Anycast DNS at INWX – fast, secure and global

The Domain Name System (DNS) is the foundation of every online presence. It makes sure your domain stays reliably reachable – for visitors, mail servers and all other services that point to your domain. At INWX you get more than just solid basics: you get a complete DNS infrastructure – global Anycast routing, DNSSEC with automated key synchronization, a full-featured API with access control, infrastructure-as-code integrations and much more.

Most features are included at no extra charge with every domain managed at INWX. But our DNS infrastructure can also be used for domains registered with another registrar – through our nameserver packages.

The Anycast network automatically distributes DNS queries across many nodes worldwide. In the case of a volumetric attack – such as a DNS flood – the attack traffic is spread across many targets at once instead of concentrating on a single server. The larger and broader the network, the greater the effort required for an attacker to impair the global reachability of their domains.

DNSSEC (DNS Security Extensions) adds cryptographic signatures to the DNS protocol. This lets resolvers verify whether a DNS response is authentic – and detect and reject forged or manipulated data. This way, attacks such as DNS cache poisoning or DNS spoofing can be effectively detected and fended off by evaluating and verifying the DNSSEC signatures.

As soon as you activate DNSSEC for a domain, INWX automatically provides CDS and CDNSKEY records. These keep the DNSSEC delegation between the parent and child zone automatically up to date – without you having to intervene manually or update keys at the registrar.

INWX provides CDS/CDNSKEY for all managed TLDs. Whether the automatic synchronization actually takes effect, however, depends on the respective parent (registry) – not all registries support this still relatively new standard yet. Where it is supported, manual key exchange is eliminated entirely.

Standard records such as A, AAAA, CNAME, MX or TXT are available as a matter of course – everyone has those. What INWX supports beyond that is the part that makes the difference:

Import

Switching to INWX or want to take over an existing DNS zone? With zonefile import you can import a ready-made zone file in BIND format directly into the INWX Control Panel – all records are transferred automatically, without you having to create them one by one.

Your DNS zones can be exported at any time – as a zone file or in CSV format. Handy as a backup, for documentation, or when you want to take your configuration to another provider. The export is available directly via the INWX Control Panel.

The INWX DNS API gives you complete access to all zone and record functions – suitable for automation, DevOps workflows and infrastructure as code.

Before going live, an Operational Test Environment (OTE) is available. In this sandbox environment you can fully test DNS configurations, API workflows and automation scripts – without any impact on production zones.

This is especially valuable when you:

• secure new deployments or scripts
• validate Terraform, Ansible or Pulumi configurations
• check API integrations before go-live

DNS zones can be managed directly as code at INWX. Official integrations are available for the most widely used IaC tools.

TSIG (Transaction SIGnatures) is a mechanism for cryptographically securing DNS communication – in particular zone transfers (AXFR) between primary and secondary nameservers. Zone transfers are blocked by default at INWX. TSIG is the mechanism with which you explicitly and securely grant certain secondary servers access: every transfer is signed and authenticated with a shared secret key – only authorized servers can request and process the transfer.

What TSIG gives you:

• Targeted access: only explicitly authorized secondary servers can request transfers
• Cryptographic protection of the transfer against tampering
• Standards-compliant mechanism, compatible with BIND, PowerDNS, Knot and other common nameserver implementations

TSIG is particularly relevant if you run secondary DNS with external or your own nameservers, or use a hidden-primary setup.

If your IP address changes regularly – for example with a home server, IoT device or a dynamic DSL connection – DynDNS keeps your domain reachable nonetheless. Automatic IP updates can be set up directly via the Control Panel or the API.

Every INWX customer gets a DynDNS account included. If you need several accounts, you can add further ones.

Use cases

Home networks, small servers, development environments, IP cameras and other devices with a changing IP address.

More on DynDNS at INWX

Do you want to run DNS management via another provider or in a hybrid infrastructure? No problem: INWX makes it possible to operate domains with external nameservers. Domain registration and management stay with INWX, while DNS operation resides elsewhere.

A common setup in this context is the so-called hidden primary: here an internal nameserver acts as the authoritative master that is not visible externally. The publicly visible nameservers act as secondaries and receive the zone data via zone transfer – this protects the primary server from direct access and increases the security of the infrastructure.

Do you want to use the INWX Anycast DNS network for domains that are not registered with INWX too? That is possible. Through our nameserver packages you can integrate external domains into the INWX DNS infrastructure and benefit from global Anycast routing and all other features – independent of the registrar.

The following DNS features are included at no extra charge for every domain managed at INWX: