Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is secondary DNS setup worth it?

news.ycombinator.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Ask HN: Is secondary DNS setup worth it?

#11

Post by donmcronald »

toast0 wrote: post #10
donmcronald wrote: post #7

I’d like to add.. Does anyone provide low volume secondary dns for cheap? Cloudflare would be my first pick, but: > Secondary DNS is only available to Enterprise customers. For more details on activation and pricing, contact your account team. I recently hit the 150 host limit on Namecheap’s DynDNS and I wanted to see if I could set up a hidden primary DNS server that takes updates from something web based like nsupd…

How cheap is cheap? How low volume is low volume? You could run secondary DNS on a VPS anywhere. Won't be anycast of course, but won't be hard to make work either. I see lots of articles about fly.io's anycast platform, but I'm not affiliated and haven't tried anything, but they do have a page about UDP services (which don't work on IPv6 right now according to their documentation) and mention DNS. It looks like it ta…

Really cheap. Lol. Maybe $50 ish per year and then I’d just tolerate exposing my bind server. Low volume is very low since most queries would be for monitoring where the DNS lookups could be done locally to the hidden primary.

Cloudflare looked super appealing because I could spin everything up in Docker containers and expose the web based part via Cloudflare Tunnel which would keep my self hosted infrastructure completely hidden.

It’s tempting to just write something that runs on Cloudflare TBH.

Re: Ask HN: Is secondary DNS setup worth it?

#12

Post by wiml »

I'm always confused that anybody doesn't have secondary servers, for anything larger than a one-off vanity site.

If your DNS needs are simple, then running a secondary is extremely easy. The hardest part is that you'll probably interact with it so rarely you'll forget it's there.

If your DNS needs are complex, then running a secondary is harder but it's still probably a small fraction of the effort you're putting into the primary server.

Re: Ask HN: Is secondary DNS setup worth it?

#13

Post by master_crab »

Secondary DNS is great for failover. I run dual piholes in a primary-secondary setup for that purpose.

The only issue you will run into is if your router can’t pass two DNS server addresses, or your client machines don’t know how to handle multiple DNS servers or failover behavior.

Re: Ask HN: Is secondary DNS setup worth it?

#14

Post by toast0 »

donmcronald wrote: post #11
toast0 wrote: post #10

Earlier quoted context omitted.

How cheap is cheap? How low volume is low volume? You could run secondary DNS on a VPS anywhere. Won't be anycast of course, but won't be hard to make work either. I see lots of articles about fly.io's anycast platform, but I'm not affiliated and haven't tried anything, but they do have a page about UDP services (which don't work on IPv6 right now according to their documentation) and mention DNS. It looks like it ta…

Really cheap. Lol. Maybe $50 ish per year and then I’d just tolerate exposing my bind server. Low volume is very low since most queries would be for monitoring where the DNS lookups could be done locally to the hidden primary. Cloudflare looked super appealing because I could spin everything up in Docker containers and expose the web based part via Cloudflare Tunnel which would keep my self hosted infrastructure comp…

At your budget, I'd run authoritative DNS on the free tier at a few clouds. If you can get one resolver in east US, west US and Europe, that'll be pretty ok.

Re: Ask HN: Is secondary DNS setup worth it?

#15

Post by wahern »

toast0 wrote: post #9
wahern wrote: post #4

> I'm afraid that it would be difficult to maintain configuration across multiple DNS providers A secondary host should be able to pull zones from the primary using standard AXFR, optionally using TSIG authentication. The primary can also notify a secondary using DNS NOTIFY for near instantaneous synchronization. For some of my domains I prefer hosting primary myself, along with e-mail, web, etc. I just find it easie…

> Your domain registrar is the gatekeeper for glue NS records, so if your primary DNS host[1] ever had a sustained down period, it's still relatively simple and fast to update your nameservers as needed. It's simple, but not exactly fast. .com and .net glue records have a TTL of 2 days, so expect significant delay. Different tlds have different times though, .org is only 1 hour, and I'm not looking up anything else ;…

Good point, I forgot about TTLs in the recursive chain.

How common is it for recursive resolvers to cache glue records? Is it more common for in-bailiwick NS domains?

(This issue exists regardless of setup, so I hope the OP and others aren't dissuaded from exploring their options.)

Re: Ask HN: Is secondary DNS setup worth it?

#16

Post by toast0 »

wahern wrote: post #15
toast0 wrote: post #9

Earlier quoted context omitted.

> Your domain registrar is the gatekeeper for glue NS records, so if your primary DNS host[1] ever had a sustained down period, it's still relatively simple and fast to update your nameservers as needed. It's simple, but not exactly fast. .com and .net glue records have a TTL of 2 days, so expect significant delay. Different tlds have different times though, .org is only 1 hour, and I'm not looking up anything else ;…

Good point, I forgot about TTLs in the recursive chain. How common is it for recursive resolvers to cache glue records? Is it more common for in-bailiwick NS domains? (This issue exists regardless of setup, so I hope the OP and others aren't dissuaded from exploring their options.)

I'd expect all caching recursive resolvers to cache glue records as well as the requested records. It's part of the deal; if they didn't, the root servers would have an insane load. (After all, you need to get glue records for .com, etc, too)

Of course, there's probably exceptions, and cache size is limited. I can say that some resolvers seem to cache glue records for a long time, more than the published TTL; when I switched NS records for a popular domain, we continued to get requests on the old domain for more than 4 weeks (at which point we needed to end the previous service).

Post reply on HN