Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

1–10 of 101 posts

Re: You can run a DNS server (2025)

#2

Post by gerdesj »

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME.

As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening.

Now with a domain under your own control, you can use CNAME records in other zones to point at your zones and if you have dynamic DNS support on your zones (RFC 2136) then you can now support ACME ie Lets Encrypt and Zerossl and co.

Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. However, acme.sh and simple-acme do and both are absolutely rock solid. Both of those projects are used by a lot of people and well trod.

acme.sh is ideal for unix gear and if you follow this blokes method of installation: https://pieterbakker.com/acme-sh-installation-guide-2025/ usefully centralised.

simple-acme is for Windows. It has loads of add on scripts to deal with scenarios. Those scripts seem to be deprecated but work rather well. Quite a lot of magic here that an old school Linux sysadmin is glad of.

PowerDNS auth server supports dynamic DNS and you can filter access by IP and TSIG-KEY, per zone and/or globally.

Join the dots.

[EDIT: Speling, conjunction switch]

Re: You can run a DNS server (2025)

#3

Post by 9dev »

gerdesj wrote: post #2

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…

Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.

Re: You can run a DNS server (2025)

#4

Post by adiabatichottub »

gerdesj wrote: post #2

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…

I'm a fan of uACME:

https://github.com/ndilieto/uacme

Tiny, simple, reliable. What more can you ask?

Re: You can run a DNS server (2025)

#6

Post by DaSHacka »

adiabatichottub wrote: post #4
gerdesj wrote: post #2

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…

I'm a fan of uACME: https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?

Neat, I've used lego (https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client.

acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.

Re: You can run a DNS server (2025)

#7

Post by adiabatichottub »

DaSHacka wrote: post #6
adiabatichottub wrote: post #4

Earlier quoted context omitted.

I'm a fan of uACME: https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?

Neat, I've used lego ( https://github.com/go-acme/lego ) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.

Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere.

The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.

Re: You can run a DNS server (2025)

#8

Post by adiabatichottub »

deepsun wrote: post #5

How to make it DNSSEC?

If you don't absolutely have to, then don't.

That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.

Post reply on HN