Domain Name System

Last published : Sep 22, 2026
Note: From release 13.0 build 41.x, the NetScaler appliance in ADNS and proxy mode is fully compliant with DNS flag day 2019.
You can configure the NetScaler appliance to function as an authoritative domain name server (ADNS server) for a domain. Add the DNS resource records that belong to the domain for which the appliance is authoritative and configure resource record parameters. You can also configure the appliance as a proxy DNS server that load balances a farm of DNS name servers that are either within or outside your network. Configure the appliance as an end resolver and forwarder. You can configure DNS suffixes that enable name resolution when fully qualified domain names are not configured. The appliance also supports the DNS ANY query that retrieves all the records that belong to a domain.
You can configure the appliance to concurrently function as an authoritative DNS server for one domain and a DNS proxy server for another domain. When you configure the appliance as the authoritative DNS server or DNS proxy server for a zone, you can enable the appliance to use the TCP for response sizes that exceed the size limit specified for the User Datagram Protocol (UDP).

How DNS Works on the NetScaler

You can configure the NetScaler appliance to function as an ADNS server, DNS proxy server, end resolver, and forwarder. You can add DNS resource records on the NetScaler appliance, including the following records:
  • Service (SRV) records
  • IPv6 (AAAA) records
  • Address (A) records
  • Mail exchange (MX) records
  • Canonical name (CNAME) records
  • Pointer (PTR) records
  • Start of authority (SOA) records
  • Text (TXT) records
  • Name Authority Pointer (NAPTR) records
  • DNSKEY records
  • Certificate Authority Authorization (CAA) records
Also, you can configure the NetScaler to load balance external DNS name servers.
The NetScaler appliance can be configured as the authority for a domain. Add valid SOA and NS records for the domain.
An ADNS server is a DNS server that contains complete information about a zone.
To configure the NetScaler appliance as an ADNS server for a zone, you must add an ADNS service, and then configure the zone. To do so, you add valid SOA and NS records for the domain. When a client sends a DNS request, the NetScaler appliance searches the configured resource records for the domain name. You can configure the ADNS service to be used with the NetScaler Global Server Load Balancing (GSLB) feature.
You can delegate a subdomain, by adding NS records for the subdomain to the zone of the parent domain. You can then make the NetScaler authoritative for the subdomain, by adding a "glue record" for each of the subdomain name servers. If GSLB is configured, the NetScaler makes a GSLB load balancing decision based on its configuration and replies with the IP address of the selected virtual server. The following figure shows the entities in an ADNS GSLB setup and a DNS proxy setup.
Figure 1. DNS Proxy Entity Model
DNS entity model
The NetScaler appliance can function as a DNS proxy. Caching of DNS records, which is an important function of a DNS proxy, is enabled by default on the NetScaler appliance. Caching enables the NetScaler appliance to provide quick responses for repeated translations. Create a load balancing DNS virtual server, and DNS services, and then bind these services to the virtual server.
The NetScaler provides two options, minimum time to live (TTL) and maximum TTL for configuring the lifetime of the cached data. The cached data times out as specified by your settings for these two options. The NetScaler checks the TTL of the DNS record coming from the server. If the TTL is less than the configured minimum TTL, it is replaced with the configured minimum TTL. If the TTL is greater than the configured maximum TTL, it is replaced with the configured maximum TTL.
The NetScaler also allows caching of negative responses for a domain. A negative response indicates that information about a requested domain does not exist, or that the server cannot provide an answer for the query. The storage of this information is called negative caching. Negative caching helps speed up responses to queries on a domain, and can optionally provide the record type.
A negative response can be one of the following:
  • NXDOMAIN error message - If a negative response is present in the local cache, the NetScaler returns an error message (NXDOMAIN). If the response is not in the local cache, the query is forwarded to the server, and the server returns an NXDOMAIN error to the NetScaler. The NetScaler caches the response locally, then returns the error message to the client.
  • NODATA error message - The NetScaler sends a NODATA error message, if the domain name in query is valid but records of the given type are not available.
The NetScaler supports recursive resolution of DNS requests. In recursive resolution, the resolver (DNS client) sends a recursive query to a name server for a domain name. If the queried name server is authoritative for the domain, it responds with the requested domain name. Otherwise, the NetScaler queries the name servers recursively until the requested domain name is found.
Before you can apply the recursive query option, you must first enable it. You can also set the number of times the DNS resolver must send a resolution request (DNS retries) if a DNS lookup fails.
You can configure the NetScaler as a DNS forwarder. A forwarder passes DNS requests to external name servers. The NetScaler allows you to add external name servers and provides name resolution for domains outside the network. The NetScaler also allows you to set the name lookup priority to DNS or Windows Internet Name Service (WINS).

