Skip to content
RedundantDNS
Menu

Multi-provider authoritative DNS

Your DNS zone, live on two providers at once.

If one goes down, nobody notices. RedundantDNS keeps one zone in sync on Route 53, OCI DNS, Google Cloud DNS, Azure DNS and Cloudflare, and watches every nameserver.

Start free See how it works

Free for one zone on two providers you already use. No card.

example.com

Delegation complete

  • AWS Route 53

    ns-1234.awsdns-26.org …

    In sync

  • OCI DNS

    ns1.p68.dns.oraclecloud.net …

    In sync

Zone synced to Route 53 and OCI DNS. Last probe: every nameserver answered, serials match.

DNS sits in front of everything

When DNS fails, redundant servers, regions and databases behind it stop mattering. Most domains are served by exactly one DNS provider. The last year gave plenty of reasons to reconsider that.

How it works

  1. Connect two providers

    Least-privilege credentials for the accounts you already have, at one of two access levels. Encrypted on arrival, never shown again.

  2. Edit one zone

    Records live in one canonical zone. Change them in the dashboard, the API, Terraform or through MCP.

  3. Every provider gets the change

    RedundantDNS diffs the zone against each provider, applies only what differs, then reads it back to verify.

  4. Every nameserver is watched

    Probes query each nameserver from every probe region and alert you when one drifts or stops answering.

The full walkthrough, with diagrams
One canonical zone synced to provider A and provider B; the registrar's NS set lists both, and a resolver can ask any nameserver.

Pick any two of five providers

Use your own accounts (bring your own) or ours (managed, on any paid plan, passed through at cost plus 20%). One zone can mix both. Every provider has a copy-paste permission guide for both access levels.

Every provider pair, explained

Dashboard, API, Terraform, MCP

The dashboard is for people. Everything it does is also in the HTTP API (OpenAPI 3.1), the Terraform provider, the CLI and the MCP server, so scripts, pipelines and AI agents use the same rules: scoped tokens, roles, IP allowlists and one audit log.

Create a record set on every provider of the zone:

curl -s -X PUT https://<host>/v1/zones/<zoneId>/records \
  -H "Authorization: Bearer rdns_..." \
  -H 'Content-Type: application/json' \
  -d '{"name":"www","type":"A","ttl":300,
       "values":["192.0.2.10"]}'

Built to be trusted with DNS

  • Provider credentials are write-only and sealed with a per-organization key (AES-256-GCM), wrapped by KMS.
  • Two access levels per provider: let RedundantDNS create zones, or only edit one zone you created.
  • Zone data lives in object storage with replicas that can sit in another cloud, and a weekly restore drill proves the keys still open it.
  • Self-host it, or run only the data plane yourself, and credentials never leave your infrastructure.
Security details

What it does not do (yet)

  • No DNSSEC on multi-provider zones. Multi-signer DNSSEC (RFC 8901) is on the roadmap.
  • Provider-only features such as Route 53 alias records, routing policies and Cloudflare’s proxy stay outside the zone.
  • No nameservers of our own: your zone is served by the providers you pick.
  • Not a registrar: you set the NS records at your registrar, and the delegation check tells you when it is live. Domains registered at Cloudflare Registrar need a transfer first for the apex.

Put your zone on two providers

Start with one zone and two providers you already have. Free, no card.

Start free See how it works