Self-hosted DNS: migrating 30+ zones to PowerDNS
Moved every zone off Cloudflare to a self-hosted PowerDNS with NS pools and authoritative edge nodes worldwide.
Challenge. Move away from dependence on an external DNS provider toward self-managed infrastructure — with control, resilience, and separation by jurisdiction.
Approach. A hidden PowerDNS primary plus a network of authoritative edge nodes (NSD), scheduled zone sync, and Ansible automation. Every zone is reconciled against its source before delegation is switched, so nothing gets lost.
Solution. Two nameserver pools — an RU pool for .ru domains and a foreign one for the rest — automatic wildcard certificate issuance via DNS-01, and certificate distribution to the edge through a control node. Unstable links are bypassed via jump hosts.
Result. 30+ zones migrated with zero downtime, a self-hosted resilient DNS network, automatic certificates, and full control over the zones instead of a third-party dashboard.