What is STACKIT DNS Resolver?
STACKIT DNS Resolver is a managed, recursive DNS resolution service within the STACKIT Cloud. It translates domain names into IP addresses and runs the full recursive resolution chain: from the cache through the root and TLD servers to the authoritative nameserver. The service is intended for workloads within the STACKIT Cloud and is not an open, public resolver for general internet use.
The distinction from STACKIT DNS matters: STACKIT DNS is an authoritative hosting service that manages and answers your own DNS zones. The DNS Resolver, by contrast, hosts no zones and instead resolves names for your applications. The two services complement each other: the resolver delivers recursive resolution, while DNS hosting provides authoritative answers. Because all queries are processed within the geographical and legal boundaries of the STACKIT Cloud, the resolver suits organizations with strict data sovereignty requirements.
Core Features
- Recursive resolution: Full recursive DNS resolution from cache through root and TLD servers to the authoritative nameserver.
- Data sovereignty: All queries are processed within the geographical and legal boundaries of the STACKIT Cloud, aligned with European compliance requirements.
- DNSSEC validation: The resolver automatically checks DNS responses for authenticity, protecting against spoofing and cache poisoning.
- DNS over HTTPS (DoH): Queries are transmitted in an encrypted HTTPS tunnel and protected from eavesdropping.
Typical Use Cases
Name resolution for cloud workloads: Applications in the eu01 and eu02 regions use the resolver to resolve domain names without falling back to external or public resolvers. Frequently requested domains are cached and served with TTL-based validity.
Encrypted DNS queries: Through DNS over HTTPS, queries can be transmitted in encrypted form, so requests and responses do not travel across the network in plain text. This reduces the risk of DNS hijacking and eavesdropping.
Sovereign resolution for regulated industries: Finance, healthcare, and the public sector resolve names within the STACKIT Cloud and thereby keep data within European infrastructure. Automatic DNSSEC validation further increases trust in the responses.
Benefits
- Free of charge and usable without a separate ordering process.
- Data processing within the STACKIT Cloud for data sovereignty in the EU.
- DNSSEC validation and DNS over HTTPS for secure, tamper-resistant resolution.
- Operated in a redundant, highly available configuration with caching for low latency.
Integration with innFactory
As an official STACKIT Partner, innFactory supports you with the adoption and operation of this service.
Typical Use Cases
Frequently Asked Questions
What is STACKIT DNS Resolver?
STACKIT DNS Resolver is a managed recursive DNS resolution service. It translates domain names into IP addresses through the full recursive chain and processes all queries within the STACKIT Cloud. Unlike STACKIT DNS, it does not host its own zones but resolves names for your workloads.
When should I use STACKIT DNS Resolver?
Use it when your workloads in the STACKIT Cloud need to resolve domain names and you require a sovereign resolver instead of an external or public service. It is especially relevant for regulated industries such as finance, healthcare, and the public sector with requirements for data sovereignty and encrypted queries.
How much does STACKIT DNS Resolver cost?
The service is free of charge and requires no separate ordering process. There are no usage- or query-based fees. Note that the service is in its beta phase and the feature scope is still being expanded.
What security features does STACKIT DNS Resolver provide?
The resolver automatically performs DNSSEC validation and thus verifies the authenticity of DNS responses against spoofing and cache poisoning. It also supports DNS over HTTPS (DoH), which transmits queries in an encrypted HTTPS tunnel and protects them from eavesdropping.
