Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Infrastructure at GitHub

githubengineering.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: DNS Infrastructure at GitHub

#11

Post by logicalstack »

antoncohen wrote: post #10
logicalstack wrote: post #3

Earlier quoted context omitted.

This was a roughly six month project for a single engineer working around 75% of the time on it, with help from other folks along the way for code reviews and etc. The first three months was research, planning, implementation, etc and the latter three months was a very careful roll out and migration from the old system to the new and finally decommissioning the old system.

Do you still run a local caching DNS daemon on every server? If not, why the change?

Yes, we still use local caches on each host.

Re: DNS Infrastructure at GitHub

#12

Post by nik736 »

logicalstack wrote: post #6
bogomipz wrote: post #4

Earlier quoted context omitted.

I noticed PowerDNS in the mix, can you say what backend you are using with PowerDNS and how that has been?

We use the mysql backend and http API, a few small nits but for our purposes it has worked very well thus far. Note that our authorities never see production traffic outside of AXFRs from our "edge" hosts so I can't say how well it works for other use cases.

What's the reason you've chosen MySQL over the bind backend when you are using the API anyways? I have to make a similar decision soon and I am not really sure yet, any insight would be appreciated.

Re: DNS Infrastructure at GitHub

#13

Post by logicalstack »

nik736 wrote: post #12
logicalstack wrote: post #6

Earlier quoted context omitted.

We use the mysql backend and http API, a few small nits but for our purposes it has worked very well thus far. Note that our authorities never see production traffic outside of AXFRs from our "edge" hosts so I can't say how well it works for other use cases.

What's the reason you've chosen MySQL over the bind backend when you are using the API anyways? I have to make a similar decision soon and I am not really sure yet, any insight would be appreciated.

Full access (read and write) to the PowerDNS HTTP API requires one of their generic SQL backends (via https://docs.powerdns.com/md/httpapi/README/), such as MySQL. The bind backend only supports reading from the API, changes to zones would need to be done on the file system and/or using pdns_control. Beyond that having all our records queryable via SQL has been nice for debugging and researching our own DNS records, types and etc. Lastly, backends like the MySQL one allow for things like auto generating serials and adding comments to the DNS data.

Re: DNS Infrastructure at GitHub

#14

Post by tedivm »

I'm curious if they're using DNSSec at all. I notice they're using Dynect for this, and in my experience DNSSec and Dyn do not get along (unless you're not using any of their special features like geotargeting), so it I'm interested in hearing how they've managed to get all that working.

Re: DNS Infrastructure at GitHub

#15

Post by betaby »

tedivm wrote: post #14

I'm curious if they're using DNSSec at all. I notice they're using Dynect for this, and in my experience DNSSec and Dyn do not get along (unless you're not using any of their special features like geotargeting), so it I'm interested in hearing how they've managed to get all that working.

$ dig +dnssec github.com will give the answer and the answer is NO.

Re: DNS Infrastructure at GitHub

#16

Post by codazoda »

I don't see any mention of HTTPS support for custom domains. I wonder if this helps move the needle on that. I had moved a lot of project hosting to my paid GitHub account but SSL has become a necessity (SEO and privacy) so I'm launching sites on Digital Ocean again. I'd love to have less server config to do though.

Re: DNS Infrastructure at GitHub

#18

Post by ktta »

tedivm wrote: post #14

I'm curious if they're using DNSSec at all. I notice they're using Dynect for this, and in my experience DNSSec and Dyn do not get along (unless you're not using any of their special features like geotargeting), so it I'm interested in hearing how they've managed to get all that working.

I'm curious why people ask about DNSSEC support. None of the major browsers support validating it.

Even to validate the DNSSEC records by yourself, there is only a single website available[1] (which doesn't even have TLS). I want DNSSEC to catch up, but adoption level is a joke.

[1]:http://dnsviz.net

Re: DNS Infrastructure at GitHub

#19

Post by chrisfosterelli »

codazoda wrote: post #16

I don't see any mention of HTTPS support for custom domains. I wonder if this helps move the needle on that. I had moved a lot of project hosting to my paid GitHub account but SSL has become a necessity (SEO and privacy) so I'm launching sites on Digital Ocean again. I'd love to have less server config to do though.

Not everyone loves this approach, but putting Cloudflare in front of Github pages works great for getting easy SSL.

Re: DNS Infrastructure at GitHub

#20

Post by Habbie »

voltagex_ wrote: post #17

>We configured zone stubs in the caching daemon to direct queries locally rather than recurse on the internet. What does this mean?

It means that for those zones, they explicitly put the IPs of the edge servers in their resolver (Unbound) configuration, so that lookups of names in those zones don't have to go the root servers and then the TLD (like .com) servers, only to find out that the authority (the edge servers in their design) are in the next rack. Instead they will go directly to those edges. This gives them "Addtionally, public zones are completely resolvable within our network without needing to communicate with our external providers. This means any service that needs to look up api.github.com can do so without needing to rely on external network connectivity."
Post reply on HN