Secondary DNS - Deep Dive

This post details the migration of Cloudflare's Secondary DNS service from Mesos Marathon to Kubernetes. It outlines the challenges of creating a distributed and reliable system in Kubernetes while protecting individual data centers from DDoS attacks. The solution involved proxying egress traffic from Kubernetes to primary DNS servers using Shadowsocks-libev for SOCKS5 implementation, and using Spectrum for DDoS protection of the Notify Listener service. The post also explains the underlying concepts of Secondary DNS, including SOA serial tracking, zone transfers (AXFR and IXFR), and the use of TSIG for security.