• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Question Multiple Plesk servers to the same Slave DNS servers

Interesting still none the less... I will look into this as I am growing this ecosystem from 1 server, to more. Will also look into multiserver extension to see if that resolves this ...
 
We hope to be able to dig into the code eventually... but yeah it sure would be nice if Plesk would add it.
 
A temporary solution can be to export a list of all domains on all servers, consolidate the output en import them in the prohibited domain list on all Plesk servers.

 
We've added some code in a branch of our fork here that should resolve this problem. We hope to test it soon, but if anyone here gets to it sooner, even better! Warning: it is *not* tested. You only need to replace these files with the versions in that branch to try it:

- plib/library/Rndc.php
- plib/scripts/slave-dns.php

Notes:
- If the tests are successful we'll add a UI control to enable/disable it
- This will only function effectively if all servers are using proper external resolvers. If using localhost, it won't work as the local DNS server will not return live lookup results for the domain, which is important to have on the server that is *not* authoritative, but still hosting the domain.
 
We ourselves are using this principle of one (well two in fact, as we use three authoritative nameservers) slave server for many (50+ currently) master servers as well, so my 2¢ are:

You can do that easily and out of the box with PowerDNS and it's "Supermaster" feature.
PowerDNS does save/remember from which primary DNS it "learned" a zone from and will then receject updates for this zone from any other nameserver.

So you are completely safe from hijacking and only need to manually interfere (i.e. delete the zone from the secondary nameserver(s)) if you really wan't another/new primary to be authoritative for that domain.


p.s. this feature may only be available if you use a database backend for PowerDNS. (and not legacy bind zonefiles - which are also supported by PowerDNS)
 
@ChristophRo Thanks for that info! Great to know. Perhaps it's time to set up a PowerDNS secondary box or two.
So you are completely safe from hijacking and only need to manually interfere (i.e. delete the zone from the secondary nameserver(s)) if you really wan't another/new primary to be authoritative for that domain.
If you're using different name servers for each server, I take it this means when you migrate an account between servers, you need to then run a PowerDNS command to tell it to no longer restrict zone transfers for that domain (ie: so that the destination server can submit zone transfers to the PowerDNS secondary successfully)? What does that process look like?
 
just "pdnsutil delete-zone blaablaa.com" on the secondary(s) to delete/purge the zone

After that the secondary(s) will accept this zone again from any "master"
 
Back
Top