Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSimple DDOS Attack

dnsimplestatus.com

Post reply on HN
Print view View original

91–100 of 120 posts

Re: DNSimple DDOS Attack

#91

Post by tortilla »

jredburn wrote: post #56
aberoham wrote: post #21

If you have an active DNSimple web UI session (or API key) you can change your root nameservers by hitting their web tier directly at 50.31.213.210. We've successfully switched our domains over to nsone.net.

Even without an active session, I was able to get this working by adding an entry to my /etc/hosts file with that IP and dnsimple.com.

Thanks for the tip! Switched to NSONE.

Re: DNSimple DDOS Attack

#92

Post by toomuchtodo »

zuccs wrote: post #85
robvolk wrote: post #82

Earlier quoted context omitted.

Yes - that should work. I'm about to make that change to bring back our site. 2 on one name server, 2 on another.

Cool. Do you need a provider that supports 'zone transfers'? Or is that only to keep things in sync automatically ?

> Do you need a provider that supports 'zone transfers'?

No.

> Or is that only to keep things in sync automatically?

Yes.

Re: DNSimple DDOS Attack

#93

Post by toomuchtodo »

dentarg wrote: post #60
joshdotsmith wrote: post #42

Earlier quoted context omitted.

Will these services not have the same thin pipe issue that's currently affecting DNSimple?

Not that I have any reliable info, but what I've heard, DNS Made Easy is a pretty stable and established DNS provider. They brag about "99.9999% uptime history" at http://www.dnsmadeeasy.com/technology/ . Though they doesn't seem as innovative and nice as DNSimple. Really hope things work out for DNSimple (really like the idea of their beta feature GitHub sync).

Old DnsMadeEasy customer here (used them for several years before moving to AWS). They were rock solid. We used them for hosting DNS for major cruise lines (fancy, very fancy ones), as well as other large Fortune 500 clients.

Their interface is pretty bad, but the backend is hardy.

Re: DNSimple DDOS Attack

#94

Post by toomuchtodo »

scott_karana wrote: post #71
beevek wrote: post #44

Earlier quoted context omitted.

good luck finding any major online property or infrastructure that isn't making use of some kind of proprietary syntactical dns sugar. it doesn't mean you can't span providers, but it does mean it takes a lot more work to do so. anyway, you're not wrong, the best approach to mitigate this kind of thing is to leverage multiple dns networks. but doing so is not easy unless the application is still using dns like it was…

Using a WWW subdomain with CNAMEs accomplishes effectively the same thing as using ALIAS on an apex domain name, and doesn't rely on anything out-of-spec or proprietary, making it easier to serve redundantly. (Did you ever wonder why google.com and facebook.com redirect to www?) (Or is there more to ALIAS than that, which wasn't on the page in GP? Happy to be corrected if so)

You're right, but people want to get fancy with hosting at the apex (domain.com), even though it kills important functionality (CNAMES) forcing the adoption of hacks (ALIAS and ANAME records).

Re: DNSimple DDOS Attack

#95

Post by toomuchtodo »

feld wrote: post #88
chrisbolt wrote: post #65

Earlier quoted context omitted.

It's surprising that they're appear to not be multihomed... http://bgp.he.net/AS32771 Unlike Dyn or CloudFlare: http://bgp.he.net/AS33517 http://bgp.he.net/AS13335

They're in ServerCentral's datacenter and ServerCentral is very much multi homed. They wouldn't gain anything by doing native BGP to all these peers in the exact same datacenter when SC's backbone will handle this stuff for them.

Doing native BGP would allow them to anycast, which would increase their reliability and allow them to sink traffic much more easily. DDOS traffic sink starts announcing your AS and anycast IP block close to the traffic source, sinking that traffic and allowing real traffic through.

Re: DNSimple DDOS Attack

#96

Post by toomuchtodo »

asstonian wrote: post #18
beck5 wrote: post #11

What are the recommended practices to prevent too much down time when your DNS provider goes down?

have multiple providers? VPSs aren't expensive and setting up bind9 or bind10 or whatever authoritative name serving daemon isn't rocket science (well, you CAN do it wrong). my experience shows, that at least 3 servers with 3 different providers is good enough. and "providers" I mean different company, city, datacenter, transit provider... trusting single entity with anything (even if they say that they have many ser…

My god no. Don't even waste your time with VPSs and BIND.

* Get accounts with AWS (Route 53), dnsmadeeasy, and cloudflare.

* Monitor resolution at all of their name servers

* Either proactively spread your authoritative nameservers across providers, or update your root NS records based on your monitoring.

Re: DNSimple DDOS Attack

#97

Post by allr »

webandtech wrote: post #83

Free solution that worked for me: Set up a free account on cloudflare.com, duplicate all dns records (thankfully I have a simple setup)... but next time I will keep a backup zone file! FYI - Instead of an Alias record on DNSimple, CloudFlare will allow a CNAME record for the root domain using "CNAME flattening". You can now set CloudFlare's DNS service to "bypass Cloudfare" on all records by clicking the icon so you…

Anybody can shed some light on the difference between "CNAME flattening" and ALIAS?

Re: DNSimple DDOS Attack

#98

Post by beevek »

scott_karana wrote: post #71
beevek wrote: post #44

Earlier quoted context omitted.

good luck finding any major online property or infrastructure that isn't making use of some kind of proprietary syntactical dns sugar. it doesn't mean you can't span providers, but it does mean it takes a lot more work to do so. anyway, you're not wrong, the best approach to mitigate this kind of thing is to leverage multiple dns networks. but doing so is not easy unless the application is still using dns like it was…

Using a WWW subdomain with CNAMEs accomplishes effectively the same thing as using ALIAS on an apex domain name, and doesn't rely on anything out-of-spec or proprietary, making it easier to serve redundantly. (Did you ever wonder why google.com and facebook.com redirect to www?) (Or is there more to ALIAS than that, which wasn't on the page in GP? Happy to be corrected if so)

you're correct about ALIAS (although practically, it doesn't matter: people are going to use the apex whether it's proper or not at this point). i'm more referring to other complex usually-proprietary capabilities of big dns providers, especially traffic routing features. routing semantics are generally not translatable across providers, and if you're using dns based routing (as most cdns, major web properties, etc are) then doing multi-network dns gets a lot harder. if you're amazon, you write and maintain a bunch of code to span providers. if you're not, the barrier to multi-network is high if you're doing more than static dns.

Re: DNSimple DDOS Attack

#100

Post by beevek »

allr wrote: post #97
webandtech wrote: post #83

Free solution that worked for me: Set up a free account on cloudflare.com, duplicate all dns records (thankfully I have a simple setup)... but next time I will keep a backup zone file! FYI - Instead of an Alias record on DNSimple, CloudFlare will allow a CNAME record for the root domain using "CNAME flattening". You can now set CloudFlare's DNS service to "bypass Cloudfare" on all records by clicking the icon so you…

Anybody can shed some light on the difference between "CNAME flattening" and ALIAS?

they are essentially the same thing -- both are "proprietary" names for the same feature, which is behind-the-scenes recursive CNAME chain lookups by the authoritative nameserver, to return A records directly.
Post reply on HN