Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Network Solutions' DNS was down

networksolutions.com

Post reply on HN
Print view View original

61–65 of 65 posts

Re: Network Solutions' DNS was down

#61

Post by druiid »

rhizome wrote: post #54
druiid wrote: post #49

Earlier quoted context omitted.

You'd think that it would be a good idea... until someone decides YOU are going to be the target of a DDoS attack. I speak from experience. I have many (at least 15) years of experience dealing with DNS and hosting of it, yet when a bot-net decided to attempt to use our DNS servers for a reflection attack. Obviously the servers were setup to not allow this, but the sheer volume of the traffic making attempts was stil…

This DDoS argument really is a premature optimization, and it's very simple to implement an external primary/secondary if the problem ever does occur.

Read comment up-stream. I disagree with this standpoint and I'm sure can find you stories out there beyond mine to back up what I'm suggesting. DNS hosting as well is so inexpensive unless you're in the hundreds of millions of queries that really I see no reason to not look to hosted DNS solutions first. Even one of the premier DNS providers out there is only like $29 for a small-business plan.

Essentially, unless your website is not revenue generating (or is below the cost to make this feasible), you really should look at moving from self-hosted DNS.

Re: Network Solutions' DNS was down

#62

Post by colmmacc »

rhizome wrote: post #54
druiid wrote: post #49

Earlier quoted context omitted.

You'd think that it would be a good idea... until someone decides YOU are going to be the target of a DDoS attack. I speak from experience. I have many (at least 15) years of experience dealing with DNS and hosting of it, yet when a bot-net decided to attempt to use our DNS servers for a reflection attack. Obviously the servers were setup to not allow this, but the sheer volume of the traffic making attempts was stil…

This DDoS argument really is a premature optimization, and it's very simple to implement an external primary/secondary if the problem ever does occur.

It is simple, but it has mixed results.

There's about 10% of the internet that's using "parent centric" DNS resolvers. What that means is that when it comes to what name-servers to query for a zone; those resolvers pay more attention to what's in the parent-zone than what the child-zone lists for itself.

For that 10% of the internet; the TTL on the NS record set is out of your control - it's whatever the parent domain's policy is. Although you may have set a TTL of an hour - for nimble re-delegations on your end, you'll have to wait out the time-to-update from your registrar (usually an hour, but sometimes a business day or more, depending on the TLD) and then also update the TTL on their end. For most domains, like com and net, it's two days.

So if you need to add name-servers after a problem starts, expect it to take two+ days to fully roll out to all users.

That said, the progress follows a distribution, and you'll remediate things for many users quite sooner - but still probably not within an an availability target of even three nines per month.

Re: Network Solutions' DNS was down

#63

Post by isb »

mmmooo wrote: post #45
colmmacc wrote: post #43

Earlier quoted context omitted.

I haven't read the bind source in a long time, but my best guess is that it's in memory. http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.h... Has some details, and I believe Bind and PowerDNS call it "Smoothed RTT" or SRTT.

interesting, not a ton of details of how. off to the source I go, thanks. sounds like it assigns a 'score' of some sort to each authoritative ns.

This might help - section 4.4 has formal details on the Bind server selection algorithms: http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theo...

Re: Network Solutions' DNS was down

#64

Post by mmmooo »

isb wrote: post #63
mmmooo wrote: post #45

Earlier quoted context omitted.

interesting, not a ton of details of how. off to the source I go, thanks. sounds like it assigns a 'score' of some sort to each authoritative ns.

This might help - section 4.4 has formal details on the Bind server selection algorithms: http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theo...

yep definitely, an interesting implementation, and certainly almost impossible to guess from passive observation. thanks.
Post reply on HN