This setting is recommended if you use more than one DNS forwarder for resilience. This setup uses dnsdist as an intelligent DNS proxy in front of your normal forwarders, with Samba DCs configured to forward external DNS queries through `dnsdist`.

While `dnsdist` provides fast and intelligent failover between DNS forwarders (e.g., Pi-hole instances), Samba's internal DNS server introduces a noticeable delay before switching to an alternate forwarder when the primary becomes unavailable.

This happens because Samba tries to contact the first configured forwarder and waits for the request to timeout, which can take several seconds per query. Only then does it attempt the next one. This sequential behavior causes temporary failures or latency spikes when a forwarder goes down.

To mitigate this, `dnsdist` is placed in front of the forwarders and Samba forwards all external queries to `dnsdist` alone, allowing fast switching and load balancing to be handled outside of Samba.

• Samba AD DCs provides internal DNS for Active Directory.
• dnsdist listens on `127.0.0.1:5353` and forwards queries to multiple (in my case) Pi-hole instances.
• If one Pi-hole becomes unavailable, `dnsdist` quickly switches to the other.
• All DNS requests go through `dnsdist`, enabling load balancing and failover.

• `samba-ad-dc` (internal DNS server)
  • ↳ forwards to `127.0.0.1:5353` (dnslist)
• `dnsdist`
  • ↳ forwards to:
    • `192.168.0.25` (Internal Pi-hole 1)
    • `192.168.0.26` (Internal Pi-hole 2)
  • ↳ If both piholes down, then fallback forward to:
    • `94.140.14.15` (External AdGuard)
    • `94.140.15.16` (External AdGuard)

apt update
apt install dnsdist

This installs `dnsdist`, its dependencies, and sets up the systemd service.

nano /etc/dnsdist/dnsdist.conf

-- Listen only on localhost, port 5353
setLocal('127.0.0.1:5353')
addLocal('[::1]:5353')
 
-- Accept queries only from localhost
setACL({'127.0.0.1/32', '::1/128'})
 
-- The interactive console (dnsdist -c) requires a valid key configured 
-- Generate your own with: openssl rand -base64 32
setKey("Q2hlY2tUaGlzS2V5SXNWYWxpZEtleTEyMzQ1Njc4OTA=")
controlSocket("127.0.0.1:5199")
 
-- Load balancing policy: least outstanding queries
setServerPolicy(leastOutstanding)
 
-- Use default pool when available, fallback otherwise
addAction(NotRule(PoolAvailableRule("")), PoolAction("fallback"))
 
-- Upstream server pihole-1
newServer({
  address = "192.168.0.25:53",
  retries = 0,          -- No retries for fast failure
  checkInterval = 10,   -- Check every 10s for faster failure / availability detection
  checkType = "A",
  checkName = "debian.org"
})
 
-- Upstream server pihole-2
newServer({
  address = "192.168.0.26:53",
  retries = 0,          -- No retries for fast failure
  checkInterval = 10,   -- Check every 10s
  checkType = "A",
  checkName = "debian.org"
})
 
-- Last resort (Adguard fallback servers with filtering)
 
newServer({
  address = "94.140.14.15:53",
  retries = 0,          -- No retries for fast failure
  checkInterval = 15,   -- Check every 15s
  checkType = "A",
  checkName = "debian.org",
  pool = "fallback"
})
 
newServer({
  address = "94.140.15.16:53",
  retries = 0,          -- No retries for fast failure
  checkInterval = 15,   -- Check every 15s
  checkType = "A",
  checkName = "debian.org",
  pool = "fallback"
})

systemctl enable dnsdist
systemctl start dnsdist

Check that it is running:

systemctl status dnsdist

To verify that `dnsdist` is listening correctly on port 5353 and responding as expected, a manual query was executed using `dig`:

dig @127.0.0.1 -p 5353 example.com
 
;; ->>HEADER<<- opcode: QUERY, status: NOERROR
;; flags: qr rd ra
;; QUESTION SECTION:
;example.com.	IN	A
 
;; ANSWER SECTION:
example.com.	299	IN	A	23.192.228.84
example.com.	299	IN	A	23.215.0.136
example.com.	299	IN	A	23.215.0.138
example.com.	299	IN	A	96.7.128.175
example.com.	299	IN	A	96.7.128.198
example.com.	299	IN	A	23.192.228.80
 
;; Query time: 8 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Sat May 17 21:14:07 UTC 2025

This confirms that:

• `dnsdist` is correctly listening on `127.0.0.1:5353`.
• The forwarding logic to the upstream Pi-hole servers is functional.
• Multiple A records are received, indicating full response handling.
• Average response time was only 8 ms, showing low-latency resolution.