Enable the ADC appliance to use DNS to resolve the host name to its respective IP address

Note: You require an SSH utility to access the command line interface (CLI) of the appliance.
By default, the ADC appliance cannot resolve the host name to its respective IP address. Complete the following tasks to enable the name resolution on the appliance:
  1. Define name servers.
  2. Define a DNS suffix.

Points to note

Perform the DNS lookup from the CLI. DNS lookups from the shell prompt of the FreeBSD operating system fail because the entry in the /etc/resolv.conf file points to the 127.0.0.2 IP address.
The following commands are replaced with the drill command in the FreeBSD CLI of the appliance reachable with the shell command:
-  host
-  dig
-  getent/MIP
-  nslookup
For example, instead of running dig www.google.com @8.8.8.8 to query the "A" record "www.google.com" at the name server "8.8.8.8", you can run drill www.google.com @8.8.8.8 command. The drill command performs exactly the same as the dig command does.
root@lab# drill www.google.com @8.8.8.8
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 57980
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; www.google.com. IN A

;; ANSWER SECTION:
www.google.com. 300 IN A 142.250.187.196

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 53 msec
;; SERVER: 8.8.8.8
;; WHEN: Thu Jun 9 11:04:55 2022
;; MSG SIZE rcvd: 48
If the appliance cannot ping the DNS server on its SNIP address, the server status shows as down. Successful ping is important when the appliance is behind a firewall.

CLI configuration

At the command prompt, type:
add dns nameServer <Name_Server_IP_Address>
add dns suffix <DNS_Suffix>
To verify the configuration, type:
show dns nameServer
show dns suffix
To test DNS resolution, type:
show dns addrec <Host_Name>

GUI configuration

  1. Navigate to Traffic Management > DNS > Names Servers > Add.
  2. In the Create Name Server dialog box enter the name server IP Address and click Create.
  3. Navigate to Traffic Management > DNS > DNS Suffix > Add.
  4. In the Create DNS Suffix dialog box, enter the DNS Suffix, such as example.com, to be used for all host queries and click Create.

Round Robin DNS

When a client sends a DNS request to find the DNS resource record, it receives a list of IP addresses resolving to the name in the DNS request. The client then uses one of the IP addresses in the list, generally, the first record or IP address. Hence, a single server is used for the total TTL of the cache and is overloaded when many requests arrive.
When the NetScaler receives a DNS request, it responds by changing the order of the list of DNS resource records in a round robin method. This feature is called round robin DNS. Round robin distributes the traffic equally between data centers. The NetScaler performs this function automatically. You do not have to configure this behavior.

Functional Overview

If the NetScaler is configured as an ADNS server, it returns the DNS records in the order in which the records are configured. When the NetScaler is configured as a DNS proxy, it returns the DNS records in the order in which it receives the records from the server. The order of the records present in the cache matches the order in which records are received from the server.
The NetScaler then changes the order in which records are sent in the DNS response in a round robin method. The first response contains the first record in sequence, the second response contains the second record in sequence, and the order continues in the same sequence. Thus, clients requesting the same name can connect to different IP addresses.

Round Robin DNS Example

As an example of round robin DNS, consider DNS records that have been added as follows:
add dns addRec ns1 1.1.1.1  add dns addRec ns1 1.1.1.2  add dns addRec ns1 1.1.1.3  add dns addRec ns1 1.1.1.4
The domain, abc.com is linked to an NS record as follows:
add dns nsrec abc.com. ns1
When the NetScaler receives a query for the A record of ns1, the Address records are served in a round robin method as follows. In the first DNS response, 1.1.1.1 is served as the first record:
ns1.                    1H IN A         1.1.1.1  ns1.                    1H IN A         1.1.1.2  ns1.                    1H IN A         1.1.1.3  ns1.                    1H IN A         1.1.1.4
In the second DNS response, the second IP address, 1.1.1.2 is served as the first record:
ns1.                    1H IN A         1.1.1.2  ns1.                    1H IN A         1.1.1.3  ns1.                    1H IN A         1.1.1.4  ns1.                    1H IN A         1.1.1.1
In the third DNS response, the third IP address, 1.1.1.2 is served as the first record:
ns1.                    1H IN A         1.1.1.3  ns1.                    1H IN A         1.1.1.4  ns1.                    1H IN A         1.1.1.1  ns1.                    1H IN A         1.1.1.2