Install the DNS Security Node

1. Choose the DNS path

Axiom can sit between endpoints and upstream resolvers, or between an internal DNS/DC server and its upstream resolvers. In an Active Directory environment, endpoints normally continue using the DC for AD-integrated records while the DC forwards external queries to Axiom.

The DNS node does not require three NICs. A simple deployment can use one NIC for node control, client DNS, and upstream access. Separate NICs are useful when management, client, and upstream networks must be isolated by design.

2. Run the installer

chmod +x axiom-installer.sh
sudo ./axiom-installer.sh

Choose dns. Enter:

• Management URL and enrollment token
• Node ID and display name
• Node control NIC, IP, and TCP port 9443
• DNS listener NIC and static IPv4
• Upstream egress NIC
• Upstream mode: internal/DC, Cloudflare, Google, Quad9, or custom
• One or more upstream IPv4 and port values

Axiom listens on UDP and TCP 53. Ensure no local resolver already owns the selected non-loopback IP and port.

3. Verify service and enrollment

sudo systemctl status axiom --no-pager
sudo ss -lunp | grep ':53'
sudo ss -ltnp | egrep ':53|:9443'
sudo journalctl -u axiom -n 160 -l --no-pager

Verify the node appears online in Management before changing any client or DC DNS settings.

4. Test resolution directly

dig @DNS_NODE_IP example.com A
dig +tcp @DNS_NODE_IP example.com A

Both UDP and TCP tests should return a valid answer. Repeat the query and confirm cache-hit counters increase. Test every configured upstream by temporarily selecting or ordering it through policy rather than changing Linux resolver files by hand.

5. Test explicit blocking

In DNS Security > DNS Policies, add a dedicated test domain with action Block. Save policy and confirm the DNS node acknowledges the new generation. Query that exact domain and verify the configured blocked response and a matching event in Management.

Do not enable large third-party feeds until their contents, update method, false-positive handling, and rollback procedure have been reviewed.

6. Configure local records

Use the Local DNS form to add an A or AAAA record with a hostname, address, and TTL. Query the record directly from the DNS node before relying on it in production. Local records are not a replacement for AD-integrated DNS zones.

7. Cut over safely

Change a small pilot group first. Monitor query latency, upstream errors, block events, and top clients. In AD environments, verify domain join, Kerberos, LDAP, Group Policy, and service discovery before a broad rollout.