Let's say I own two servers with the static IPv4 addresses a.a.a.a
and b.b.b.b
. Can I run my own DNS servers on them, so me and my friends can set a.a.a.a
and b.b.b.b
in our resolvers' settings, anywhere in the world, and have our own toy DNS root zone, where we can register any domain names we want on any level, without ever depending on registrars? Something like an internal DNS, but without the boundaries of a private network. If not, what exactly would be stopping me?
Yes. It's just a regular zone. People have done so both with private root servers and with larger "alternate root" projects open to public. (For example, dn42 does the former mostly as an exercise, with internal root servers adding the "dn42" TLD, while OpenNIC does the latter.)
Generally speaking, very little about the Internet is special; you can re-create all of it yourself like it was built in the 19X0s – your own DNS root, your own BGP between networks, and you have an internet. (Again, dn42 is a specific example that does both.)
But to achieve the result you're asking for (i.e. ability to register any domain), I don't think a root zone is what you actually want.
Toy root zone (as asked)
If you specifically want to build a replica internet from scratch, then any authoritative nameserver software (e.g. BIND9) can be used to host the root zone like any other zone – it'll be named
.
or""
depending on configuration syntax.Such a setup will be a blank slate; it will not have the usual .com or .org unless you manually copy those from ICANN's root zone. (The root zone is public and you can download it as a text file, then add your changes – but don't forget to strip away all of the DNSSEC signatures, as those would be invalidated.)
If you do so, then you'll need to repeat the process for every level. For example, while the root zone is still fresh, you can directly add a customexample.com
delegation to it. But if you've already added the generalcom
delegation (so that you could browse serverfault.com), you cannot override specific subdomains anymore – because you've delegated the authority forcom
elsewhere. (At that point, you'd instead need to repeat the "copy and edit" process forcom
, and that's a problem because the zone contents of .com aren't public.)I'm not sure if the above is strictly true; it might happen to work even though in theory it ought not to.
Simpler option for custom domains
For your goals, starting from root is not necessary, as OS stub resolvers don't make iterative queries and don't care about zone boundaries – they let the specified server do all resolving – so it would be much easier to set up a special resolver instead, one which has your custom domains as authoritative zones (or some other kind of override) on top of standard ICANN-root DNS.
For example – start with plain BIND9 or Windows Server as a resolver for standard DNS (be careful about exposing a resolver to Internet though), then define your own authoritative zone for some domain, and that domain immediately "exists" for anyone using your server.
(Other zone types such as 'forward' zones will also work, e.g. you can set up resolver A that forwards fake.com to authoritative server B. Unbound or Dnsmasq can also be used on a smaller scale; the former has individual overrides but I think current versions are capable of hosting full zones.)
This is an extremely common thing to do; that's how your wifi router does ".home" or ".lan" names, and it's how many corporate networks have their internal domains – thousands of Windows DNS servers that host a made-up domain for Active Directory in addition to being general-purpose resolvers.
(It can create some problems with DNSSEC, though, but most operating systems don't actually do DNSSEC validation on their own, so it's likely that you won't need to do anything special about that.)
In other words, having a root zone doesn't give you fine-grained "registrar bypass" powers for lower levels; it only gives you the power to replace a TLD registry in its entirety. Rather, it's the fact that your friends would be using your server as their primary resolver (i.e. the opposite of a root server!) that lets you bring individual custom domains into existence.
Side note: It is enough to have one server and one IP address. Traditionally two were required for reliability, but that's a matter of NIC policy, not anything fundamental to DNS.