Paul Vixie thinks more people should be running their own DNS servers

However, even if we did switch everyone to running their own DNS resolvers, what would happen then? Without the massive shared caching we have today, the load would significantly increase on the authorative DNS servers for each domain. Even with client local caching.

So the number of companies running their own authorative DNS servers would probably decrease — more of them would be using hosted DNS provided by a third party. A lot of companies host the authorative DNS of their domains with a third party big already. Including myself — I use Cloudflare for all my sites because of the HTTP caching and other things they offer on top of hosted DNS.

Increased load on authorative servers will likely lead to further centralization of DNS hosting with a few big providers IMO. Because even a lot companies that specialize in hosting DNS might not be able to handle the load when everyone is running their own resolver. Only the big DNS hosting companies will be able to afford it. So we end up with everyone hosting DNS with a few DNS hosting providers — Cloudflare, Amazon Route 53, etc.

So by decentralizing the DNS resolvers that clients use, you push companies to centralize the authorative DNS servers further. The net effect is that you will only have shifted where in the resolution the queries centralize.

And let’s say that this happens and Google sees the amount of queries received by 8.8.8.8 drop to near zero over night. Odds are that if Google values the data they gain from clients using these resolvers, they will make a big push to ensure that they host the DNS for as many companies as possible, so that they still end up with their hands on the query data. (And Google does value this data — otherwise they wouldn’t still be offering public DNS query servers.)

And also, what about the root servers? Will they be able to handle the massive increase in load? And won’t the root server traffic be subject to surveillance by state actors wanting to know what sites someone is browsing?

DNS is kind of funny because in a way it is both centralized and decentralized at the same time. But if you want the web to be truly decentralized I believe for the reasons stated above that having people run their own DNS resolvers is not part of the solution.

You are going to have to replace DNS altogether. Realistically I don’t think DNS is going away anytime soon. The web and the internet in general is too reliant on it. But I really wish we could.

The server kept running out of memory and shutting down MySQL so my sites stopped working. I started to learn how to read logs and saw that there is a huge amount of malicious activity directed at my server all the time.

Yesterday I installed Fail2ban which meant installing postfix. I got it working (took most of the day) but I can't send emails to my gmail account because I need to set up dkim and dmarc and other stuff. I have a list. But first I have to learn how to do all this stuff.

I use Fedora every day at work but I'm obviously no sysadmin and you are so right. All this takes hours and hours to learn and then to stay on top of it. When I was on shared hosting I had a lot less control and options but it was a lot easier as well.

What originally made the Internet amazing was the participatory nature of it. As it started 'standardizing' or 'accruing', autonomy was lost in the pursuit of efficiency.

Today, 2-3 corporations are just trying to own the internet, and this needs to stop. I favour a participation in the Internet than what it is today.

Okay, so how can we make it happen?

- Make a decent DNS Server in Go/Rust/.

- Make this embeddable in routers/open stacks, maybe in OpenWRT.

- Make it easier to define top level zones/domains in a modern, easy data format (maybe JSON/YAML). Make this an overlay/augment format.

- Publish bootstrap corpus of data for such independent DNS servers; No, they do not need to have all the root server content updated as frequently. It could be easy to sync this periodically with a git pull. This should be an internet-wide mirrored effort, like Bitcoin.

- Isolate oneself from people, arguments and organizations who want to use AWS/Google/ because they work at scale and are cheap. One should know that to have an independent internet, the change starts with the self.

- Run the DNS server at home, production, *cloud and protect the Internet.

Edit: I should add that the slowness wasn't a peak hour thing, it was consistent, all day, for several months.

Switching made my subjective experience better.