DNSimple target of DDoS attack • Hacker News Board

Re: DNSimple target of DDoS attack

#11

Post by yesimahuman » Mon, Jun 03, 2013, 2:17 PM UTC

whafro wrote: post #7

yesimahuman wrote: post #4

Ah, got bitten by this. Just added Route 53 as redundancy, should have done that a long time ago.

Are you doing this manually? I make solid use of DNSimple's ALIAS record type, which is also supported by Route 53, but DNSimple says they don't support AXFRs ( http://support.dnsimple.com/articles/master-slave-support ).

Honestly, I'm not a DNS pro, but I added more nameservers in our registrar to point to R53 nameservers, then setup R53 to point to our Heroku app w/ alias support by following this guide: https://devcenter.heroku.com/articles/route-53

Re: DNSimple target of DDoS attack

#12

Post by davidradcliffe » Mon, Jun 03, 2013, 2:23 PM UTC

dexcs wrote: post #2

That makes sense. rubygems.org was down for me for a few minutes....

We're working on adding some redundancy!

Re: DNSimple target of DDoS attack

#13

Post by soci » Mon, Jun 03, 2013, 2:37 PM UTC

robotmay wrote: post #9

soci wrote: post #5

DNSimple seems the best way to go if you want to host your service with Heroku using a root domain (no www at the beginning of the domain name) [1]. Unfortunately, DNSimple is now the weakest layer of our stack. And at http://KiteBit we are suffering it right now! [1] https://devcenter.heroku.com/articles/custom-domains#root-do... )

Yep, I just got whacked by this at https://www.photographer.io (www is working at least). Guess I've learnt my lesson about using the root domain. However I'm glad this happened whilst I was still beta testing! My CloudFront stack was pointing at the root domain, which was stupid. Fixed that now.

We were not so lucky.

We have a URL forwarding set to www that points to out root domain so we are completely down.

Re: DNSimple target of DDoS attack

#14

Post by robotmay » Mon, Jun 03, 2013, 2:47 PM UTC

soci wrote: post #13

robotmay wrote: post #9

Earlier quoted context omitted.

Yep, I just got whacked by this at https://www.photographer.io (www is working at least). Guess I've learnt my lesson about using the root domain. However I'm glad this happened whilst I was still beta testing! My CloudFront stack was pointing at the root domain, which was stupid. Fixed that now.

We were not so lucky. We have a URL forwarding set to www that points to out root domain so we are completely down.

I've just switched over to Route 53 as this attack is still ongoing. Alas the DNS is one of the last things you think about when building an app, you just assume that it's going to work and entirely forget it exists while it is working :\

Re: DNSimple target of DDoS attack

#15

Post by robotmay » Mon, Jun 03, 2013, 2:59 PM UTC

jwarzech wrote: post #10

Our site (and others) seem to still be working through the 'www' domain. We have had nothing but great experiences with DNSimple up to this point and will probably stay customers, just sort of frustrating as we wait for our domain to resolve to another dns provider as a quick fix...

I'm having an interesting issue where my root domain is currently getting its nameserver details from DNSimple, whereas www. is getting them from iWantMyName. Hopefully that rotates around too at some point soon :\

Re: DNSimple target of DDoS attack

#16

Post by randall » Mon, Jun 03, 2013, 3:03 PM UTC

Anyone know how to make DNS redundant? Is it as simple as adding them as extra nameservers, and then copying all the records? I'm thinking about using Linode's DNS as a failover.

Re: DNSimple target of DDoS attack

#17

Post by latch » Mon, Jun 03, 2013, 3:15 PM UTC

randall wrote: post #16

Anyone know how to make DNS redundant? Is it as simple as adding them as extra nameservers, and then copying all the records? I'm thinking about using Linode's DNS as a failover.

Yes. You can do master-slave with AXFR but it doesn't seem very well supported nowadays. I remember 1 provider that let you put in your AWS credentials and they'd sync to Route53 using the API, though I can't find which one right now. Different providers offer different solutions...a lot don't offer anything.

Of course, you can always do it manually..which is fine if you have few records and they are static.

edit: Kept googling and I did find http://www.dnsly.net/ neat enough that I wanted to share it, even though I think dns providers should be doing this as part of their existing packages.

Also, although it's no guarantee, dns providers that use anycast are less susceptible (but not invulnerable) to ddos.

Re: DNSimple target of DDoS attack

#18

Post by whafro » Mon, Jun 03, 2013, 3:23 PM UTC

It's not a great long-term solution, but DNSimple has been disabling their ALIAS support, which many Heroku and AWS users are likely to depend on, especially if you use SSL.

Short term, keep your ALIAS record and add an additional A record for your root domain pointing to one of the IPs indicated by your hostname. DNSimple says they'll treat the A record as a fallback when ALIAS isn't working, and will return both sets of records when it is (https://twitter.com/dnsimple/status/341574753276002304).

For the next 3/12/24/96 hours or however long it takes for the threat to subside, this should increase your availability, and the likelihood that your A record will work for that time is probably reasonable. Longer term, you'll want to get rid of the A record.

Re: DNSimple target of DDoS attack

#19

Post by colmmacc » Mon, Jun 03, 2013, 3:26 PM UTC

randall wrote: post #16

Anyone know how to make DNS redundant? Is it as simple as adding them as extra nameservers, and then copying all the records? I'm thinking about using Linode's DNS as a failover.

There are two important steps;

1. Adding NS records to the parent zone via your registrar. E.g. if you are using example.com, when you add nameservers with your registrar they add them to the ".com" zone.

2. Update the NS records in your own copies of the zone on your DNS providers.

If your registrar is also one of your DNS providers, then both of these steps are sometimes handled in one action from your registrar - but you still need to update the NS records on the other provider.

"NS" record sets are special in DNS in that there is a copy of the NS record for a particular zone in both the parent zone and the child zone. About 8% of resolvers consider the parent zone's copy the one that matters, the other 92% honour whatever is in the child zone's.

This can lead to confusing cases where you have different NS configurations on different providers - the resolver may "stick" to whichever one it found first (as long as both providers are in the parent zone). DNS can be maddening!

Full-disclosure: I'm a Route 53 developer.

Re: DNSimple target of DDoS attack

#20

Post by robotmay » Mon, Jun 03, 2013, 4:21 PM UTC

colmmacc wrote: post #19

randall wrote: post #16

Anyone know how to make DNS redundant? Is it as simple as adding them as extra nameservers, and then copying all the records? I'm thinking about using Linode's DNS as a failover.

There are two important steps; 1. Adding NS records to the parent zone via your registrar. E.g. if you are using example.com, when you add nameservers with your registrar they add them to the ".com" zone. 2. Update the NS records in your own copies of the zone on your DNS providers. If your registrar is also one of your DNS providers, then both of these steps are sometimes handled in one action from your registrar -…

This is unfortunately a bit tricky as DNSimple doesn't let you update your NS records for the root domain with them. My computer seems to be going through DNSimple still, but Pingdom went via iWantMyName to find my new Route 53 nameservers. Not sure what I can do for now though.