Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Network Solutions' DNS was down

networksolutions.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Network Solutions' DNS was down

#31

Post by jeltz »

area51org wrote: post #24
simonsarris wrote: post #20

Honest question from a networking beginner: So suppose right now I've got two name servers configured, NS93.worldnic.com and NS94.worldnic.com. These are down as they're the part of the Network Solution's name servers that are having issues. If I had added more, for instance if I used Amazon's Route53 and added two name servers of theirs in addition to the *.worldnic.com ones, would my site be reachable right now?

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to the next.

Also you as always have to be careful and make sure that all DNS servers have the same content or else you will get weird bugs.

Re: Network Solutions' DNS was down

#32

Post by thejosh »

area51org wrote: post #24
simonsarris wrote: post #20

Honest question from a networking beginner: So suppose right now I've got two name servers configured, NS93.worldnic.com and NS94.worldnic.com. These are down as they're the part of the Network Solution's name servers that are having issues. If I had added more, for instance if I used Amazon's Route53 and added two name servers of theirs in addition to the *.worldnic.com ones, would my site be reachable right now?

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to the next.

Wouldn't a delay be better than full downtime?

Re: Network Solutions' DNS was down

#33

Post by pilif »

esw wrote: post #21
pilif wrote: post #16

This is one of the reasons why I self-host DNS. Even with tons of users, the resources it takes to serve DNS requests pale compared to what you have to put behind your application servers. Of course if you are using a CDN to provide your users with better locality, you might want to look into a service that provides localized DNS distribution, but the inherent caching feature of the DNS protocol might make that an un…

This is workable for small sites, but are you really equipped to deal with a denial of service attack? There are plenty of small DNS providers (Zerigo comes to mind) that can't even stay up during attacks.

I would assume that sites affected by a Network Solutions downtime would qualify as small(ish) sites because the big ones have other solutions anyways. Also, it's much easier to deal with a DOS on DNS than with a DOS on your app servers. If you can handle it for your app servers, you'll be able to handle if for DNS.

If not, well, then you're down anyways.

Re: Network Solutions' DNS was down

#35

Post by thejosh »

pilif wrote: post #16

This is one of the reasons why I self-host DNS. Even with tons of users, the resources it takes to serve DNS requests pale compared to what you have to put behind your application servers. Of course if you are using a CDN to provide your users with better locality, you might want to look into a service that provides localized DNS distribution, but the inherent caching feature of the DNS protocol might make that an un…

What happens when someone doesn't like you and decides to DDoS your DNS servers?

Though if it's only your site on the DNS Servers, they might as well just DDoS your website.

Re: Network Solutions' DNS was down

#36

Post by nevir »

thejosh wrote: post #35
pilif wrote: post #16

This is one of the reasons why I self-host DNS. Even with tons of users, the resources it takes to serve DNS requests pale compared to what you have to put behind your application servers. Of course if you are using a CDN to provide your users with better locality, you might want to look into a service that provides localized DNS distribution, but the inherent caching feature of the DNS protocol might make that an un…

What happens when someone doesn't like you and decides to DDoS your DNS servers? Though if it's only your site on the DNS Servers, they might as well just DDoS your website.

Well, what happens if someone doesn't like your registrar and DDoS' them?

Do both.

Re: Network Solutions' DNS was down

#37

Post by muraiki »

mikegirouard wrote: post #11

This[0] FB post is the best I can come up with as an explanation. > Yesterday, some Network Solutions customer sites were compromised. The funny thing is, they have a link in their post going back to their site, which of course doesn't work. [0]: https://www.facebook.com/networksolutions/posts/101514668014...

That explains my friend's site yesterday. Requests to his site sometimes resulted in the display of a banner page by "Islamic Ghosts Team," but not all the time. I noticed that Network Solutions was apparently running Apache 2.2.22, which has a few security flaws (I'm pretty sure he doesn't use a VPS).

Re: Network Solutions' DNS was down

#39

Post by thejosh »

nevir wrote: post #36
thejosh wrote: post #35

Earlier quoted context omitted.

What happens when someone doesn't like you and decides to DDoS your DNS servers? Though if it's only your site on the DNS Servers, they might as well just DDoS your website.

Well, what happens if someone doesn't like your registrar and DDoS' them? Do both.

You would hope that a registrar would have better bandwidth and/or capabilities to protect against that then what you would generally have for your server(s).

Re: Network Solutions' DNS was down

#40

Post by colmmacc »

area51org wrote: post #24
simonsarris wrote: post #20

Honest question from a networking beginner: So suppose right now I've got two name servers configured, NS93.worldnic.com and NS94.worldnic.com. These are down as they're the part of the Network Solution's name servers that are having issues. If I had added more, for instance if I used Amazon's Route53 and added two name servers of theirs in addition to the *.worldnic.com ones, would my site be reachable right now?

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to the next.

(I work on Route 53).

We've done a lot of experiments on this one and we've found that the most common resolvers make 3 tries to 3 different servers by default. At first those servers are picked at random, but over time the resolvers usually "home in" on what the least-latent nameserver is. Once they do, and have a good round-trip-time estimate for how long it takes to respond, they stay using it. But they have a hair-trigger; if the nameserver doesn't respond, they'll very quickly fall-back to trying the other nameservers.

In practice what that means is that up to two of your nameservers may be completely unresponsive and the effects will be pretty negligible. So if you're using multiple DNS providers and want to protect against one going off-air; use no more than two nameservers from each provider.

That said, for all of the reasons above, and some more, the Route 53 SLA currently only applies if you use all four Route 53 nameservers.

Post reply on HN