12 ms·

How and why I run my own DNS servers

268 points by zwischenzug 9y ago

zwischenzug 9y ago
Somebody pointed out to me that you can get a free DNS service here: https://dns.he.net/ https://dns.he.net/
- alex_hitchins 9y ago
  Still good to go through the process of setting this up and making yourself less reliant on third parties.
  - zwischenzug 9y ago
    Yes, totally agree. All the pain put the knowledge in my bones.
  - gruez 9y ago
    You're "less reliant", but chances are, you'll end up having worse reliability.
    - alex_hitchins 9y ago
      Why do you think that? There is nothing to prevent one from running two, three or four DNS servers each with different providers. The internet was designed to be decentralised and run in such a manor, no?
- JepZ 9y ago
  After dyndns.org decided to remove the free service, I was so pissed that I had to update all my devices including git checkouts etc. So I decided not to go with any free providers anymore and get my own domain instead. So far no regret.
  - j_s 9y ago
    For anyone willing to take the risk, another 3rd party service currently free was promoted on HN 6 months ago: https://news.ycombinator.com/item?id=14856277#14858784 https://news.ycombinator.com/item?id=14856277#14858784 >opie34: A friend and I put together a free dynamic DNS service [1] offering cool custom domains aimed at the Raspberry Pi community (and similar hardware hackers.) It's not strictly a hardware project, but it's a crucial building block for any network-enabled Raspberry Pi project, and we'd love your feedback. [1]: https://www.legitdns.com https://www.legitdns.com
  - cheez 9y ago
    Why didn't you just pay dyndns? That's what I did.
    - reacweb 9y ago
      It seems dyndns is €24 per year. My baremetal hosting (4 Dedicated ARM Cores, 2GB memory, 200Mbit/s Unmetered, 50GB HD) is €43.2 per year. I am not ready to pay more than €10 per year for a domain name. For the moment, I enjoy 3 free domain names from no-ip.org.
      - pnutjam 9y ago
        I use duckdns.org. They are free and simple.
    - wila 9y ago
      Not TS, but I did pay dyn for several years. The problem with them however was that they did rack up the price over time and not just a little bit. In 2006, I had to pay $9.95 for their yearly "Pro" offering. In 2008 the deal became "only $23.00 for 2 years", humm OK. Two years later in 2010 it was "$30 for 2 years", in 2012 the bill became $40.00 and when 2016 came the price was upgraded again... (yet again without any other benefits from a customer point of view) That's when I figured that it was too much and moved over to he.net. Which still is free and still works great for the dynamic DNS needed. For static DNS services I also happen to run my own DNS servers, if needed then the he.net services could be moved over to their, but not seeing the need for now.
- andmarios 9y ago
  Good thing with Hurricane Electric's service is that they also provide slave DNS capability. So you can run your own DNS master server and rely on HE for availability when your server is down or even give preference to the slave DNS, so your users can get the results quick.
- amorphid 9y ago
  +1 for Hurricane Electric's free DNS. I ordered a .ninja domain, which they didn't support at the time. I contacted customer service, and they added it within a few hours. I love service when I have a problem!
alex_hitchins 9y ago
Thinking about all the servers I've run over the years, I think DNS is one that was most satisfying in a weird way. Incredibly handy also for making amendments to a bunch of records.
JepZ 9y ago
Anybody knows why he uses ssh to update the records and not nsupdate?
- millettjon 9y ago
  Not sure in his case, but I keep my dns configuration in git and deploy over ssh git pull followed by a dns server restart. I prefer ssh as I know better how to secure that and it seems like less attack surface.
- sliken 9y ago
  I use both, ssh <host> "nsupdate -l". That way I don't trust nsupdates security model, yet I can still automate updates from any machine I choose.
craig1f 9y ago
How does this compare to pi-hole?
- moviuro 9y ago
  That's really not the point of the article. He updates the A records for his home machine that doesn't have a static IP.
  - yorby 9y ago
    the title is pretty bad for that article... I would never have guessed
- organsnyder 9y ago
  Pi-hole is a DNS resolver: it takes questions from clients, such as "what's the IP address for google.com"? And takes care of contacting an authoritative server (or passes it to downstream resolver, which does the work) to get the answer. An authoritative server is responsible for answering that same question, but it's been labeled as authoritative for a domain, via the domain registrar system. To see what servers are authoritative for a domain, you can use commands like dig or host; here's an example host command (I'm running OSX, but this should work on any *nix that has it installed): $ host -t ns ycombinator.com ycombinator.com name server ns-1411.awsdns-48.org. ycombinator.com name server ns-1914.awsdns-47.co.uk. ycombinator.com name server ns-225.awsdns-28.com. ycombinator.com name server ns-556.awsdns-05.net.
