Product Documentation
ADC
14.1-Current Release 13.1 12.1
View PDF

Configure the NetScaler as an end resolver

May 28, 2025
Contributed by: 
C S S

A resolver is a procedure that is invoked by an application program that translates a domain/host name to its resource record. The resolver interacts with the LDNS, which looks up the domain name to obtain its IP address. The NetScaler can provide end-to-end resolution for DNS queries.

In recursive resolution, the NetScaler appliance queries different name servers recursively to access the IP address of a domain. When the NetScaler receives a DNS request, it checks its cache for the DNS record. If the record is not present in the cache, it queries the root servers configured in the ns.conf file. The root name server reports back with the address of a DNS server that has detailed information about the second-level domain. The process is repeated until the required record is found.

When you start the NetScaler appliance for the first time, 13 root name servers are added to the ns.conf file. The NS and Address records for the 13 root servers are also added. You can modify the ns.conf file, but the NetScaler does not allow you to delete all 13 records. At least one name server entry is required for the appliance to perform name resolution. The following diagram illustrates the process of name resolution.

Figure 1. Recursive resolution

Recursive Resolution

In the process shown in the diagram, when the name server receives a query for the address of s1.s2.s3.com, it first checks the root name servers for s1.s2.s3.com. A root name server reports back with the address of the .com name server. If the address of s1.s2.s3.com is found in the name server, it responds with a suitable IP address. Otherwise, it queries other name servers for s3.com, then for s2.s3.com to retrieve the address of s1.s2.s3.com. In this way, resolution always starts from the root name servers and ends with the domain’s authoritative name server.

Note

For recursive resolution functionality, caching must be enabled.

Enable recursive resolution

To configure the NetScaler appliance to function as an end resolver, you must enable recursive resolution on the appliance. You must also add a DNS name server with the local option for the feature to work.

Enable recursive resolution by using the CLI

At the command prompt, type the following commands to enable recursive resolution and verify the configuration:

-  set dns parameter -recursion ENABLED  
-  show dns parameter

Example:

> set dns parameter -recursion ENABLED
 Done
> show dns parameter
        DNS parameters:
            .
            .
            .
        Recursive Resolution : ENABLED
            .
            .
            .
 Done

Enable recursive resolution by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, select the Enable recursion checkbox, and then click OK.

Add a name server (when the NetScaler appliance acts as a resolver) by using the CLI

At the command prompt, type:

add dns nameServer ((<IP> [-local]) | <dnsVserverName>)

Example:

add dns nameServer 10.102.9.19 -local
show dns nameServer
1)  10.102.9.19 LOCAL -  State: UP  Protocol: UDP
Done

Local - Mark the IP address as one that belongs to a local recursive DNS server on the NetScaler appliance. The appliance recursively resolves queries received on an IP address that is marked as being local. For recursive resolution to work, the global DNS parameter, recursion, must also be set. If no name server is marked as being local, the appliance functions as a stub resolver and load balances the name servers.

Add a name server by using the GUI

Navigate to Traffic Management > DNS > Name Servers and create a name server.

Enable DNS root referral

DNS root referral is disabled by default. When enabled, the ADC appliance responds with the root referral records.

Send a root referral if a client queries a domain name that is unrelated to the domains configured/cached on the NetScaler appliance. If the setting is disabled, the appliance sends a blank response instead of a root referral. Applicable to domains for which the appliance is authoritative. Disable the parameter when the appliance is under attack from a client that is sending a flood of queries for unrelated domains.

Enable root referral by using the CLI

At the command prompt, type the following commands to enable recursive resolution and verify the configuration:

-  set dns parameter -dnsrootReferral ENABLED  
-  show dns parameter

Example:

> set dns parameter -recursion ENABLED
 Done
> show dns parameter
        DNS parameters:
            .
            .
            .
        DNS Root Referral : ENABLED
            .
            .
            .
 Done

Enable root referral by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, select the Enable Root Referral checkbox, and then click OK.

Set the Number of Retries

Configure the ADC appliance to make a preconfigured number of attempts (called DNS retries) when it does not receive a response from the server to which it sends a query. By default, the number of DNS retries is set to 5.

Set the number of DNS retries by using the CLI

At the command prompt, type the following commands to set the number of retries and verify the configuration:

-  set dns parameter -retries <positive_integer>  
-  show dns parameter

Example:

> set DNS parameter -retries 3
 Done
> show dns parameter
        DNS parameters:
        DNS retries: 3
            .
            .
            .
 Done

Set the number of retries by using the GUI

  1. Navigate to Traffic Management > DNS.
  2. In the details pane, under Settings, click Change DNS settings.
  3. In the Configure DNS Parameters dialog box, in the DNS Retries text box, type the DNS resolver request retry count, and then click OK.

Enhanced DNS resolution with TCP support

Starting from release 14.1 build 47.x, NetScaler has enhanced its DNS resolution capabilities by adding support for DNS over TCP. Previously, it only used UDP that is fast but has difficulties with larger responses. By incorporating TCP, NetScaler can effectively handle bigger DNS responses. This enhancement is beneficial for DNS Security Extensions (DNSSEC).

Key enhancements

  • DNS over TCP support: Enables reliable handling of large DNS responses.
  • DNS profiles: Centralizes and simplifies DNS configuration management.
  • EDNS(0) integration: Optimizes UDP usage for efficient DNS communication.

