Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

81–90 of 101 posts

Re: You can run a DNS server (2025)

#81

Post by rmoriz »

deltarholamda wrote: post #66
rmoriz wrote: post #31

Still running DNS without a database and immutable. Push-based deployment.

I do this as well. I have a decent number of domains in my control, but not hundreds, so editing a text file and updating a hidden master is a perfectly reasonable workflow.

I built a ruby cli (back when Thor was a thing) that does most of the stuff, but I still edit the zone itself using vim („dns edit “ launches vim). PowerDNS has nice cli to deal with DNSSEC and bind (file) backend so I don’t have to deal with it by hand.

Of course I am the only user. But YAGNI works for me.

Re: You can run a DNS server (2025)

#82

Post by rdevilla »

jcalvinowens wrote: post #80
rdevilla wrote: post #38

Earlier quoted context omitted.

> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can us…

I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072

I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.

Re: You can run a DNS server (2025)

#83

Post by Adachi91 »

I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month.

Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whatsmydns.net/ reported it could not query A names, while 30% were like "Yeah here you go" from their cache.

I fixed the glue and got everything back up, I need to write an automated script to check every day if my IP has changed and alert me to update my glue record at my registar.

I use a lot of mix and match scripts to maintain other aspects like challenges for DNS e.g. Letsencrypt, I'll use their hooks to update my DNS, resign it (DNSSEC), complete the challenge, then cleanup. My more personal domains I don't use DNSSEC so I just skip right ahead.

I quite enjoy handling my own DNS records, BIND has been really good to me and I love their `view "external"` and `view "internal"` scopes so I can give the world my authoritative records, and internally serve my intranet and other services like pihole (which sits behind BIND)

Re: You can run a DNS server (2025)

#84

Post by 0x073 »

throw0101d wrote: post #65
0x073 wrote: post #21

Earlier quoted context omitted.

"Otherwise any MitM can easily redirect users to a phishing resource." Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites. If bad actors can create valid tls certs they can solve the dnssec problem.

> If bad actors can create valid tls certs they can solve the dnssec problem. I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs. It is now mandated that public CAs have to verify DNSSEC before issuing a cert: * https://news.ycombinator.com/item?id=47392510 So if you want to reduce the risk of someone cre…

If you mean MITM between DNS Server and CA (e.g. letsencrypt), thats on a level of BGP hacking (means for me government involved) and means they can just use a CA (e.g. Fina CA 2025 with cloudflare).

I think the risk didn't change much (except for big corp/bank).

Re: You can run a DNS server (2025)

#87

Post by akdev1l »

Xylakant wrote: post #44
ssl-3 wrote: post #36

Earlier quoted context omitted.

Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefin…

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

From all this what I got is that Microsoft is connecting to some random servers not using TLS and then somehow outputting that data straight into the Nintendo Switch

Re: You can run a DNS server (2025)

#88

Post by jcgl »

tzury wrote: post #63
megous wrote: post #60

Earlier quoted context omitted.

Virtual private cloud services where you host the DNS server may also include DDoS protection.

May or may not. You open the UDP ports, you get flooded, they block all incoming traffic, and this way or another your assets are not resolvable. One must distinguish between application layer attacks HTTP/S and UDP, cloud vendors won’t protect you implicitly for network layer attacks unless you purchased such service from them.

Sure, but if the services are available, you can just purchase as-needed. If the problem never comes up, you're golden.

Re: You can run a DNS server (2025)

#89

Post by jcgl »

tzury wrote: post #57
jcgl wrote: post #43

Earlier quoted context omitted.

Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.

Large scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).

Yes, of course. But my question was why are you focusing on DNS here? Everything you've said so far is true of setting up literally any public service. Considering how cheap DNS is to serve in the common case, running an authoritative DNS server seems no less risky than running, say, a web server.

Re: You can run a DNS server (2025)

#90

Post by 1vuio0pswjnm7 »

You can also serve a root.zone on that DNS server and it does not have to a carbon copy of ICANN's root.zone. I have been doing this for over 15 years. I've tried many DNS server software projects over that time and I always come back to djbdns

Multiple comments in this thread refer to TLS certificates

Why is payment to and/or permission from a third party "necessary" to encrypt data in transit over the a computer network, whether it's a LAN or an internet. What does this phoney "requirement" achieve

For example, why is it "necessary" to purchase a domain name registration from an "ICANN-approved" registrar in order to use a TLS certificate

Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication". What purpose does _purchasing_ a registration serve. For example, similar to "free" Let's Encrypt certificates, domain names could also be "free"

Whatever "authentication" ICANN and its "approved" registries and registrars are doing, e.g., none, is it possible someone else could do it better using a different approach

This comment is not asking for answers to these questions; the question are rhetorical. Of course the questions may trigger defensive replies; everyone is entitled to an opinion and opinions may differ

Post reply on HN