Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

21–30 of 101 posts

Re: You can run a DNS server (2025)

#21

Post by 0x073 »

deepsun wrote: post #14
adiabatichottub wrote: post #8

Earlier quoted context omitted.

If you don't absolutely have to, then don't. That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.

I consider it as basic security measure as SSL. Otherwise any MitM can easily redirect users to a phishing resource. Did DNSSEC for company website, worked with zero maintenance for several years. On a cloud-provided DNS. Would want the same on self-hosted DNS too.

"Otherwise any MitM can easily redirect users to a phishing resource."

Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites.

If bad actors can create valid tls certs they can solve the dnssec problem.

Re: You can run a DNS server (2025)

#23

Post by khoirul »

micw wrote: post #20

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

You could run it within a Tailscale VPN network. In fact Headscale (Tailscale server) has a very basic DNS server built-in.

Re: You can run a DNS server (2025)

#24

Post by Loeffelmaenn »

micw wrote: post #20

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

I just use a VPN like tailscale or wireguard. You can normally also tell clients what DNS to use when on the VPN

Re: You can run a DNS server (2025)

#25

Post by henrebotha »

WaitWaitWha wrote: post #17

Running DNSMasq on an old RasPI & USB SSD. No problems no issues. Just quietly runs in the background.

dnsmasq on an RPi Zero 2W is the backbone of my self-hosted setup. Combined with Tailscale, it gives me access from anywhere to arbitrary domains I define myself, with full HTTPS thanks to Caddy.

Re: You can run a DNS server (2025)

#26

Post by Xylakant »

khoirul wrote: post #23
micw wrote: post #20

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

You could run it within a Tailscale VPN network. In fact Headscale (Tailscale server) has a very basic DNS server built-in.

That assumes a device that can enter a VPN. I’d like to run a DNS server for a group of kids playing Minecraft on a switch. Since they’re not in the same (W)LAN, I can’t do it on the local network level. And the switch doesn’t have a VPN client.

Re: You can run a DNS server (2025)

#28

Post by dwedge »

I've been tempted by this because I self host everything else, but "adding an entry to postgres instead of using namecheap gui" is overkill, just use a DNS with an API.

Last few days I've been migrating everything to luadns format, stored in github and then I have github actions triggering a script to convert it to octodns and apply it.

I could have just used either, but I like the luadns format but didn't want to be stuck using them as a provider

Re: You can run a DNS server (2025)

#29

Post by albertgoeswoof »

micw wrote: post #20

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

It can’t be fully secure but you can use a domain or path with a uuid or similar such that no one could guess your dns endpoint, over dot or doh. In theory someone might log your dns query then replay it against your dns server though.

You could also add whitelisting on your dns server to known IPs, or at least ranges to limit exposure, add rate limiting / detection of patterns you wouldn’t exhibit etc.

You could rotate your dns endpoint address every x minutes on some known algorithm implemented client and server side.

But in the end it’s mostly security through obscurity, unless you go via your own tailnet or similar

Re: You can run a DNS server (2025)

#30

Post by albertgoeswoof »

Xylakant wrote: post #26
khoirul wrote: post #23

Earlier quoted context omitted.

You could run it within a Tailscale VPN network. In fact Headscale (Tailscale server) has a very basic DNS server built-in.

That assumes a device that can enter a VPN. I’d like to run a DNS server for a group of kids playing Minecraft on a switch. Since they’re not in the same (W)LAN, I can’t do it on the local network level. And the switch doesn’t have a VPN client.

Why do you want to do this? What would you redirect / override on this?
Post reply on HN