About This Project
Designed and deployed an authoritative internal DNS service for my lab network, replacing consumer router name resolution with a redundant, monitored, corporate-style setup.
What Was Built
- Primary and secondary DNS servers running in separate Linux containers on a Proxmox cluster
- Authoritative forward zone for the internal domain plus reverse (PTR) zones for every VLAN
- Zone transfer with notify from primary to secondary, so records replicate automatically
- Per-network recursion allow-lists, so only trusted internal ranges may use the resolver
- Admin console secured with HTTPS using a certificate from my own internal CA
- DNS records for every lab service, integrated with a reverse proxy so services are reached by name instead of IP
Monitoring
DNS metrics exported to Prometheus with a read-only API token and visualised in Grafana — query volume, client distribution, and blocked/failed lookups (roughly 11,000 queries per hour in normal operation).
Problems Solved
- NS and SOA records had to be corrected to fully qualified form to be standards-compliant
- Remote VPN clients received "Refused" responses for external names until the tunnel network was added to the recursion allow-list — a good lesson in how resolver access control interacts with VPN design
Skills Demonstrated
- DNS zone design
- Primary/secondary replication
- Resolver hardening
- Service monitoring
- Linux container administration
Project Info
- Category: Infrastructure
- Year: 2026
- Status: Completed