Haseeb ArshadHaseeb Arshad
← All projects
Network reliabilityProduction

Highly Available DNS and Network Telemetry

Primary and secondary Pi-hole resolvers backed by encrypted upstream DNS and source-aware telemetry across the cluster.

Pi-holeCoreDNSDNS-over-TLSMetalLBPrometheusGrafana

2

independent resolvers

3

DNS tap nodes

DoT

upstream transport

The challenge

What the system needed to solve

Remove the single-resolver failure mode while preserving useful per-client DNS visibility in a network that intercepts ordinary outbound DNS.

The build

Engineering decisions

01

Deployed a stateful primary resolver and a separately scheduled stateless secondary resolver advertised together by DHCP.

02

Routed upstream resolution through redundant CoreDNS-over-TLS services.

03

Added read-only Pi-hole exporters plus a lightweight tap on each cluster node to retain the original LAN source and requested name before forwarding.

04

Monitored resolver availability, latency, failure rates, blocked traffic, and source distribution in Grafana.

Architecture

How the pieces connect

  1. 1LAN clients
  2. 2Primary and secondary Pi-hole
  3. 3CoreDNS-over-TLS pair
  4. 4Encrypted upstream resolvers
  5. 5Prometheus telemetry

Results

What changed

  • Client DNS continues through maintenance or loss of one resolver.
  • Troubleshooting can distinguish upstream failure, resolver failure, and a single noisy client.
  • Private service discovery and public-name overrides stay centrally managed.