[global]
    dns forwarder = 127.0.0.1:5353

systemctl restart samba-ad-dc

Check that now Samba is resolving properly - note now we use port 53 instead of 5353 to make sure we query samba:

dig @127.0.0.1 -p 53 example.com
 
; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @127.0.0.1 -p 53 example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37277
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
 
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 3 (Stale Answer)
;; QUESTION SECTION:
;example.com.			IN	A
 
;; ANSWER SECTION:
example.com.		0	IN	A	96.7.128.175
example.com.		0	IN	A	23.215.0.138
example.com.		0	IN	A	23.215.0.136
example.com.		0	IN	A	23.192.228.84
example.com.		0	IN	A	23.192.228.80
example.com.		0	IN	A	96.7.128.198
 
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat May 17 21:30:39 UTC 2025
;; MSG SIZE  rcvd: 142

The `leastOutstanding` policy in `dnsdist` is a dynamic and intelligent load-balancing strategy. It selects the upstream server (forwarder) that currently has the fewest active, unanswered queries.

This approach distributes load more evenly under pressure by avoiding overloaded servers and preferring those that are currently faster or less busy.

• For every incoming DNS query, `dnsdist` checks how many queries are currently “in flight” (sent but not yet answered) on each configured server.
• It chooses the server with the lowest number of outstanding queries at that moment.
• If two or more servers have the same count, it picks one at random.

• Reacts in real-time to server load and network delays.
• More efficient than round-robin when under load.
• Helps prevent slow responses caused by overloaded forwarders.

Connect to the console and run:

dnsdist -c
> showServers()

#   Address              State  Qps   Queries  Drops  Lat   Pools
0   192.168.0.25:53      up     0.0   55       0      8.6
1   192.168.0.26:53      up     10.0  416      0      1.7
2   94.140.14.15:53      up     0.0   0        0      -     fallback
3   94.140.15.16:53      up     0.0   0        0      -     fallback

Fallback servers showing 0 queries means your main servers are healthy.

To verify the resilience and failover handling of `dnsdist`, a 30-second DNS stress test was performed using `dnsperf`. The forwarders configured in `dnsdist` were two Pi-hole servers. During the test, one of the Pi-hole forwarders was deliberately shut down after 10 seconds to simulate a failure.

dnsperf -s localhost -d queries.txt -l 30

• Target: Samba AD-DC (localhost)
• Duration: 30 seconds
• Query file: 1000 unique fake domains (e.g. test1.example.com to test1000.example.com) to avoid cache hits

Queries sent:         105909
Queries completed:    105859 (99.95%)
Queries lost:         50 (0.05%)
 
Response codes:       NOERROR 105859 (100.00%)
Average packet size:  request 36, response 77
Run time (s):         30.43
Queries per second:   3478.13
 
Average Latency (s):  0.026
Latency StdDev (s):   0.0526

Despite shutting down one Pi-hole during the test:

• Only 50 queries were lost (0.05%), which were quickly retried and resolved.
• All valid responses had NOERROR status.
• `dnsdist` recovered from the failed forwarder automatically and quickly, showing excellent failover behavior.
• The system maintained an average throughput of 3478 QPS with low latency, indicating that the setup is stable even under load and partial failure.

`dnsdist`, configured with `leastOutstanding` policy and `retries=1`, provides a robust DNS load balancing and failover mechanism suitable for critical infrastructure such as Samba AD environments.

• Official dnsdist website: dnsdist.org

Caponato's Samba notebook. Start here or else Main menu