Coding_Cat 9y ago
>The YOUREMAIL.YOUREMAILDOMAIN. part must be replaced by your own email. For example, my email address: ian.miell@gmail.com becomes ianmiell.gmail.com.. Note also that the dot between first and last name is dropped. email ignores those anyway! Isn't that only the case for gmail (and maybe some others)? As an aside I'm surprised someone setting up their own dns-server would still be using gmail. I've found running my own email-server to be very useful and satisfying. (0-configuration throwaway addresses, automatic sorting with sieve, personal and professional mail on the same account, etc. etc.)
- zwischenzug 9y ago
  I haven't ever got comfortable with running mail. Interested in any good guides I haven't already read.
  - perlgod 9y ago
    I've spent years tweaking my mail server setup (Postfix, Dovecot, RSPAMD, LDAP...) and did a full writeup a few months ago. I've used other guides online but found most of the rest lacking on details. https://www.c0ffee.net/blog/mail-server-guide https://www.c0ffee.net/blog/mail-server-guide
    - j_s 9y ago
      I've submitted this for discussion and asked the mods to give you the credit you deserve for putting in so much effort! https://news.ycombinator.com/item?id=16238937 https://news.ycombinator.com/item?id=16238937
    - zwischenzug 9y ago
      That looks great, thanks.
    - herbst 9y ago
      Curious why you settled for Postfix? I know its basically the standard but its a pain to configure and modify. I recently started to work with Haraka and its so much more of a plessure (even thought i am no JS fan, i prefer JS to cryptic/ancient config files) Just curious if you went through a evaluation process
perlgod 9y ago
I've been down this route but ultimately found much more stability running BIND as a hidden master and pushing NOTIFYs to secondary nameservers (I use DNSMadeEasy) whenever the zone is modified. Supports DNSSEC as well. I wrote up my setup here: https://www.c0ffee.net/blog/dns-hidden-master https://www.c0ffee.net/blog/dns-hidden-master I host mostly static IPs, but I also use this setup with shared keys and PFSense's RFC2136 feature to push dynamic DNS updates for my home network.
- JeanMarcS 9y ago
  I’m stuck on the DNSSEC part with OVH as a registar, as they won’t let you add DNSSEC records if you don’t use their DNS. Not cool. But your post gave me an idea to try, so anyway, thank you, either it will work or not.
  - psz 9y ago
    Enable DNS zone, you don't even need to use it. Then, you'll be able to set custom DS records on a domain. I asked them. It's not a bug, it's a feature!
moviuro 9y ago
I have a similar problem, but there's just no way I'm running a DNS server in the open (amplification attacks, etc.). I was thinking of using https://icanhazip.com https://icanhazip.com + OVH's API to regularly update my A records. However, I still didn't get around to finding (or writing) a CLI for their DNS offering (it is possible, because acme.sh does it [0] -- maybe I'll just use this as a base?) [0] https://github.com/Neilpang/acme.sh/tree/master/dnsapi https://github.com/Neilpang/acme.sh/tree/master/dnsapi
- zwischenzug 9y ago
  Contact me if you want. nsupdate (mentioned below) may help also.
- herbst 9y ago
  Just a random input. I use Cloudflare for this. Mostly because changes are more or less instant. I've used Namecheap and OVH before and both could end up with longer delays (~1h)
- zzzcpan 9y ago
  > there's just no way I'm running a DNS server in the open (amplification attacks, etc.) Why not? Bind has rate limiting to make it useless for amplification attacks. You can also use smaller than 4k udp response sizes, forcing clients to switch to tcp. Nothing to be afraid of, your dns hosting provider probably does the same thing.
crims0n 9y ago
I know it is not the point of the article, but it is possible to do this with one VPS if the provider offers an API to update DNS records. I have this working with Digital Ocean: https://developers.digitalocean.com/documentation/v2/#update-a-domain-record https://developers.digitalocean.com/documentation/v2/#update...
nrki 9y ago
This is pretty simple stuff, and the two ads for your book make this look like an ad rather than something not otherwise posted on tens of other blogs.
- lisper 9y ago
  Everything is simple once you know how.
conorrr 9y ago
Good article on How, pretty bad at describing why # It’s Cheap There are plenty of cheap & free DNS hosts out there. # More Control Every DNS host I've ever used has offered full control of DNS records. If all you've ever experienced is poor shared hosting maybe this looks is something new. A why not section would be good * High latency for people who do not live near one of your servers. * Time to set up * Cost (lots of cheaper alternatives) * Some overhead. Running any server that is public facing has some overhead even if it's just installing patches. Interestingly zwischenzugs.com isn't hosted on authors own DNS (maybe a restriction of wordpress.com?)
- zwischenzug 9y ago
  Yeah, wordpress. Also my home server is for from 5 9s (but it's good enough for my services).
- upofadown 9y ago
  We are missing the most important reason: >I’ve learned a lot by doing this, probably far more than any course would have taught me. It is quite obvious that the world needs more people with a deep knowledge of how DNS works. Doing something like this is a quick and effective way to make the world a better place.
