Running a DNS server on your Synology NAS gives you local hostname resolution, split-horizon DNS for internal services, ad-blocking at the network layer, and full control over your home or office domain without depending on your router's limited DHCP/DNS combo. The Synology DNS Server package is a full BIND 9 implementation wrapped in a GUI — powerful, but easy to misconfigure if you don't know the exact menu paths. This guide covers every step from package installation to zone creation, forwarder setup, DNSSEC validation, and CLI verification, so you end up with a working, reliable DNS server the first time.

Why Run DNS on Your Synology NAS?

Most home routers can resolve local hostnames only for devices that register via DHCP, and even then the support is inconsistent. A Synology running DNS Server gives you:

  • Custom local domain (e.g., home.lan or corp.internal) with proper A, CNAME, MX, and SRV records
  • Split-horizon DNS — serve different answers to internal vs. external queries for the same domain
  • Reliable PTR records for reverse lookups, which many monitoring tools require
  • Selective forwarding — send public queries to upstream resolvers while keeping internal queries local
  • DNSSEC validation for outbound recursive queries
  • DNS-over-TLS (DoT) forwarding available in DSM 7.x

Before You Start: Prerequisites

Check these items before installing the package:

  1. Static IP on the NAS. Go to DSM > Control Panel > Network > Network Interface, select your primary interface (usually eth0 or bond0), click Edit, and set a static IP. A DNS server must not change its own IP address — if it does, every device pointing to it breaks.
  2. DSM version. DNS Server package requires DSM 6.2 or later. DSM 7.x is strongly recommended; it ships with a newer BIND and has better UI for conditional forwarding and DNSSEC.
  3. Port 53 not in use. If you run Pi-hole or AdGuard Home as a Docker container on the same NAS, port 53 will conflict. You must either stop that container or configure it to listen on a different port before installing DNS Server.
  4. Firewall rules. Under DSM > Control Panel > Security > Firewall, allow TCP and UDP on port 53 from your LAN subnet.

Step 1: Install the DNS Server Package

  1. Open Package Center from the DSM desktop.
  2. In the search bar, type DNS Server.
  3. Click Install. The package is free and published by Synology.
  4. After installation, open it from Main Menu > DNS Server. The package opens its own management interface within DSM.
💡 After setup, use the DNS Propagation Checker to verify your internal zones are resolving correctly from multiple vantage points, or to confirm that your public-facing domain records haven't been disrupted by your new split-horizon configuration.

Step 2: Enable the DNS Service

The DNS Server interface opens on the Overview tab. At the top, toggle Enable DNS Server to ON. Before saving, configure the basics on the Settings tab:

  • Limit queries from: Enter your LAN subnet (e.g., 192.168.1.0/24). This restricts recursive queries to internal clients only — critical for security. Without this, your NAS becomes an open DNS resolver that can be abused for amplification attacks.
  • Enable forwarders: Check this box and add your upstream resolvers. Good choices: 1.1.1.1 and 1.0.0.1 (Cloudflare), or 8.8.8.8 and 8.8.4.4 (Google). Learn more about these options at Google Public DNS documentation.
  • Enable DNSSEC validation: In DSM 7.x, there is a checkbox under Settings for DNSSEC. Enable it to validate responses from upstream resolvers.

Click Apply to save. The DNS service starts immediately.

Step 3: Create a Forward Lookup Zone

A forward zone maps hostnames to IP addresses for your internal domain. Example: home.lan.

  1. Go to the Zones tab and click Create > Master Zone.
  2. Domain Type: Forward Zone.
  3. Domain Name: Enter your internal domain, e.g., home.lan. Avoid using .local — it conflicts with mDNS/Bonjour. Use .lan, .internal, or a subdomain of a domain you actually own.
  4. Primary DNS Server: Enter the NAS's own static IP (e.g., 192.168.1.10).
  5. Serial Format: Leave as Date (YYYYMMDDNN). BIND increments this automatically.
  6. Click OK to create the zone.

Now click on the zone you just created, then click Resource Record to add DNS records:

  • A record for the NAS itself: Name = nas, Type = A, IP = 192.168.1.10. This resolves nas.home.lan.
  • CNAME for DSM: Name = dsm, Type = CNAME, Canonical = nas.home.lan. (trailing dot is required — it denotes an absolute FQDN).
  • A record for your router: Name = router, Type = A, IP = 192.168.1.1.
  • Wildcard A record (optional): Name = *, Type = A, IP = your NAS or reverse proxy IP. Useful if you run a reverse proxy like Nginx Proxy Manager.

