Using DNScale as Your Secondary DNS Provider

Your DNS is the front door to every service you run. If your only authoritative DNS provider goes down, your domains can go dark — websites, APIs, email, everything. Adding a secondary DNS provider gives resolvers another authoritative network to query when one provider is unreachable.

DNScale works as a primary authoritative DNS provider and as an API/IaC-driven control plane for multi-provider DNS. This guide covers how to prepare DNScale alongside your existing DNS provider for redundancy where parent delegation can include DNScale.

Why You Need a Secondary DNS Provider

A single DNS provider is a single point of failure. Provider outages happen more often than most teams expect:

• DDoS attacks can overwhelm even large providers, making your zones unreachable
• Software bugs or misconfigured deployments can take an entire provider offline
• Network issues at a single provider can leave entire regions unable to resolve your domains

With a secondary DNS provider, resolvers worldwide have an alternative set of nameservers to query. If one provider is down, many resolvers will retry another listed nameserver and continue getting answers, though users may still see timeouts during retries or where caches and networks behave differently. For a deeper look at the threat landscape, see DNS Attacks and Threats.

Adding a secondary DNS provider is one of the most useful resilience measures for production domains, provided record synchronization, DNSSEC, monitoring, and registrar controls are also handled carefully.

How DNScale Works for Multi-Provider DNS

Traditional secondary DNS relies on zone transfers — the secondary server pulls zone data from the primary using AXFR or IXFR protocols, authenticated with TSIG keys. This approach works but has limitations: both providers must support zone transfers, firewall rules must allow the transfer traffic, and synchronization is pull-based with inherent delays.

DNScale takes a different approach: API-based synchronization using infrastructure-as-code tools like Terraform or DNSControl, plus provider snapshots for review and drift detection. You define your DNS records once in a declarative configuration file and push reviewed state to the providers you intend to serve.

This has several advantages over traditional zone transfers:

• Works with API/IaC sources — no need for AXFR/IXFR support or TSIG key negotiation for snapshots, exports, and reviewed sync plans
• Push-based, not pull-based — changes are sent when you deploy, then depend on provider replication and resolver caching
• CI/CD native — fits into existing deployment pipelines with drift detection
• Version controlled — your DNS records live in Git alongside your infrastructure code
• Provider-agnostic — switch or add providers by changing a config file, not reconfiguring zone transfers

For background on how traditional secondary DNS works, see What Is Secondary DNS and Primary DNS vs Secondary DNS.

Cloudflare full-setup zones on Free/Pro plans can be inventoried through the Cloudflare API, but DNScale cannot be live authoritative backup DNS while Cloudflare remains the only delegated nameserver provider. To get live multi-provider authoritative redundancy, the parent delegation must include DNScale or another non-Cloudflare authoritative provider.

DNScale's Anycast Architecture

When you add DNScale as an additional delegated provider, your domains benefit from its globally distributed anycast network:

• Multiple Points of Presence across Europe, North America, Asia-Pacific, Latin America, and Africa
• Dual autonomous systems — separate EU and Global networks with independent BGP routing, so a failure in one network doesn't affect the other
• Routing-level failover — BGP route withdrawal can move traffic away from a failed node, with convergence depending on upstream routing
• DDoS dilution — attack traffic can be spread across multiple anycast nodes rather than concentrated on a single server

DNScale's Global DNS Resolution Balancing is designed to answer queries from a nearby available node according to BGP and network policy. You can see real-time performance data from RIPE Atlas probes on the network performance page.

This means adding DNScale as an additional delegated provider can add redundancy and improve performance for some resolvers. Users in regions where your existing provider has limited coverage may get faster DNS resolution through DNScale's distributed points of presence.

