port and enforces the controls a generic load balancer cannot. ANY queries are refused, per-address query rates are capped, floods of failing lookups trigger automatic dynamic blocks, and a response-rate cap defeats amplification.
- DNSSEC without key shuffling. Signing keys replicate with the database, so every secondary signs identically with no separate key distribution to get wrong.
- Reverse DNS as a rule, not a request. Every address we assign to an interface, a service or a host gets a reverse record in the same session.
- Watched every ten minutes. An estate monitor checks replication health and lag, compares each zone's serial across every server, compares record counts, and confirms the hidden primary has never appeared in a public NS or SOA record.
What it protects you from
- Amplification and random-subdomain floods taking your nameservers down.
- A single site, platform or network failure making your domain unresolvable.
- A reverse DNS mismatch that gets your mail rejected or fails a compliance scan.
- A zone silently answering differently on different nameservers.
- Exposing the server that holds your master data to the internet.
In practice
A cutover proven before the registry change. When we moved a large set of zones onto this estate, the registry change waited for two complete verification rounds, separated by a cold reboot of every server, to prove the whole estate comes back clean on its own.
Why EuroVPS
- A hidden primary and public secondaries on separate networks and continents.
- dnsdist protection on every public server, built for DNS attacks rather than generic traffic.
- DNSSEC signing that is identical everywhere by design.
- A reverse record for every address, as a standing rule.
- Monitoring that checks the answers, not just whether the servers are up.
FAQ
Can you host my domain's DNS? Yes. Your zones are served from the same estate as our own, with DNSSEC available.
Can I have my own dedicated DNS cluster? Yes. We build dedicated PowerDNS clusters for customers who want their own, including geographically diverse ones. See managed DNS clusters.
Do you set reverse DNS for my addresses? Yes. Every address we assign gets a reverse record, and we set custom PTR names on request.
Can you move my DNS away from a cloud provider without downtime? Yes. We verify the new zone against the live one before anything changes, and stage DNSSEC moves so validation never breaks. Read how we helped a customer leave cloud DNS for a cluster of their own.
If you want DNS that is run as infrastructure, talk to an engineer.
Your next infrastructure partner
Let’s look at
your setup.
Tell us what you run today and what needs to improve. An engineer will review your brief and help you plan the next step.
+357 222 32280
who will look after your infrastructure.
Let’s start with your setup.
A little context helps us start the right conversation.