Local DNS that keeps serving during an Internet outage.
An authoritative local zone with guarded API synchronization and last-known-good recovery.
Context
Internal services depended on a domain hosted by an external DNS provider. AXFR was unavailable, and local resolution had to keep working during Internet outages.
Implementation
Deployed BIND 9 as a caching resolver and local authoritative zone. A Python synchronizer retrieves records through the provider API. It compares SOA serials across every authoritative name server and proceeds only when they agree on a newer version.
Before applying a change, the script validates the generated zone, backs up the active copy, reloads only that zone and verifies that it loaded. A systemd timer runs hourly.
Verified result
The completion report confirms that local clients resolve names through BIND and the active local zone remains available without Internet access. Incomplete or inconsistent upstream data cannot replace the working zone.
This protects local DNS continuity; it does not make external services available offline. Client domains, addresses and API credentials are omitted.