5 ms·

But who runs a DNS server? 99% of users only do DNS resolution and for that you don't need to run a DNS server on your system.

• kuschku 9y ago
  Many people run a DNS server to cache DNS responses locally. And they don’t want to expose the DNS server publicly. systemd-resolved does that, you can’t even expose it accidentally. But many distros actually install a DNS server by default, usually unbound or BIND9, and while some bind it to localhost, many bind it to all interfaces. As you said, that’s not necessary for most users, yet, major distros do it.
  • deleted 9y ago
    [deleted]
  • pgl 9y ago
    Which distros install a DNS server (and enable it) by default? I've never seen this.
    • deleted 9y ago
      [deleted]
    • barrkel 9y ago
      dnsmasq has been installed as a local DNS cache on Ubuntu and other Debian derivatives for many years. /etc/resolv.conf normally points at localhost.
      • deleted 9y ago
        [deleted]
      • dsp1234 9y ago
        It only listens on localhost though (127.0.1.1 by default), so it's not possible for it to be abused for dns amplification attacks.
        • dom0 9y ago
          IIRC dnsmasq still listens on all interfaces for some reason
          • afuchs 9y ago
            I thought DNS was connectionless? Don't all DNS clients have to bind to UDP port 53 to function correctly?
            • smhenderson 9y ago
              It's not the port that matters; it's the interface. A caching DNS service for a simple desktop experience should only be listening for queries on the localhost interface (lo).
          • kuschku 9y ago
            Which is exactly the issue I mentioned. You get on some distros by default something that that makes you subject to DNS amplification attacks.
            • dom0 9y ago
              It is supposed to reject requests from the addresses it does not listen on. I just found it strange that it binds on all interfaces regardless.
              • kuschku 9y ago
                I’ve noticed it respond with an error packet – which ended up being used for DNS Amplification nonetheless.
    • equalunique 9y ago
      FreeBSD has named. In 9.0 it's BIND. In 10.0 & 11.0 it's Unbound.
      • petre 9y ago
        You need to explicitly enable it, and it only listens on localhost by default.
  • qb45 9y ago
    > cache DNS responses locally I believe there is a built-in solution in glibc: http://prefetch.net/blog/index.php/2011/03/27/configuring-nscd-to-cache-dns-host-lookups/ http://prefetch.net/blog/index.php/2011/03/27/configuring-ns...