What are the recommended practices to prevent too much down time when your DNS provider goes down?
DNSimple DDOS Attack
11–20 of 120 posts
Re: DNSimple DDOS Attack
#12We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings). Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone. Not perfect or permanent, but we…
How are you exporting the zone with things as they are?
Oof, really good point – I suppose I got lucky in that I was at dnsimple.com just a few hours ago for other purposes. Their DNS was still cached for me, and it all worked flawlessly. I didn't even suspect their outage extended to their web servers, though that makes perfect sense.
FWIW, the IP I have cached is 50.31.213.210.
Re: DNSimple DDOS Attack
#13What are the recommended practices to prevent too much down time when your DNS provider goes down?
My site is currently offline from this attack. I am considering that providers like DNSimple simply cannot provide the networking availability to mitigate these kinds of attacks. This is because the solution to these kinds of attacks, often, is that you need a larger pipe than the attackers. Very few people are good at both and having a huge pipe. For web apps, you can use CloudFlare, which does have a bigger pipe and is designed to mitigate this. But DNS is not a web app, so you can't just put DNSimple behind CloudFlare.
Hence, I'm going to try CloudFlare (assuming they take over DNS hosting, I need to check) and Google Cloud DNS, because then all parts of my site (from DNS to CSS hosting) will be with providers with bigger pipes than attackers can create. Hopefully that will prevent this kind of attack from taking my site down.
Re: DNSimple DDOS Attack
#14For anyone else who needs to mitigate this in a hurry:
Set up a new account on another host that does ALIAS records (I used pointDNS)
Create your new record without much in it
Change your nameservers on your domain now - they'll take time to propagate
Fill in the records on your domain. If you can't remember them, print out most of your existing records with
dig yourdomain.com ANY
Add the rest of the records to pointDNS
Wait for the new Nameservers to propagate (0-24 hours - it took 15-30 min for us on a small-medium traffic domain today during sales crunch)
Re: DNSimple DDOS Attack
#15We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings). Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone. Not perfect or permanent, but we…
FYI you can use ALIAS records without a 301 redirect if the ALIAS is to an ELB.
Re: DNSimple DDOS Attack
#16We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings). Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone. Not perfect or permanent, but we…
A few people do ALIAS style records, DNSMadeEasy and EasyDNS do "ANAME" records which are pretty much the same.
Re: DNSimple DDOS Attack
#17We can watch this happen live @ http://map.ipviking.com/ Fascinating traffic floods from various locations, but the attack is not continuous.
Noticed a lot of hits to St. Louis, where they're based. Do you think this has anything to do with the attacks?
Re: DNSimple DDOS Attack
#18What are the recommended practices to prevent too much down time when your DNS provider goes down?
have multiple providers? VPSs aren't expensive and setting up bind9 or bind10 or whatever authoritative name serving daemon isn't rocket science (well, you CAN do it wrong).
my experience shows, that at least 3 servers with 3 different providers is good enough. and "providers" I mean different company, city, datacenter, transit provider...
trusting single entity with anything (even if they say that they have many servers blabla... geologically blabla...)... well, you have situation like this right now :)
Re: DNSimple DDOS Attack
#19Anyone switching from DNSimple? I really don't want to, but we've been down for almost 3 hours. I've seen chatter about Cloudfare and it looks pretty good, reviews?
Re: DNSimple DDOS Attack
#20We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings). Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone. Not perfect or permanent, but we…
FYI you can use ALIAS records without a 301 redirect if the ALIAS is to an ELB.
[deleted]