Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zerigo DNS services down for 6+ hours due to massive DDoS

zerigostatus.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#31

Post by jbarham »

slig wrote: post #15

What are the main advantages of paying for DNS hosting like Zerigo or SlickDNS instead of using the one provided for free with web host companies (E.g. Linode's DNS Manager)?

FWIW the SlickDNS name servers are hosted by Linode so I'm a fan of their server hosting. For DNS management, the Linode interface is fine if you have a handful of domains with simple configurations, but beyond that it's unwieldy IMHO.

I'd say the main reason to use a DNS hosting service is to consolidate your DNS management for all of your domains regardless of registrars or server hosting providers. E.g., I personally have domains registered with 5 registrars and use two server providers. And because they specialize in DNS, DNS hosting providers should have superior interfaces, APIs and support for DNS hosting compared to generalist hosting providers.

The SlickDNS interface has two features in particular that I haven't seen in any other DNS hosting service: automatic management of "alias domains" and mapping IP addresses to named servers. See https://www.slickdns.com/features/ for details.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#32

Post by cbsmith »

I can totally buy DDoS flooding network capacity, but I'm befuddled these days by statements saying the servers are "under load", which typically means "out of CPU". It's kind of hard for me to imagine even an i5 not being able to saturate a gigE line with DNS lookups (yes, it is a lot of packets, but it can be done) unless DNSSec is going on. Even 10gigE, if you can amortize interrupts, seems like it'd not be hard to saturate with today's hardware.

What am I missing here?

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#33

Post by PonyGumbo »

aeden wrote: post #30
PonyGumbo wrote: post #28

Earlier quoted context omitted.

Your pricing looks amazing - but it looks like you had an outage this morning too. Can you talk about that?

Yes, we had a short outage this morning. We're still investigating the root cause but the symptoms were essentially a simultaneous slow down across all name servers. It's quite possible this is part of the same DDoS that Zerigo is facing, we're not certain - we've been seeing lots of spikes today from various IP addresses (but we've actually been seeing similar patterns for quite some time, as have other DNS provider…

Thanks for your quick response. I'll follow up in an email with some additional questions about moving over my domains.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#34

Post by aeden »

latch wrote: post #29

Seems like if you are serious about mitigating this type of issue (as a consumer), you really should be specifying name servers from different providers. Your primary DNS server can be from dnsimple/zerigo/dnsmadeeasy and your secondary can be route53, or you could run your own. The only problem seems to be keeping them in sync. Seems like you'd have to poll the primary (using whatever API it exposes) to update the s…

Ideally your primary provider would support AXFR and NOTIFY which are part of the DNS zone transfer protocol. It's something we're working on adding to DNSimple, but we're not quite ready to launch it yet. The primary and secondary providers also both need to report the correct authoritative name server delegation details so the primary needs to ensure that that data is in the zone file.

There is another challenge in that we're pushing the envelope a bit by offering features that rely on more than just a DNS record (for example ALIAS and POOL records). These are useful features for some people, but if you're using these types of features then they won't be portable to secondary providers.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#35

Post by swatermasysk »

aeden wrote: post #14

I run DNSimple ( https://dnsimple.com ) and we have a full REST API and support domain registrations, transfers and SSL certificates as well. Plus we have an ALIAS record type that's very useful for pointing your apex to services where they only provide a hostname. I'll be happy to answer any questions you have regarding our service either here or through our support channels.

Another big fan of DNSimple here. Been with them for over a month and the services and support have been great.

Even more impressive is we have directed a couple very non-technical customers to them and they all have been able to get up and running in no time.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#36

Post by _phred »

aeden wrote: post #27
latch wrote: post #26

Earlier quoted context omitted.

I know there's much love for DNSimple, but this is the first time that I can remember when the top comment of an X is down post is a competitor essentially posting an advert with no insight on the OP.

I tried to add some insight on another comment, but it's tough to say anything about DDoS that hasn't already been said. DDoS attacks suck, mitigating them requires a multi-prong approach and proactive monitoring and agressive banning and even then you can still be screwed if your bandwidth is saturated. I feel for the operational folks at Zerigo - dealing with this type of outage is hard. The best thing they can do…

And DNS is, by definition, critical.

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#38

Post by gaia »

Best thing Zerigo could do for their customers at this point is export all zone information and email it to them or make available for DL. I have a feeling this is going to be a long outage. In the meanwhile, here is a great list of free DNS providers (dont get caught without a secondary DNS provider): http://www.lowendtalk.com/wiki/free-dns-providers

Re: Zerigo DNS services down for 6+ hours due to massive DDoS

#39

Post by jlecour »

aeden wrote: post #14

I run DNSimple ( https://dnsimple.com ) and we have a full REST API and support domain registrations, transfers and SSL certificates as well. Plus we have an ALIAS record type that's very useful for pointing your apex to services where they only provide a hostname. I'll be happy to answer any questions you have regarding our service either here or through our support channels.

I'm not (yet) an actual customer of DNSimple, but I know literally half of the team and I can vet for them, both humanly and technically.

That said, I don't know anything about Zerigo and I have no opinion about them.

Post reply on HN