4 ms·

This was a roughly six month project for a single engineer working around 75% of the time on it, with help from other folks along the way for code reviews and e

This was a roughly six month project for a single engineer working around 75% of the time on it, with help from other folks along the way for code reviews and etc. The first three months was research, planning, implementation, etc and the latter three months was a very careful roll out and migration from the old system to the new and finally decommissioning the old system.

bogomipz 9y ago
I noticed PowerDNS in the mix, can you say what backend you are using with PowerDNS and how that has been?
- logicalstack 9y ago
  We use the mysql backend and http API, a few small nits but for our purposes it has worked very well thus far. Note that our authorities never see production traffic outside of AXFRs from our "edge" hosts so I can't say how well it works for other use cases.
  - bogomipz 9y ago
    Thanks!
  - nik736 9y ago
    What's the reason you've chosen MySQL over the bind backend when you are using the API anyways? I have to make a similar decision soon and I am not really sure yet, any insight would be appreciated.
    - logicalstack 9y ago
      Full access (read and write) to the PowerDNS HTTP API requires one of their generic SQL backends (via https://docs.powerdns.com/md/httpapi/README/ https://docs.powerdns.com/md/httpapi/README/), such as MySQL. The bind backend only supports reading from the API, changes to zones would need to be done on the file system and/or using pdns_control. Beyond that having all our records queryable via SQL has been nice for debugging and researching our own DNS records, types and etc. Lastly, backends like the MySQL one allow for things like auto generating serials and adding comments to the DNS data.
  - Habbie 9y ago
    PowerDNS developer here - any nits we should know about?
chrxr 9y ago
Thanks very much for the reply. Very useful. I think these kinds of details really help people in other organizations who might want to undertake similar projects.
pbarnes_1 9y ago
Do queries to github.net stay internal or do you also sync github.net zones to Route53/Dynect ... just in case? We have a similar setup with unbound and nsd (no need for powerdns for us). Even then it took a while to get it right because JVM apps especially love to hang for no reason doing NS lookups. You also need to specify -Dnetworkaddress.cache.ttl= etc since they don't listen to TTLs. Running unbound on every single machine has saved us a lot of downtime.
- logicalstack 9y ago
  Nearly all of our internal zones are internal and not sync'd to an external provider. In a few cases we need to perform lookups of internal zones external to our network and those zones live both internal and external.
antoncohen 9y ago
Do you still run a local caching DNS daemon on every server? If not, why the change?
- logicalstack 9y ago
  Yes, we still use local caches on each host.

bogomipz 9y ago

I noticed PowerDNS in the mix, can you say what backend you are using with PowerDNS and how that has been?

logicalstack 9y ago
We use the mysql backend and http API, a few small nits but for our purposes it has worked very well thus far. Note that our authorities never see production traffic outside of AXFRs from our "edge" hosts so I can't say how well it works for other use cases.
- bogomipz 9y ago
  Thanks!
- nik736 9y ago
  What's the reason you've chosen MySQL over the bind backend when you are using the API anyways? I have to make a similar decision soon and I am not really sure yet, any insight would be appreciated.
  - logicalstack 9y ago
    Full access (read and write) to the PowerDNS HTTP API requires one of their generic SQL backends (via https://docs.powerdns.com/md/httpapi/README/ https://docs.powerdns.com/md/httpapi/README/), such as MySQL. The bind backend only supports reading from the API, changes to zones would need to be done on the file system and/or using pdns_control. Beyond that having all our records queryable via SQL has been nice for debugging and researching our own DNS records, types and etc. Lastly, backends like the MySQL one allow for things like auto generating serials and adding comments to the DNS data.
- Habbie 9y ago
  PowerDNS developer here - any nits we should know about?

chrxr 9y ago

Thanks very much for the reply. Very useful. I think these kinds of details really help people in other organizations who might want to undertake similar projects.

pbarnes_1 9y ago

Do queries to github.net stay internal or do you also sync github.net zones to Route53/Dynect ... just in case? We have a similar setup with unbound and nsd (no need for powerdns for us). Even then it took a while to get it right because JVM apps especially love to hang for no reason doing NS lookups. You also need to specify -Dnetworkaddress.cache.ttl= etc since they don't listen to TTLs. Running unbound on every single machine has saved us a lot of downtime.

logicalstack 9y ago
Nearly all of our internal zones are internal and not sync'd to an external provider. In a few cases we need to perform lookups of internal zones external to our network and those zones live both internal and external.

antoncohen 9y ago

Do you still run a local caching DNS daemon on every server? If not, why the change?

logicalstack 9y ago
Yes, we still use local caches on each host.