ns2 — standby secondary and European probe endpoint

This host holds a full copy of every zone the network is responsible for and answers authoritatively for them. It is deliberately kept out of the public delegation: it exists to take over on short notice and to measure Europe-facing latency, not to carry day-to-day query volume.

node id

ns2

role

dns-secondary / probe

region

eu-ams-a

software

nsd 4.8

in delegation

no — standby

last transfer

see /status

Because this node is not in the delegation, no resolver will consult it unless you ask it directly. That is intentional. If you are troubleshooting a delegation problem, the answers you want come from the servers listed in the parent zone, not from here — though comparing the two is often exactly what tells you where the problem is. See verify.

What runs here

Service	Transport	Scope	State
dns-secondary	udp/53, tcp/53	Authoritative answers from transferred copies. No recursion, ever.	serving
zone-xfr client	tcp/53 outbound	Pulls from the primary on NOTIFY and on the refresh timer.	serving
probe-agent	icmp, tcp/443	RTT sampling from the European side towards our own endpoints.	serving
response rate limiting	udp/53	Enabled. Repeated identical queries from one source are truncated or dropped.	enforced

Why a standby rather than a live secondary

A nameserver in the delegation has to be as correct as the primary at all times, because resolvers pick from the NS set at random. A copy that is one serial behind is not a resilience feature, it is an intermittent bug that appears for one query in four and is almost impossible to reproduce on request.

Keeping this node out of the delegation until its data has been verified against the primary removes that failure mode entirely. Promotion is a deliberate act: verify, then publish the NS record, in that order. The cost is that we carry a machine that serves almost no queries, which is cheap compared to a week of chasing an intermittent resolution failure.

Relationship to ns1

ns1 is the Moscow-side node and carries the authoritative role for delegated zones. Policies that apply to the network as a whole are published there rather than duplicated here:

Peering policy — requirements, presence, technical expectations.
Abuse reporting — what to include and how we respond.
Looking glass — measurement intake, on ns1 only.

Contacts

Operational questions about this node: noc@clouderra.ru. Anything about zone contents belongs with the zone owner, not with us — we transfer what the primary sends and do not edit records in flight.