DNS Deployment & Cutover Runbook

The Technitium deployment starts with sa-dns-01 as the authoritative primary, joins three secondaries, and moves clients from OPNsense Unbound only after replication and resolution are verified. Site B joins after WireGuard is available.

Prerequisites

Provision the four addresses and placements in the DNS VM inventory.
Keep OPNsense Unbound active as the rollback resolver during deployment.
Establish WireGuard before provisioning sb-dns-01 and sb-dns-02.
Permit the DNS, AXFR, NOTIFY, and cluster API paths in the DNS firewall tables.

Site A Secondary Placement Remains Open

The host for sa-dns-02 is not finalized; the source design permits sa-cmp-01 or sa-cmp-02.

Install the Four Instances

Run on each DNS VM or LXC:

curl -sSL https://download.technitium.com/dns/install.sh | sudo bash
# DNS: port 53 | Web UI / cluster API: port 5380

Open http://<vm-ip>:5380 and change the default admin password immediately.

On every node, enable recursion under Settings → Recursion and leave Forwarders empty to use root-server recursive resolution.

Form the Technitium Cluster

On sa-dns-01, open Settings → Cluster, enable clustering, select Primary, and generate a join token.
On sa-dns-02, sb-dns-01, and sb-dns-02, enable clustering, select Secondary, and supply the sa-dns-01 address and join token.
Verify all three secondaries appear in the sa-dns-01 cluster view.

The cluster synchronizes server settings, applications, and catalog membership. AXFR remains the separate mechanism that replicates zone data.

Create Zones and Replication

On sa-dns-01:

Create core.aorxi.io as a Primary zone. Set the SOA, add NS records for all four DNS servers, and add infrastructure A records.
Create each reverse zone as Primary and add PTR records for static hosts.
For every zone, restrict transfer to 10.10.30.11, 10.20.30.10, and 10.20.30.11; send NOTIFY to the same addresses; attach the TSIG key.

On each secondary:

Create core.aorxi.io as a Secondary zone with primary server 10.10.30.10 and the TSIG key.
Repeat for every reverse zone.

Confirm that a new test record on sa-dns-01 reaches each secondary before proceeding.

Configure TSIG and Dynamic Updates

Generate the TSIG secret on sa-dns-01:

openssl rand -base64 32

In Settings → TSIG Keys, add opnsense-ddns with HMAC-SHA256 and record the secret for OPNsense and external-dns.

For the forward zone and PTR zones covering VLANs 30, 40, and 100, set dynamic-update policy to Signed updates only (TSIG) and allow opnsense-ddns.

OPNsense serves DHCP on Site A client VLANs 100/110/120. Validate dynamic registration from each scope before considering the DNS migration complete.

Cut over from OPNsense Unbound

OPNsense Unbound remains the fallback resolver until each validation gate passes.

Update static DNS configuration on Site A Proxmox nodes:

# /etc/resolv.conf, or the distribution's persistent network configuration
nameserver 10.10.30.10
nameserver 10.10.30.11
search core.aorxi.io

For Site A clients:

Change the VLAN 100/110/120 DHCP DNS options on OPNsense from the local OPNsense resolver to 10.10.30.10 and 10.10.30.11.
Renew one test client on each VLAN.
Verify forward and reverse resolution, public recursion, and the expected inter-VLAN isolation.
Disable Unbound as the client resolver only after the Technitium path is proven.

Site B follows the OPNsense per-scope procedure when that site is built.

Rollback

Return the affected DHCP DNS options to the OPNsense resolver. Clients pick up the rollback on their next lease renewal. Keep the Technitium instances online for diagnosis unless they are the cause of the failure.

DNS VMs: authority, replication, RFC 2136, and firewall contract
DNS Architecture: zone rationale and infrastructure records
WireGuard: Site B replication and dynamic-update transport
Site A L2 Fabric: OPNsense routing and client DHCP ownership

On this page