16 Operating an authoritative service

16.1 Build, stage, verify, replace

A safe publication cycle separates source editing from serving:

cd /etc/rgbdns
tinydns-data
tinydns-get example.com A www.example.com

In production, compile in a staging directory, run representative exact, wildcard, delegation, negative, IPv4, IPv6, and large-response queries, then atomically replace data.cdb. Retain the previous known-good database for rollback. Query the bound service over both UDP and TCP after deployment.

Do not expose the recursive service to arbitrary networks by accident. The default ALLOW_NETS is loopback only because an open resolver can be abused for amplification and can consume local capacity. Likewise, expand AXFR allowlists only for intended secondaries.

16.2 Observe the right signals

Useful signals include:

• query and error rate by transport;
• truncated UDP responses and TCP retries;
• SERVFAIL, REFUSED, NXDOMAIN, and validation-failure rates;
• resolver cache capacity and latency percentiles;
• process restarts and file-descriptor use;
• root-hint and trust-anchor freshness;
• time synchronization;
• CDB build identity and deployment time.

High NXDOMAIN volume is not automatically an incident; browsers, typo traffic, and discovery protocols generate it. A change from baseline paired with latency or SERVFAIL is more meaningful.

TAI64N log labels make events stable for storage. Convert them for human display at the edge:

tail -f main/current | tai64nlocal