Skip to content

Related DNS infrastructure

Saphira Linux gslbDragon

BreathGSLB is a standalone authoritative Global Server Load Balancer we wrote and operate. It answers health-aware A/AAAA for a delegated zone while still serving ordinary DNS records — a small server built for the job BIND and PowerDNS are not.

Free · separate project
Saphira Linux gslbDragon, authoritative GSLB

What BreathGSLB is

BreathGSLB is a standalone authoritative Global Server Load Balancer. It serves health-steered A and AAAA records for a delegated zone while also answering the ordinary DNS records around them. It is DNS in its own right — just built for a narrower job than a general-purpose nameserver.

NoteBreathGSLB does not replace BIND. It does not replace PowerDNS, Knot, or NSD. It does not provide recursive DNS, and it does not require replacing the nameserver already hosting your parent domain. You delegate the zone or sub-zone that needs GSLB behaviour to BreathGSLB and leave the rest of your DNS alone.

Concretely, you point an NS record at BreathGSLB for the namespace that needs health-aware answers. Everything else in the parent zone keeps being served by the DNS you already run.

existing authoritative DNS
        |
        | NS delegation
        v
delegated.example.com
        |
        v
   BreathGSLB
        |
        +-- health checks the origins
        +-- chooses the appropriate A / AAAA answers
        +-- serves the rest of the delegated DNS data

BreathGSLB is authoritative-only and non-recursive. It serves health-steered A/AAAA together with ordinary DNS records. It is not a DNS replacement; it is a DNS server for the part of your namespace that needs to make a live traffic decision.

Why we wrote it

The original problem was simple to describe. There may be two or more places capable of serving something: a large machine or site with plenty of capacity but a shakier last-mile, and a smaller machine or site that is extremely reliable but short on CPU, RAM, or bandwidth.

Ordinary DNS can publish both addresses, but it has no idea which system is healthy right now. BreathGSLB performs active health checks and changes the authoritative answer accordingly.

Its design goal is plain: keep traffic on the big machine while it is healthy, and fail over to the reliable machine when it is not. Rise and fall thresholds, a cooldown window, and per-check jitter keep the answer steady instead of chattering during a short blip.

The Saphira-like part is that this stays understandable. There is no mandatory hosted control plane, no requirement to hand DNS control to a SaaS provider, and no need to replace the parent nameserver. Delegate the zone, configure the endpoints and policies, and BreathGSLB answers it.

TipWe wrote this because we needed it. That is more credible than any marketing line.

What it can do

  • Authoritative DNS only — no recursion.
  • IPv4 and IPv6, with health-steered A and AAAA answers.
  • Multiple health mechanisms: HTTP/HTTPS, HTTP/3, TCP, UDP, ICMP, and raw IP.
  • Rise and fall thresholds, plus cooldown and jitter to avoid answer flapping.
  • Public and private address views.
  • RFC1918-aware private answers and IPv6 ULA-aware private answers.
  • ECS-aware behaviour.
  • Optional GeoIP steering.
  • DNSSEC signing (generated or loaded keys; NSEC/NSEC3).
  • TSIG-protected zone transfers.
  • AXFR and IXFR replication, with catalog/bootstrap behaviour for secondaries.
  • DNS64 synthesis.
  • ALIAS/ANAME-like behaviour at the apex.
  • Normal authoritative records: TXT, MX, CAA, RP, SSHFP, SRV, and NAPTR.
NoteNot every item in the project roadmap is finished. The current repository documentation and source are the ground truth; treat the list above as the capabilities that exist today, not a promise of everything planned.

Public and private: RFC1918 and ULA

BreathGSLB understands that public and local clients are not the same thing. For client networks you configure, it can return private addresses — RFC1918 IPv4 and IPv6 ULA/private views — while ordinary Internet clients receive the public answers.

That means one delegated DNS namespace can sensibly serve three kinds of client at once: public clients, internal IPv4 clients, and internal IPv6 clients — without pretending that private and public topology are identical.

The point is not novelty. It is that the same name can mean different, correct things depending on who asks, which is exactly what real networks need and ordinary single-view DNS cannot express.

Lightitup

Lightitup is not a theoretical future idea. It exists in the BreathGSLB repository under demo/lightitup and mirrors the live development setup. Its design includes:

  • Primary authoritative node: gslb.zerodns.co.uk — 2a02:8012:bc57:53::1
  • Secondary authoritative node: gslb2.zerodns.co.uk — 2a02:8012:bc57:53a::1
  • IPv6 light-up test network: 2a02:8012:bc57:5353::/64
  • Private IPv4 test network: 172.16.0.0/24

The interesting part is why. IPv6 gives you an absurdly large address space inside a single /64. There is no sensible reason to author billions upon billions of literal zone-file records merely to give deterministic addresses useful names. Lightitup demonstrates synthesised forward and reverse DNS across that address space instead.

The demo includes delegated IPv6 reverse DNS for 2a02:8012:bc57:5353::/64 (3.5.3.5.7.5.c.b.2.1.0.8.2.0.a.2.ip6.arpa.) and delegated IPv4 reverse DNS for 172.16.0.0/24 (0.16.172.in-addr.arpa.). The repository shows deterministic forward/reverse synthesis rather than pre-generating an impossible number of records: ask for an arbitrary address inside the light-up /64 and the test tools verify the reverse/forward round-trip.

NoteThe key idea: light up an IPv6 /64 with useful, deterministic DNS names without materialising 2^64 records. The names are synthesised from the configured template and policy — they are not stored.

Lightitup is more than synthesis

The current demo also exercises other BreathGSLB machinery working together, which is the part that matters for trust:

  • Primary and secondary authoritative nodes.
  • Catalog-based secondary bootstrap.
  • AXFR replication.
  • TSIG transfer authentication.
  • Generated DNSSEC keys.
  • NSEC.
  • Forward and delegated reverse zones.
  • Named address pools.
  • Per-host A and AAAA pools.
  • Host-level health overrides.
  • Public and private address pools.
  • GeoIP steering.
  • IPv6-first smoke tests.
  • Forward/reverse round-trip testing.

The repository ships a tracked scripts/lightitup-smoketest suite run against both authoritative servers. It mirrors the real development setup and exists to exercise actual server behaviour — it is not merely a code example.

Why it belongs on Saphira

The connection to Saphira is philosophy, not packaging. BreathGSLB came from the same instinct: solve the actual infrastructure problem; keep the moving parts understandable; support IPv4 and IPv6 properly; let the operator own the configuration; and do not bolt on a hosted control plane merely because the problem can be made to sound complicated.

Sometimes the answer is BIND. Sometimes the problem is not BIND's job. BIND and PowerDNS are excellent authoritative DNS platforms. BreathGSLB exists for the narrower case where the authoritative answer itself needs to depend on live endpoint health, network view, or steering policy. Instead of replacing the DNS system you already run, you delegate that one responsibility to the small server built specifically for it.

BreathGSLB has been benchmarked and tested. Reproducible methodology lives in the repository rather than in a single headline number, so we point there instead of quoting one out of context.

That also fits the wider Saphira message: simple does not mean incapable.

NoteBreathGSLB is free, source-built software we wrote and operate. It is not a Saphira package and is not part of the Saphira package repository or build. There is no apk install for it here; it stands on its own as related infrastructure.

Where to look next