# DNS

How names resolve on the LAN.

## The setup

| Role | Host | Port |
|------|------|------|
| **Primary DNS** | pi4 `.2` | `:53` |
| Backup DNS | mini1 `.4` | `:53` |
| Backup DNS | mini2 `.5` | `:53` |
| Recursion | unbound (on each Pi-hole host) | `:5335` |

- Every device asks the Pi-holes to resolve names.
- **Pi-hole** = ad blocking + LAN pins (local hostnames → IPs).
- **unbound** = real DNS recursion (no public upstreams, DNSSEC).

## LAN pins (internal names)

Local hostnames like `starcommand.tomasetti.online` resolve to LAN IPs via Pi-hole "pins" — not the public internet. Since the dual-Caddy build (2026-08-19), pins are **dual-A** (`10.0.0.2` + `10.0.0.4`) so LAN clients fail over to the standby edge.

## DHCP → DNS

mini1's DHCP tells clients to use DNS `.2`, `.4`, `.5`.

## Public DNS

- `tomasetti.online` / `tomasetti.shop` → **Namecheap** (wildcard `*.tomasetti.online` → `161.97.210.86`).
- `leebens.com` → **GoDaddy**.