If you have an active DNSimple web UI session (or API key) you can change your root nameservers by hitting their web tier directly at
50.31.213.210.
We've successfully switched our domains over to nsone.net.
DNSimple DDOS Attack
21–30 of 120 posts
Re: DNSimple DDOS Attack
#22What are the recommended practices to prevent too much down time when your DNS provider goes down?
You can use two or more DNS providers, but if you do try not to list more than two name servers from any one provider when you delegate. You should also take care to do the same in your own zones "NS" record set. Some providers don't let you change the NS record set, so avoid those providers.
The reason for this is that resolvers will generally try at least three different name servers before giving up, so if you have three or more from a single provider that may not help.
There is also a big caveat to consider: once you use two more providers, whenever you need to make rapid DNS changes for your own availability reasons you will need to wait for the slowest-to-update provider.
Re: DNSimple DDOS Attack
#23DNS is so straightforward, so easily distributed, and so fundamental, that I'm always astounded when it's a single point of failure for so many operations.
I wonder how many of the affected companies do have redundant appservers and load balancers, but missed this piece of the puzzle...
Re: DNSimple DDOS Attack
#24For anyone else who needs to mitigate this in a hurry: Set up a new account on another host that does ALIAS records (I used pointDNS) Create your new record without much in it Change your nameservers on your domain now - they'll take time to propagate Fill in the records on your domain. If you can't remember them, print out most of your existing records with dig yourdomain.com ANY Add the rest of the records to point…
For those with a more deterministic bent: "propagation" time has a maximum bound of your TTL, which will show with any dig queries.
Re: DNSimple DDOS Attack
#25For anyone else who needs to mitigate this in a hurry: Set up a new account on another host that does ALIAS records (I used pointDNS) Create your new record without much in it Change your nameservers on your domain now - they'll take time to propagate Fill in the records on your domain. If you can't remember them, print out most of your existing records with dig yourdomain.com ANY Add the rest of the records to point…
Publishing an incomplete copy of your zone seems like a bad idea, an ANY dig at the zone apex is going to retrieve less than 30% of the records (on average) for real-world zones. Negative responses in DNS are cacheable - so you can easily poison yourself.
If you really really want to do it anyway, most caches use either the TTL on your SOA record, or the final field in the SOA record as the negative cache TTL; so lower both of those values to something like 60 seconds.
Re: DNSimple DDOS Attack
#26Anyone switching from DNSimple? I really don't want to, but we've been down for almost 3 hours. I've seen chatter about Cloudfare and it looks pretty good, reviews?
We switched periscope.io from DNSimple to Amazon Route 53. DNSimple doesn't have an exporter so it took about an hour, including having one engineer review the other engineer's work.
Many customers were able to resolve the domain in the minutes immediately following the switch, and the rest seem to be trickling in.
Re: DNSimple DDOS Attack
#27[deleted]
Re: DNSimple DDOS Attack
#28For anyone else who needs to mitigate this in a hurry: Set up a new account on another host that does ALIAS records (I used pointDNS) Create your new record without much in it Change your nameservers on your domain now - they'll take time to propagate Fill in the records on your domain. If you can't remember them, print out most of your existing records with dig yourdomain.com ANY Add the rest of the records to point…
For those with a more deterministic bent: "propagation" time has a maximum bound of your TTL, which will show with any dig queries.
Propagation is bound at the DNS TTL plus whatever time it takes your DNS provider/setup to relay records to all of its authoritative servers.
Re: DNSimple DDOS Attack
#29DNS is so straightforward, so easily distributed, and so fundamental, that I'm always astounded when it's a single point of failure for so many operations. I wonder how many of the affected companies do have redundant appservers and load balancers, but missed this piece of the puzzle...
exactly my thought. the year is 2014 and DNS is least of my problems, since 1999 or something...
Re: DNSimple DDOS Attack
#30DNS is so straightforward, so easily distributed, and so fundamental, that I'm always astounded when it's a single point of failure for so many operations. I wonder how many of the affected companies do have redundant appservers and load balancers, but missed this piece of the puzzle...
dns is less easily distributed when fancy features like ALIAS (which dnsimple is widely known for) are in the mix. and wide distribution isn't enough to win vs truly volumetric attacks. it takes a lot of ports and compute to absorb 100Gbps+ attacks which are not uncommon against major providers.