Step 4: Create a Reverse Lookup Zone

Reverse zones enable PTR lookups — translating IP addresses back to hostnames. Many logging tools and SMTP servers rely on working PTR records.

  1. Go to Zones > Create > Master Zone.
  2. Domain Type: Reverse Zone.
  3. Network Address: Enter your subnet in reverse notation. For 192.168.1.0/24, enter 1.168.192 — DSM appends .in-addr.arpa automatically.
  4. Primary DNS Server: NAS IP again.
  5. Click OK.

Open the reverse zone and add PTR records:

  • Name = 10 (the last octet), Type = PTR, Host = nas.home.lan. (trailing dot required)
  • Name = 1, Type = PTR, Host = router.home.lan.

Step 5: Configure Conditional Forwarders (Optional but Recommended)

If you have a second internal domain — say your work VPN uses corp.example.com — you can tell the Synology DNS to forward queries for that domain specifically to the corporate DNS server, while handling all other queries through your public forwarders.

  1. In the Zones tab, click Create > Forwarder Zone.
  2. Domain Name: corp.example.com
  3. Forwarder IP: Your corporate DNS server IP (e.g., 10.0.0.1).
  4. Click OK.

This is split-horizon DNS in practice: your internal clients use Synology DNS for everything, but queries for corp.example.com are silently forwarded to the right place.

Step 6: Point Your Clients to the Synology DNS

The DNS server is useless if nothing uses it. You have two options:

Option A: Set DNS on Your Router (Recommended)

Set the NAS IP as the primary DNS server in your router's DHCP settings. Every device on the network will receive it automatically. The exact path varies by router brand:

  • ASUS: 192.168.1.1 or asusrouter.com > LAN > DHCP Server > DNS Server 1
  • TP-Link (Archer): tplinkwifi.net or 192.168.0.1 > Advanced > Network > DHCP Server > Primary DNS
  • Netgear Orbi: orbilogin.com > Advanced > Setup > Internet Setup > Domain Name Server (DNS) Address — note Orbi also has a separate LAN DNS field under Advanced > LAN Setup
  • Linksys: linksyssmartwifi.com > Router Settings > Local Network > DHCP Reservations > Static DNS
  • Netgear (non-Orbi): routerlogin.net > Advanced > Setup > LAN Setup > Use Router as DNS Proxy — disable this, then set DNS manually
  • OpenWrt: Network > DHCP and DNS > General Settings > DNS forwardings: add your NAS IP. Or edit /etc/config/dhcp directly.

Option B: Set DNS Manually on Individual Devices

Useful for testing before rolling out network-wide:

  • Windows: Settings > Network & Internet > [adapter] > Edit DNS > Manual > IPv4 Preferred DNS
  • macOS: System Settings > Network > [interface] > Details > DNS > Add server
  • Linux (systemd-resolved): Edit /etc/systemd/resolved.conf, set DNS=192.168.1.10, then run sudo systemctl restart systemd-resolved
  • iOS: Settings > Wi-Fi > [network] > Configure DNS > Manual
  • Android: Settings > Network & Internet > Wi-Fi > [network] > Pencil icon > Advanced > IP settings: Static > DNS 1

Step 7: Verify with CLI Commands

Never assume a DNS server is working — verify it. Run these commands from a client that's pointing to your Synology DNS:

# Test forward lookup (replace with your NAS IP and domain) nslookup nas.home.lan 192.168.1.10 # Or with dig: dig @192.168.1.10 nas.home.lan A # Reverse lookup: dig @192.168.1.10 -x 192.168.1.10 # Verify forwarder is resolving public domains: dig @192.168.1.10 example.com A # Linux with systemd-resolved — check which DNS is active: resolvectl status # Windows — confirm DNS server in use: ipconfig /all | findstr "DNS Servers"

Expected output from dig @192.168.1.10 nas.home.lan A should show a NOERROR status and your NAS IP in the ANSWER SECTION. If you see SERVFAIL, check forwarder settings. If you see NXDOMAIN, the A record in the zone is missing or the zone name doesn't match.

💡 Use the DNS Lookup tool to check public-facing records for your domain and confirm that your split-horizon setup isn't accidentally leaking internal zone data to external resolvers.

