Running DNSMasq on an old RasPI & USB SSD. No problems no issues. Just quietly runs in the background.
DNSMasq is a DNS resolver, not a DNS server.
You can run a DNS server (2025)
71–80 of 101 posts
Re: You can run a DNS server (2025)
#72I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?
The article is about running your own DNS server, which is, and must, always be available to everyone. What you are talking about is running a DNS resolver, but that is not the topic.
Re: You can run a DNS server (2025)
#73Running DNSMasq on an old RasPI & USB SSD. No problems no issues. Just quietly runs in the background.
DNSMasq is a DNS resolver, not a DNS server.
It's both, and more, in a way. But it's primarily a DNS tweaking tool, and does not support things like zone transfers. Which you usually don't need with a small-scale personal setup anyway.
Re: You can run a DNS server (2025)
#74I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…
I'm a fan of uACME: https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?
I ended up vibe an ACME client for my custom TLS server.
It's a chat server but with curl. You can try it here
curl -NT. https://chat.est.im/hackernews
(Note: IPv6 only for the moment)
Re: You can run a DNS server (2025)
#75I've been running tinydns for decades now. I don't even think about it anymore.
Re: You can run a DNS server (2025)
#76How to make it DNSSEC?
If you're a masochist you can do it manually, just make sure you have a good grasp of whats going on first[1]
Simplistically you need a DS record at your registrar, then sign your zones before publishing. You can cheat and make the KSK not expire, which saves some aggravation. I've rolled my own by hand for 10 yrs with no dnssec related downtime
[1] DNSSEC Operational Practices https://datatracker.ietf.org/doc/html/rfc6781
Re: You can run a DNS server (2025)
#77I've been tempted by this because I self host everything else, but "adding an entry to postgres instead of using namecheap gui" is overkill, just use a DNS with an API. Last few days I've been migrating everything to luadns format, stored in github and then I have github actions triggering a script to convert it to octodns and apply it. I could have just used either, but I like the luadns format but didn't want to be…
I selfhost DNS as well, but I just use plain old bind zone files and it works well enough across a bunch of domains (and RFC2136 for my dynamic IP at home) that I haven't bothered to look into database stored records. I just need to remember the pesky serial number so that the changes get properly replicated :)
Re: You can run a DNS server (2025)
#78I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?
A personal DNS server provides no privacy. Even if you were using a caching resolver, it would barely even provide any obfuscation.
If you want DNS that is only for you, edit your hosts file.
Re: You can run a DNS server (2025)
#79I've found that teaching DNS is an excellent gateway to learning about how the internet itself works, especially to "green" tech folks who go blank-faced when you get into protocols, IPs, etc.
Break out a piece of mail, connect the dots, and you see their eyes light up with comprehension. "Oh, so that's how my computer gets to google.com; it's just like how my postman knows where to deliver my mail!" Then a critical component is demystified, and they want to learn more.
Running a DNS server is honestly such a good activity for folks in general.
Re: You can run a DNS server (2025)
#80I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…
> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can us…
I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate.
I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072