Edgium / Managed DNS and DNS Slave
Managed DNS or DNS Slave, answering from an anycast network
Two ways to have your authoritative DNS answer from the Edgium edge, with points in Brazil and abroad. Host the zones here, or keep editing on your server and let Edgium be the DNS Slave (secondary), the only address the internet sees.
Managed DNS (Hosted DNS)
Zones live at Edgium and answer from every point of the anycast network. Whoever asks gets the answer from the closest point, and an attack on DNS spreads across the network instead of landing on a single server.
Editing in the panel
A, AAAA, CNAME, MX, TXT, SRV and other records, including wildcards (*.yourcompany.com), edited in the Edgium panel.
DNSSEC
Zones signed by Edgium. You publish the DS record at the domain registry and you are ready to validate.
Nameservers under your brand
Use ns1.yourcompany.com and ns2.yourcompany.com, answering from the Edgium network.
DDoS mitigation
The same protection as the DNS Firewall, built in: random subdomain, NXDOMAIN, ANY and SYN floods stay at the edge, with blocking of DNS hijacking and poisoning.
Answers from nearby
Every point announces the same IPs. The query is answered where it arrives, without crossing the country.
Together with the CDN
Hosted your DNS here? To turn on the CDN for a site, you just change its record.
DNS Slave (secondary): your server never shows up
You keep editing the zones on your server (BIND, PowerDNS, your hosting panel). It becomes the hidden master: it notifies Edgium on every change and transfers the zone. The published nameservers are Edgium's, and they are the only ones the internet queries.
- notification (NOTIFY) and zone transfer (IXFR or AXFR)
- query from a resolver
- answer from Edgium
Swipe sideways to see the whole animation.
A truly hidden master
Your server is not in the NS records or anywhere public. You can close port 53 to the internet and accept only Edgium.
Changes that arrive in seconds
You save on your server, it sends the NOTIFY, and Edgium fetches only what changed (IXFR), or the whole zone (AXFR) when needed.
Your tools keep working
Automation, hosting panels and scripts keep writing to your server. Nothing changes in your team's routine.
DNS does not go down with it
If your server goes offline, Edgium keeps answering with the last copy of the zone.
Which of the three fits you
| Managed DNS | DNS Slave | DNS Firewall | |
|---|---|---|---|
| Where the zones live | At Edgium | On your server, with a copy at Edgium | On your server |
| Where you edit | In the Edgium panel | On your server | On your server |
| Who answers queries | Edgium | Edgium | Your server, behind Edgium |
| Does your server show up? | You have no server | No | No |
| If your server goes down | Does not apply | Edgium keeps answering | Queries stop |
| Built for | Companies that want DNS taken care of | Providers and companies with their own DNS | Providers with many zones and dynamic answers |
What changes for the company and for visitors
For the company
- DNS that is not the weak link: without DNS, site, email and systems all stop together. On the anycast network, it holds up.
- Server out of the target: with the DNS Slave, the master does not show up, and attackers have nothing to aim at.
- Your own brand: nameservers under your domain, for providers and resellers.
- Less operations work: redundancy and protection without building and maintaining secondary servers.
For visitors
- Sites and email that answer, because the name always resolves.
- A faster first visit, with the query answered nearby.
- Signed answers (DNSSEC), which cannot be forged along the way.
Use examples
Common situations and how Edgium handles each one.
Internet provider (ISP) and hosting
DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge.
See the full exampleAgencies and web developers
Dozens of sites in a single panel, with certificates that renew themselves and the bare domain protected.
See the full exampleCompanies with their own ERP, database and email
ERP and email reachable from outside, with the company's server hidden behind the edge.
See the full exampleQuestions about DNS
With the DNS Slave, where do I edit the zones?
On your server, as always. When you save, it notifies Edgium (NOTIFY) and the change is transferred right after (IXFR or AXFR).
How does my server stay hidden?
The NS records published at the domain registry point only to Edgium. Your server does not appear anywhere public and can accept connections only from Edgium.
Can I have nameservers with my company's name?
Yes. With managed DNS and with the DNS Slave, the nameservers can carry your domain, such as ns1.yourcompany.com, answering from the Edgium network.
Do you support DNSSEC?
Yes, with managed DNS. Edgium signs the zones, and you publish the DS record at the domain registry.
Can I test before moving all my zones?
Yes. Talk to us: you can start with one zone, on managed DNS or as a DNS Slave, and move the others after you check the answers.
Managed or Slave?
Talk to Edgium: tell us how many zones you have and where they are today. We point you to the right path, test with one zone and handle the switch.