The challenge
What the system needed to solve
Remove the single-resolver failure mode while preserving useful per-client DNS visibility in a network that intercepts ordinary outbound DNS.
The build
Engineering decisions
Deployed a stateful primary resolver and a separately scheduled stateless secondary resolver advertised together by DHCP.
Routed upstream resolution through redundant CoreDNS-over-TLS services.
Added read-only Pi-hole exporters plus a lightweight tap on each cluster node to retain the original LAN source and requested name before forwarding.
Monitored resolver availability, latency, failure rates, blocked traffic, and source distribution in Grafana.
Architecture
How the pieces connect
- 1LAN clients
- 2Primary and secondary Pi-hole
- 3CoreDNS-over-TLS pair
- 4Encrypted upstream resolvers
- 5Prometheus telemetry
Results
What changed
- Client DNS continues through maintenance or loss of one resolver.
- Troubleshooting can distinguish upstream failure, resolver failure, and a single noisy client.
- Private service discovery and public-name overrides stay centrally managed.
