Docs / DNS

lattice-dns embedded (hidden primary)

Authoritative DNS for internal Lattice-managed zones. Not public DNS. Recursion off.

Binary: lattice-dns. Adapter name in IPAM: embedded. Pick this mode on DNS modes first.

lattice-dns zone seattledistribution.meridian.internal — lease-derived and static records

lattice-dns zone seattledistribution.meridian.internal — lease-derived and static records

Run it

lattice-install publishes lattice-dns on :53 (UDP and TCP). On Starter three-node HA the VIP serves UDP/TCP :53. Community is the single node’s address. HA.

LATTICE_LISTEN_DNS=:53

Console

  1. DNS servers → adapter embedded.
  2. DNS (/dns): create a zone (SOA/NS). Add static records if you need them (A, AAAA, CNAME, MX, SRV, CAA).
  3. On each subnet that should publish into this zone: DDNS on, adapter embedded, forward and reverse zones.

Lease-derived A/AAAA/PTR appear after Ack, via the outbox. SOA serial increases on static CRUD and on grant/renew/release/expire. Static records.

What it answers

  • SOA/NS from dns_zone
  • A/AAAA/PTR from leased rows and static_record
  • MX / SRV / CAA from static records
  • Off-zone query → REFUSED
  • Name in zone, no such RR type → NODATA
  • Name not in zone → NXDOMAIN
  • RecursionAvailable=0

Transfers

AXFR is TCP-only. allow_transfer is a list of IPs/CIDRs — empty means any client can zone-transfer, so list the slave IPs. Optional transfer_tsig_name + transfer_tsig_secret_ref (env: / file:). After a serial bump, lattice-dns sends NOTIFY to also_notify.

IXFR: if the slave’s serial is the previous compiled snapshot, lattice-dns sends an RFC 1995 delta. Older serials get a full AXFR. Process restart forgets history, so the next IXFR is AXFR.

Hidden primary

On BIND:

Current BIND 9 ARM uses type secondary and primaries. Older configs used type slave and masters; both still work on many releases.

zone "office.example.com" {
    type secondary;
    file "slaves/office.example.com";
    primaries { 10.0.0.10 port 53; };  // lattice-dns VIP
};

On the Lattice zone: allow_transfer = the BIND IPs, also_notify = those IPs. NS records at the parent should be the BIND servers, not Lattice, if you want Lattice hidden.

Not this binary

Recursive lookup, forwarding, RPZ, public/external DNS, DNSSEC, AD forest DNS. lattice-dns is for internal zones only. If workstations need a cache, run Unbound/BIND in front and conditional-forward our zones here; leave AD on the DCs.