This enhancement provides the following key benefits:

  • Enhanced scalability: Efficiently manages high DNS query volumes.
  • Improved reliability: Eliminates resolution failures for large DNS records.
  • Centralized management: Simplifies DNS configuration through DNS profiles.
  • Future-ready security: Supports modern DNS security standards and offers better protection against attacks.
  • Simplified operations: Provides a consistent and easier way to manage DNS resolution.
  • Increased control: Allows customized DNS resolution policies.

Prerequisite

Ensure that there is network connectivity to Top-Level Domain (TLD) servers from NetScaler.

Configure DNS resolution by using the CLI

Note:

Configuring recursive DNS resolution by adding a DNS name server with the -local option and setting the dns parameter with the -recursion option is deprecated.

To configure recursive resolution, perform the following steps at the command prompt:

  1. Create a DNS profile with the recursiveResolution parameter set to ENABLED.

add dns profile dns_prof_rec_on -recursiveResolution ENABLED

  1. Configure ADNS services (for UDP and/or TCP) and attach the created DNS profile.
        add service svc_adns <IP> ADNS 53 -dnsProfileName dns_prof_rec_on
        add service svc_adns <IP> ADNS 53 -dnsProfileName dns_prof_rec_on

You can adjust the DNS recursive resolver’s behavior using the following new parameters. Configure them by using the set dns parameter command.

  • resolverMaxActiveResolutions: Controls the maximum number of active concurrent DNS resolutions allowed per packet engine.
  • resolverMaxTcpConnections: Sets the maximum number of DNS-TCP connections that can be opened for recursive resolution per packet engine.
  • resolverMaxTcpTimeout: Defines the maximum time (in seconds) to wait for a response on a DNS-TCP connection during recursive resolution per packet engine.

Enable DNS recursive resolution by using the CLI

  1. Create or modify a DNS profile for recursive resolution.
    1. To create a DNS profile with recursion enabled. add dns profile <new_profile_name> -recursiveResolution ENABLED
    2. To update an existing DNS profile to enable recursion. set dns profile <existing_profile_name> -recursiveResolution ENABLED
  2. Attach the DNS profile to the target entity (if not already attached).
    1. For an existing ADNS or ADNS_TCP service. set service <service_name> -dnsProfileName <dns_profile_name>
    2. For an existing content switching virtual server. set cs vserver <vserver_name> -dnsProfileName <dns_profile_name>
    3. For a new ADNS or ADNS_TCP service. add service <service_name> <ip> <type> <port> -dnsProfileName <dns_profile_name>
    4. For a new content switching virtual server. add cs vserver <vserver_name> <ip> <type> <port> -dnsProfileName <dns_profile_name>

Notes:

  • Use policy-based recursion to enable recursive resolution for traffic from specific domains to a load balancer.
  • Directly attaching a DNS profile with recursiveResolution ENABLED to the load balancing virtual server does not provide domain-specific recursive resolution.

Enable DNS recursive resolution by using the GUI

  1. Navigate to System > Profiles > DNS Profile.
  2. Click Add.

    Note: You can also edit an existing profile.

  3. Select Recursive Resolution.
  4. Click OK.
  5. Navigate to Traffic Management > Load Balancing > Virtual Servers.
  6. Click Add.

    Note: You can also edit an existing profile.

  7. Under Advance Settings, click Profiles.
  8. Select DNS Profile.

    Note: Update the DNS profile for both the content switching virtual server and the ADNS virtual server using the same process.

Enable recursive resolution in specific deployment use cases

  • GSLB deployment with ADNS service: To enable recursion for a GSLB setup, attach a DNS profile with recursiveResolution enabled to your ADNS services (both type ‘ADNS’ for UDP and ‘ADNS_TCP’ for TCP). This configuration ensures that:

    • Queries for GSLB domains or locally configured records on the NetScaler are answered directly.
    • All other domain queries are resolved recursively using root hints over UDP or TCP.

  • Conditional forwarding with recursion: To implement conditional forwarding, directing queries for specific zones to local authoritative DNS servers while resolving all other queries externally:

    • Enable recursion on a DNS profile.
    • Attach the DNS profile to a content switching virtual server.
    • Avoid binding a default load balancing virtual server to this content switching virtual server. By using this configuration, only DNS traffic explicitly routed through content switching policies reaches local authoritative servers. All other queries are forwarded to the external DNS infrastructure through the attached DNS profile’s recursive resolver.

  • Policy-based recursion (for DNS proxy with load balancing): To enable recursion conditionally based on DNS query characteristics, especially in a DNS proxy setup with a load balancing virtual server front-end authoritative DNS servers:

    1. Configure a DNS action that applies a DNS profile with recursion enabled. For example:

    add dns action dnsrecursion noop -dnsprofileName recursive

    1. Create a DNS policy to trigger this action under specific conditions (For example, when the queried domain is not authoritative for the back-end servers).

    add dns policy doRootResolution 'dns.req.question.domain.contains("abc.com").not' dnsrecursion

    1. Bind the created DNS policy globally with a priority.

    bind dns global doRootResolution 1

This policy-based approach allows you to selectively enable recursion for queries that cannot be answered by your back-end authoritative servers.

Configure the NetScaler as an end resolver
May 28, 2025
Contributed by: 
C S S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-2025 Cloud Software Group, Inc. All rights reserved.