What we do · Platforms
Authoritative and recursive DNS on PowerDNS
We build and run PowerDNS clusters that answer for your domains from separate sites on separate networks, with the master copy of your zones hidden where the internet can never reach it. For your servers, we run validating resolvers that answer fast and refuse forged answers.
What it is
Two services, sold together or apart.
Authoritative DNS. Your zones served by your own cluster, or hosted on ours: a hidden primary that holds the truth and a set of public secondaries in different datacenters, on different networks, on different continents if you want them. DNSSEC signing, a web interface for your team, and an API for your automation.
Recursive DNS. Validating resolvers for the servers and networks we run for you, so every lookup your applications make is answered nearby and checked against DNSSEC.
How we build it
The primary never answers the internet. It has no public address and never appears in your nameserver records. It is where your team and your automation make changes, and it replicates those changes privately to the secondaries.
The secondaries carry the load. We place them in separate failure domains: different datacenters, different networks, different virtualisation platforms.
Nothing talks to PowerDNS directly. On every public box, dnsdist faces the internet and PowerDNS listens only on the machine itself. dnsdist is built for DNS: it refuses the query types used for amplification, refuses questions about domains we do not serve before they reach the backend, limits the bytes it will send to any one address, and blocks random subdomain and error floods automatically, with no human in the loop. It health checks the backend with a real query, so a broken database is taken out of service instead of being answered from.
The firewall is built for DNS too. Authoritative traffic is handled statelessly, so a query flood cannot fill a firewall's state table and take everything else down with it.
Cutovers are rehearsed. Before the registry changes, every server in the new cluster is rebooted to prove it comes back on its own, and the DNSSEC handover is sequenced so validating resolvers keep trusting the domain throughout.
Resolvers validate, and we prove it. Our resolvers check DNSSEC on every answer, and we test them against a domain that is deliberately signed wrong. If that domain ever resolves, validation is off and we know about it.
What it protects you from
- Paying a cloud provider per query and per zone, forever, for a service you can own.
- A single DNS host, or a single provider, being the reason your whole company is unreachable.
- Your nameservers being used to amplify attacks against someone else.
- Random subdomain floods that exhaust a DNS backend.
- A firewall state table filled by a query flood.
- Forged answers reaching your applications through a resolver that does not validate.
In practice
A customer came to us with every one of their zones on AWS Route53 and a monthly bill that grew with every query. We built them a geographically diverse PowerDNS cluster of their own: a hidden primary on a private network, filtered public secondaries in Athens and in Toronto on separate networks, each behind dnsdist. We carried the zones across, compared every record against Route53 until the only differences were the ones we intended, sequenced the DNSSEC handover at the registry so validating resolvers kept trusting the domain throughout, rebooted every server to prove the cluster came back on its own, and only then moved the nameservers. The customer now owns the cluster outright and saves a great deal of money every month.
Why EuroVPS
- A hidden primary and filtered secondaries as the standard design, not an upgrade.
- dnsdist in front of every public server, with automatic flood protection.
- Secondaries in separate datacenters on separate networks, across continents if you want them.
- Resolvers that validate DNSSEC, tested against a broken domain on purpose.
FAQ
Can we keep using DNSSEC? Yes. We sign your zones and handle the handover at your registry in the right order, so validating resolvers keep trusting your domain during a migration.
Can our tools still change records automatically? Yes. PowerDNS has a full API, and there is a web interface for people who prefer one.
Do we get our own cluster or space on yours? Either. We can host your zones on our estate, or build a cluster that belongs to you alone.
How long does a move from Route53 or another provider take? The build and verification take days, not months. The registry change itself is a moment, done only after the new cluster has passed every check.
Can you run resolvers for our servers? Yes, for servers and networks we operate for you, with DNSSEC validation on.
Own the first lookup your customers make. Talk to an engineer.
Your next infrastructure partner
Let’s look at
your setup.
Tell us what you run today and what needs to improve. An engineer will review your brief and help you plan the next step.
+357 222 32280
who will look after your infrastructure.
Let’s start with your setup.
A little context helps us start the right conversation.