Improving the Resiliency of Our Infrastructure DNS Zone
Nov 30, 2020Ryan Timken, Kiran Naidoo

Summary
This post details the implementation of a multi-primary DNS zone strategy for Cloudflare's infrastructure zone. This involves adding a third-party DNS provider as a second primary authority, managed using OctoDNS for synchronized record updates. The setup leverages DNSDist for weighted, health-checked routing of internal DNS queries, prioritizing Cloudflare's edge DNS and failing over to the third-party provider during outages. The post also describes the automation of DNS record provisioning using OctoDNS integrated with TeamCity for CI/CD, including a review step for changes.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available