Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-Hosting DNS

ghostdev.xyz

Post reply on HN
Print view View original

61–70 of 72 posts

Re: Self-Hosting DNS

#61

Post by tmottabr »

sulandor wrote: post #59
tmottabr wrote: post #56

Earlier quoted context omitted.

DNS and all the overall infra should do whatever the owner of the infra want it to do. If i as the network admin don't want you to access some site i will block it, and blocking it at DNS level is one of the ways i have to achieve this and if i catch you trying to circumvent it you will be booted from my network in no time. That is what local DNS servers are for and what solutions like Pi-Hole and AdGuard Home were d…

well, there is certainly a lot to be said for efficiently checking boxes. just wanted to point out that dns-level blocking introduces a discrepancy to a shared truth, which creates problems and is hence more costly than it might appear.

Don't know what shared truth you are referring too.. truth is totally relative...

I have stuff that i can only access inside my home network, so here the truth is one.. Out in the internet those same addresses do not exist, so out there the truth is another..

This is also the same for most, if not all, enterprises, there is always stuff that can only be accessed either on the internal network or via VPN..

There are address that point to different endpoints depending on the network you are connected, and this is by design, again the network wide google safe search is an example.

Same thing for streaming services and CDN's, the same address will return a different endpoint depending on your location..

This happen even for direct IP address without using DNS, Quad9 for example have dozens of servers that provide service to the address 9.9.9.9 for their DNS Server, so depending on your location the same IP address will connect you to a different server that is located closer to you to ensure fast access.

DNS like anything in the network and in computing in general can cause problem if not done correctly.. But then the problem is how it was implemented not the dns blocking or redirecting functionalities on themselves..

Re: Self-Hosting DNS

#62

Post by zuntaruk »

packetlost wrote: post #55
zuntaruk wrote: post #52

Earlier quoted context omitted.

Depending on your definition of "Dynamic DNS", you could check out PowerDNS.

I mean specifically in the RFC2136 ( https://datatracker.ietf.org/doc/html/rfc2136 ) sense. It does look like PowerDNS supports it: https://doc.powerdns.com/authoritative/dnsupdate.html

TIL more about Dynamic DNS Update. Thanks!

Re: Self-Hosting DNS

#63

Post by globular-toast »

swiftcoder wrote: post #37
globular-toast wrote: post #16

Earlier quoted context omitted.

Yes but to the root servers, not to someone else's cache.

I don't really see how this scales, on a global basis. Sure, one or two of us running our own resolvers isn't going to hurt, but an extra hundred million or so resolvers would hurt -> at best just causes all the servers targeted by the resolver to add more layers of caching

Replying again as I did some research. It turns out there aren't actually only 13 root name servers, there are almost 2000. Also, the vast majority of queries to the root servers are from badly configured systems that aren't caching results properly or aren't even receiving the results. So running your own caching resolver, assuming it's working correctly, would contribute to the small drop in the ocean that is legitimate usage of the root servers. Presumably the same applies to the next levels up too.

Re: Self-Hosting DNS

#64

Post by sulandor »

tmottabr wrote: post #61
sulandor wrote: post #59

Earlier quoted context omitted.

well, there is certainly a lot to be said for efficiently checking boxes. just wanted to point out that dns-level blocking introduces a discrepancy to a shared truth, which creates problems and is hence more costly than it might appear.

Don't know what shared truth you are referring too.. truth is totally relative... I have stuff that i can only access inside my home network, so here the truth is one.. Out in the internet those same addresses do not exist, so out there the truth is another.. This is also the same for most, if not all, enterprises, there is always stuff that can only be accessed either on the internal network or via VPN.. There are a…

> But then the problem is how it was implemented not the dns blocking or redirecting functionalities on themselves..

redirection and managing your horizons aside, my objection lies with the use for content blocking, because it is the wrong tool for the job.

cheers

Re: Self-Hosting DNS

#65

Post by onlyspaceghost »

johnea wrote: post #60

Aparently signing up for a subscription service now qualifies as "self-hosting" 8-) I've been running bind9 on a computer under my desk for about 20 years. The only subdscription required is an ISP contract that includes static IP. Maybe I'll get a netflix acct (never had one), and "self-host" some videos...

The post was about self-hosting, not about the subscription. I do think the subscription is a good way to do it though!

Re: Self-Hosting DNS

#66

Post by onlyspaceghost »

creesch wrote: post #21
ThePowerOfFuet wrote: post #6

>I wanted to be able to access it with a static IP, and I don’t feel like calling my ISP to get one. Not "feeling like" calling your ISP to get a static IP, but also wanting to self-host?

I don't think calling the ISP was actually what they didn't feel like doing. It is more the call itself. Being put on queue with wait music, dealing with first line customer support who have no clue what you are asking, waiting to be connected to the right support, being connected to the wrong support, being put on hold again, suddenly being hung up on, rinse, repeat. Which is a whole different type of mental challen…

> I don't think calling the ISP was actually what they didn't feel like doing. It is more the call itself. Being put on queue with wait music, dealing with first line customer support who have no clue what you are asking, waiting to be connected to the right support, being connected to the wrong support, being put on hold again, suddenly being hung up on, rinse, repeat.

Exactly this... we have enough issues with our internet I didn't want to add this into the mix - especially as if they decide to not really give me a static IP, then I have to change it everywhere :/

I trust my VPS provider far more than my ISP

Re: Self-Hosting DNS

#67

Post by onlyspaceghost »

Alifatisk wrote: post #45
progbits wrote: post #39

Earlier quoted context omitted.

Half of the article is literally a comparison between pihole and adguard...

Really? Because what I got out from the article was a table that did a comparison then the rest of the was focused towards AdGuard. But I found a thread on r/selfhosted that was more about comparing these two.

I apologise that it wasn't as clear as it could've been! What I was trying to get at is that for my requirements Pi-hole simply can't do it all without faff (DoH being the main one).

Re: Self-Hosting DNS

#68

Post by onlyspaceghost »

endre wrote: post #23
voytec wrote: post #18

Earlier quoted context omitted.

Agree. Title got me hoping for a description of reasonably-solved public zones self-hosting. The actual content is not interesting to me, and reads like an ad for something called AdGuard (I use unbound for most of this).

same here, bait title as it is

I haven't gotten this deep into it yet, but I hope to! It's very interesting - will try to be clearer next time :D /gen

Re: Self-Hosting DNS

#69

Post by onlyspaceghost »

voytec wrote: post #18
bananapub wrote: post #11

DNS resolver , which it is deeply silly to not include in the title.

Agree. Title got me hoping for a description of reasonably-solved public zones self-hosting. The actual content is not interesting to me, and reads like an ad for something called AdGuard (I use unbound for most of this).

> reads like an ad for something called AdGuard (I use unbound for most of this).

Definitely not an AD - it's just the best option that I found, and have been super happy with it! There are lots of ways to do this (people have shared even more options in the comments here), and for a lot of people AdGuard/Pi-hole/... are the relatively easier options

Post reply on HN