Common Misconfigurations and Fixes

SERVFAIL on All Queries

Usually caused by DNSSEC validation failing against a forwarder that doesn't support it, or the NAS can't reach the forwarder. Check: DNS Server > Settings > Forwarder — confirm the forwarder IPs are reachable. Temporarily disable DNSSEC validation to isolate the cause.

Internal Names Resolve but Public Names Don't

Forwarder is not configured or the NAS firewall is blocking outbound port 53. Run dig @1.1.1.1 example.com from the NAS via SSH to confirm outbound DNS works. Check DSM > Control Panel > Security > Firewall for outbound rules.

PTR Records Not Returning Hostnames

The reverse zone domain name is wrong. The zone for 192.168.1.x must be named 1.168.192.in-addr.arpa. In the Synology GUI, enter 1.168.192 in the Network Address field — do not add .in-addr.arpa yourself or the zone name gets doubled.

Clients Still Using Old DNS After Router Change

DHCP leases cache the old DNS server IP. Force a renewal: Windows — ipconfig /release && ipconfig /renew; macOS — disconnect and reconnect Wi-Fi; Linux — sudo dhclient -r && sudo dhclient. The new DNS server won't take effect until leases are refreshed.

Port 53 Conflict with Docker

If you see the DNS Server package fail to start, run this SSH command to check what's holding port 53:

sudo ss -tulnp | grep ':53'

Stop the conflicting container or change its DNS listen port, then restart the DNS Server package from Package Center.

DNS-over-TLS Forwarding in DSM 7.x (2026 Considerations)

DSM 7.2 and later support DNS-over-TLS (DoT) for upstream forwarders. This encrypts DNS queries between your NAS and the upstream resolver, preventing your ISP from logging your DNS traffic. To enable it:

  1. Go to DNS Server > Settings > Forwarder.
  2. Enable DNS over TLS.
  3. Set forwarder to 1.1.1.1 with TLS hostname cloudflare-dns.com, or 8.8.8.8 with hostname dns.google.
  4. Click Apply.

Note: DoT uses port 853. Confirm outbound port 853 is not blocked by your ISP or perimeter firewall. Verify with:

curl -v --doh-url https://cloudflare-dns.com/dns-query https://example.com

IPv6 Considerations

If your network uses IPv6 (common with modern ISPs in 2026), add AAAA records in your forward zone and create a reverse zone for your IPv6 prefix under ip6.arpa. The Synology DNS Server GUI supports IPv6 zones natively — create a Reverse Zone and enter your prefix in the Network Address field. For link-local IPv6, DNS is less useful; focus on GUA (Global Unicast Address) or ULA prefixes.

How to Back Up and Restore DNS Configuration

Synology DNS Server stores its BIND configuration in /var/packages/DNSServer/target/named/. Zone files live in /var/packages/DNSServer/target/named/syno_zones/. Back up this directory via SSH or Hyper Backup (include the @appdata/DNSServer shared folder). To restore, copy the files back and restart the DNS Server package. This is especially important before DSM upgrades, which can occasionally reset package configurations.

Preventing Recurrence: Operational Best Practices

  • Use a secondary DNS. If the NAS reboots, clients lose DNS resolution. Set a secondary DNS (your router IP or a public resolver) as a fallback in your DHCP server settings so clients aren't completely stranded.
  • Set up monitoring. Use Synology's built-in Log Center to watch for BIND errors, or configure an external monitor to query your NAS DNS on port 53 every minute.
  • Document your zone records. Export your zone files after major changes. BIND zone files are plain text — readable and easy to diff.
  • Increment serials manually for slave setups. If you add a secondary/slave DNS server later, always increment the SOA serial number after changes, or zone transfers will silently fail.
  • Don't use .local as your domain suffix. mDNS (used by Apple devices, Chromecasts, and many IoT devices) owns .local. DNS queries for .local go to mDNS first and your BIND server will often be ignored.

A properly configured Synology DNS server is one of the most valuable infrastructure improvements you can make to a home lab or small office network. It gives you predictable hostname resolution, clean logs, and a foundation for more advanced setups like local certificate issuance and internal service discovery — all from hardware you already own. The setup takes under 30 minutes and the DNS Server package has been stable across DSM versions for years. The RFC governing the DNS protocol itself — RFC 1035 — is still the definitive reference if you want to understand why BIND behaves the way it does at a protocol level.