Live data from Hacker News

DNSimple DDOS Attack

dnsimplestatus.com

111–120 of 120 posts

Re: DNSimple DDOS Attack

#112
post #88

Earlier quoted context omitted.

They're in ServerCentral's datacenter and ServerCentral is very much multi homed. They wouldn't gain anything by doing native BGP to all these peers in the exact same datacenter when SC's backbone will handle this stuff for them.

Doing native BGP would allow them to anycast, which would increase their reliability and allow them to sink traffic much more easily. DDOS traffic sink starts announcing your AS and anycast IP block close to the traffic source, sinking that traffic and allowing real traffic through.

I'm pretty sure they're only in one of Server Central's datacenters. Anycast won't help. That's why I said they don't gain anything by directly peering.

Re: DNSimple DDOS Attack

#113
post #98

Earlier quoted context omitted.

Using a WWW subdomain with CNAMEs accomplishes effectively the same thing as using ALIAS on an apex domain name, and doesn't rely on anything out-of-spec or proprietary, making it easier to serve redundantly. (Did you ever wonder why google.com and facebook.com redirect to www?) (Or is there more to ALIAS than that, which wasn't on the page in GP? Happy to be corrected if so)

you're correct about ALIAS (although practically, it doesn't matter: people are going to use the apex whether it's proper or not at this point). i'm more referring to other complex usually-proprietary capabilities of big dns providers, especially traffic routing features. routing semantics are generally not translatable across providers, and if you're using dns based routing (as most cdns, major web properties, etc a…

Yeah, that's a fair point. I'm not sure of a good fix for that, either.

Re: DNSimple DDOS Attack

#114
post #37

Earlier quoted context omitted.

hi. i did not mean to spam or kick dnsimple, we know them and they are a great company and service. we are actively receiving inbound queries about this from folks asking for help, so thought it made sense to chime in publicly here. but you're right, i should have kept it on topic to the discussion at hand instead of offering anything else up. you're not wrong: in this industry you never kick your competitors when th…

dsl (1402 days old, 4664 karma) - beevek (123 days old, 4 karma). beevek you just lost our business.

That seems a little extreme; perhaps what he did was in poor taste, but to use karma and account age as an barometer for your business decisions seems crazy (or an arbiter in an internet catfight).

Re: DNSimple DDOS Attack

#115
post #85

Earlier quoted context omitted.

Cool. Do you need a provider that supports 'zone transfers'? Or is that only to keep things in sync automatically ?

> Do you need a provider that supports 'zone transfers'? No. > Or is that only to keep things in sync automatically? Yes.

I replicated our DNS on DNSMadeEasy, which I've used in the past on a very high-traffic website. They have an incredible track record for uptime. And they're really cheap.

We manually exported our DNS configuration from DNSimple as a single file and imported it to DNSMadeEasy. Pretty easy transition, although we have to make future changes in two places.

I set 2 nameservers on the old host and 2 on the new, and am keeping that configuration for automatic failover in the future. The DNS propagated fairly quickly and our site was up and running for many users within an hour. Glad that's over with.

Re: DNSimple DDOS Attack

#116
post #81

Earlier quoted context omitted.

Can you use custom nameservers with your service?

AWS Route 53 has added vanity DNS in the last few weeks, so you can make your DNS servers appear to be ns0.yourdomain.com rather than ns153.awsdomain.com (or whatever) However, making your DNS servers to be responsible for serving their own DNS is a bit of an extra complexity and risk that no customer will ever care about..

Nice. Got a link for this one?

Re: DNSimple DDOS Attack

#117
post #116

Earlier quoted context omitted.

AWS Route 53 has added vanity DNS in the last few weeks, so you can make your DNS servers appear to be ns0.yourdomain.com rather than ns153.awsdomain.com (or whatever) However, making your DNS servers to be responsible for serving their own DNS is a bit of an extra complexity and risk that no customer will ever care about..

Nice. Got a link for this one?

It was oddly snuck into the private DNS announcement

http://aws.amazon.com/blogs/aws/route-53-update-private-dns-...

"You can create generic "white label" name servers such as ns1.example.com and ns2.example.com, use them in your delegation set, and point them to your actual Route 53 name servers."

Re: DNSimple DDOS Attack

#118
post #102

DNSimple is my registrar and (was my only) DNS provider. Now that they're back up I've exported the zone file and imported it to route 53 for redundancy in case this happens again. I also I updated the name servers in DNSimple to be 2 route 53, and 2 DNSimple, in that order. Is that the right way to do it? Does the order of the NS records matter? I set them up so that they're in the same order in both places.

That should be right. I'm doing the same thing with CloudFlare. However, it appears that DNSimple won't keep your secondary name servers in the order entered. They are showing for me sorted alphabetically. Apparently, they are working on providing this (http://blog.dnsimple.com/2014/12/incident-report-ddos/) for failover in case of an event like this again.
Post reply on HN