21–30 of 30 posts
Ah, got bitten by this. Just added Route 53 as redundancy, should have done that a long time ago.
Ah, got bitten by this. Just added Route 53 as redundancy, should have done that a long time ago.
Are you using route53 to do an alias AND have the root domain use SSL? The setup at route53 is confounding me. I thought I'd setup a CNAME www.domain.com that points to sub.herokussl.com, and than an A record Alias that points domain.com to www.domain.com. But Amazon seems to not avow that the CNAME record is a "Record Set" that I can use for this.
- domain.com ALIAS sub.herokussl.com - www.domain.com CNAME domain.com
Earlier quoted context omitted.
Are you using route53 to do an alias AND have the root domain use SSL? The setup at route53 is confounding me. I thought I'd setup a CNAME www.domain.com that points to sub.herokussl.com, and than an A record Alias that points domain.com to www.domain.com. But Amazon seems to not avow that the CNAME record is a "Record Set" that I can use for this.
That's interesting. Have you tried it the other way around? - domain.com ALIAS sub.herokussl.com - www.domain.com CNAME domain.com
https://twitter.com/scottvdp/status/341604885600534530
So I can make an Alias record to the ELB that heroku is pointing at with their SSL CNAMES.
Is anyone else seeing a sustained level of trashy DNS queries to their own servers? I've been seeing a sustained level to mine that's way above normal, for the last few days. I wonder if this is a broader problem than just DNSimple.
But it also seems as though the same advice proposed in that thread should have been used by their customers: Namely, utilize multiple DNS providers to mitigate risk, and choose providers with IP anycast. Heck, even setting up your own secondary DNS on a $5/mo cloud server would keep your site up (unless of course your site is the main target of the DDOS).
Ah, got bitten by this. Just added Route 53 as redundancy, should have done that a long time ago.
Are you using route53 to do an alias AND have the root domain use SSL? The setup at route53 is confounding me. I thought I'd setup a CNAME www.domain.com that points to sub.herokussl.com, and than an A record Alias that points domain.com to www.domain.com. But Amazon seems to not avow that the CNAME record is a "Record Set" that I can use for this.
Is anyone else seeing a sustained level of trashy DNS queries to their own servers? I've been seeing a sustained level to mine that's way above normal, for the last few days. I wonder if this is a broader problem than just DNSimple.
That's probably someone attempting to you for a DDOS reflection. Take a look at http://openresolverproject.org/ and make sure you're not providing an open resolver to the internet
Is anyone else seeing a sustained level of trashy DNS queries to their own servers? I've been seeing a sustained level to mine that's way above normal, for the last few days. I wonder if this is a broader problem than just DNSimple.
You could be an open resolver being used for reflection. You could be running DNSSEC and providing an amplification vector. You could be getting queries for another DNS server that used to have your IP. The possibilities are endless.
Is anyone else seeing a sustained level of trashy DNS queries to their own servers? I've been seeing a sustained level to mine that's way above normal, for the last few days. I wonder if this is a broader problem than just DNSimple.
Can you give an example of what 'trashy' is? You could be an open resolver being used for reflection. You could be running DNSSEC and providing an amplification vector. You could be getting queries for another DNS server that used to have your IP. The possibilities are endless.
I'm planning on moving hosting over to Route53 at some point in the next few days, because the fact that I can't figure this out other than "turn off logging" tells me I probably shouldn't be running DNS servers.