Preparing DNScale as an Additional Provider

There are three ways to keep DNScale in sync with your source of truth or another provider:

Option 1: Terraform

Define your zones and records in Terraform, targeting both your source provider and DNScale:

# DNScale provider
resource "dnscale_record" "www" {
  zone_id = dnscale_zone.example.id
  name    = "www"
  type    = "A"
  content = "203.0.113.10"
  ttl     = 300
}
 
# Your other provider (for example, Route 53, Hetzner, or Cloudflare where delegation and setup mode allow it)
resource "cloudflare_record" "www" {
  zone_id = var.cloudflare_zone_id
  name    = "www"
  type    = "A"
  content = "203.0.113.10"
  ttl     = 300
}

Run terraform apply and both providers are updated simultaneously. See the full walkthrough in Multi-Provider DNS with Terraform & DNSControl.

Option 2: DNSControl

DNSControl is purpose-built for multi-provider DNS. Define records once and push to multiple providers:

D("example.com", REG_NONE,
  DnsProvider(DSP_DNSCALE),
  DnsProvider(DSP_CLOUDFLARE),
 
  A("www", "203.0.113.10", TTL(300)),
  AAAA("www", "2001:db8::10", TTL(300)),
  MX("@", 10, "mail.example.com."),
);

One dnscontrol push updates both providers. See the DNSControl Guide for setup instructions.

Option 3: REST API

For custom integrations, use the DNScale API directly. Export records from your source provider and push them to DNScale via the REST API. This works well for organizations with existing automation that can't easily adopt Terraform or DNSControl.

Configuring NS Delegation

When you want live multi-provider authoritative service and your registrar/provider setup permits it, update the NS records at your domain registrar to include nameservers from both providers:

example.com.  86400  IN  NS  ns1.primary-provider.com.
example.com.  86400  IN  NS  ns2.primary-provider.com.
example.com.  86400  IN  NS  ns1.dnscale.eu.
example.com.  86400  IN  NS  ns2.dnscale.eu.
example.com.  86400  IN  NS  ns3.dnscale.com.

Resolvers choose among the delegated nameservers using their own algorithms, often influenced by past response time and retry behavior. If your primary provider goes down, resolvers that encounter timeouts can retry DNScale's nameservers without a registrar change, but the timing is resolver-specific.

For region-specific delegation strategies, see DNS Delegation by Region.

DNSSEC with Multiple Providers

Running DNSSEC across two providers adds complexity. Each provider signs records with its own keys, and both sets of DS records must be published at the registrar.

Key considerations:

• Both providers must support DNSSEC independently
• DS records from both providers must be added to the parent zone
• Key rollovers must be coordinated — or each provider can manage its own keys independently (multi-signer model, RFC 8901)
• Do not mix signed and unsigned authoritative providers for the same delegated signed zone. If the parent publishes a DS record, validators expect a valid chain from every authoritative answer they receive. Use RFC 8901 multi-signer DNSSEC where supported, or keep DNSSEC disabled until both providers can serve a valid signed zone.

DNScale as Your Primary DNS

If you don't have an existing DNS provider — or want to switch — DNScale works as a standalone primary DNS provider too:

• Web dashboard for managing zones and records
• Full API for automation and integration
• 20+ record types including A, AAAA, CNAME, MX, TXT, SRV, CAA, TLSA, SVCB, HTTPS, and more
• Zone import to migrate from your current provider — see Zone Import Methods
• DNSSEC with automated key management
• Query analytics with per-zone and per-edge traffic breakdowns

Whether you use DNScale as your primary, an additional delegated provider, or a promotion target — the same anycast infrastructure, API, and management tools apply.

Comparison: Traditional Secondary vs DNScale

Getting Started

1. Create a DNScale account (free tier available)
2. Create your zone and add records via the dashboard or API
3. Set up Terraform or DNSControl for reviewed sync
4. Add DNScale nameservers to your registrar's NS delegation when your provider and registrar setup allow it
5. Verify resolution with dig @ns1.dnscale.eu example.com

For a complete walkthrough with code examples, see Multi-Provider DNS with Terraform & DNSControl.