  - ksk 9y ago
    >It is quite obvious that the world needs more people with a deep knowledge of how DNS works. Doing something like this is a quick and effective way to make the world a better place. I think you're overstating your case here. I found it interesting too, and us geeks like to dabble in many things, but you can never achieve specialized knowledge and expertise through mere tinkering. Using C++ didn't make me a language designer or even an expert on C++.
    - ryandrake 9y ago
      The point is there's now one more person in the world who knows C++, which is better than there being one less person in the world who knows it. The fewer people who learn these systems, the fewer people there will be available to innovate/maintain these things going forward. Entire trades are facing slow extinction for lack of people who bothered to learn. Almost 3/4 of electrical or electronics repairmen are over 45 years old, and 30% of them are over 55 years old [1]. It would be a shame to wake up one day in 2030 and realize there are only a handful of (presumably very well paid) people on earth who know how DNS works. 1: https://www.lincolntech.edu/news/skilled-trades/baby-boomers-skilled-trades-opps https://www.lincolntech.edu/news/skilled-trades/baby-boomers...
ebbv 9y ago
This is not really a great idea. It's just adding more brittleness to your system. Leave DNS to people with distributed DNS networks and redundancy. I mean obviously you can do it if you want to, I'm not stopping you, but to me it's silly.
- zzzcpan 9y ago
  DNS is only distributed if you run it yourself, not when you rely on a centralized service.
  - zrail 9y ago
    That's... that's not what "distributed" means. DNS is distributed because it's arranged as a tree, with the root nodes delegating to the TLDs delegating to individual name servers for each zone. Just because someone chooses to use a service instead of running a nameserver themselves doesn't make DNS centralized.
    - sp332 9y ago
      I pretty sure that's not what eebv meant. They're talking about redundancy for high-availability.
      - zzzcpan 9y ago
        Redundancy and high-availability is something DNS has by design. DNS providers are incentivized to highlight those things as if they were unique to them, but actually the only thing they can offer is anycast for lower latency. Incidentally anycast also makes them less reliable, not more.
    - zzzcpan 9y ago
      If a bunch of people choose a single DNS provider they all create a centralized point in this tree, through witch all of the clients wanting to access their services have to go through. This is exactly what centralization is and is exactly what caused downtime for a lot of websites when Dyn was DDoSed.
icedchai 9y ago
I've run my own DNS servers since the mid 90's. Anyone doing this should check out the "DNS and BIND" O'Reilly book.
zrail 9y ago
I used to do this as well, with tinydns. I even wrote an article with a similar name[1]. Then I wrote another article with a similar name[2] when I decided that I was being silly. I use Route53 now with a little cron that periodically updates the record that points at my home IP[3]. Route53 is bulletproof in a way that I'm unable to accomplish on my own. edit: Route53 is not actually cheaper than this person's setup. That said, $0.50 per hosted zone is a bargain for what you get and there's a volume break to $0.10 after 25 zones. We're talking about global 100% DNS uptime with an SLA[4] for $0.50/mo. [1]: https://www.petekeen.net/how-i-run-my-own-dns https://www.petekeen.net/how-i-run-my-own-dns [2]: https://www.petekeen.net/how-and-why-im-not-running-my-own-dns https://www.petekeen.net/how-and-why-im-not-running-my-own-d... [3]: https://github.com/peterkeen/route53_ddns https://github.com/peterkeen/route53_ddns [4]: https://aws.amazon.com/route53/sla/ https://aws.amazon.com/route53/sla/
- HorizonXP 9y ago
  Furthermore, lots of FOSS router software, like pfSense, have support for Route53 for a Dynamic DNS target, built-in.
  - francis-io 9y ago
    This is exactly what I do with PfSense. I run multiple services from home, so get PfSense to keep a Route 53 address of home.<domain>.com updated to point to my home IP, then create CNAMEs for each service that point to that home record. It's then just a case of using HAProxy (which is also on the same box) to route to different internal services. I don't host anything important, just time saving things running in docker containers on a separate box. Things like email and personal site always go on cloud hosting or a service, since these need to be up for me. Make sure your firewall rules are setup well, and look into some logging and monitoring.
- __david__ 9y ago
  Are you sure it's cheaper than $2/month? I also run route53 and it comes out to about $20/month for 30ish domains.
sideproject 9y ago
I've done this for my domain parking company too. For my need, it's (probably) a must, since you want to make sure you have a reliable DNS server which you can fully control. I've used PowerDNS, which was a breeze for me. It's super efficient too. So I set up my DNS on a very cheap VPS on Vultr ($5/month) and everything has been running well. I do wish PowerDNS had a better web interface, but hey it does the job.
wohlergehen 9y ago
Does anyone have experience with using dot.tk domains as described in the article?
- blacksqr 9y ago
  tcl.tk has been running without a hitch for 15+ years. I know the admins and they are satisfied with the service.
- takeda 9y ago
  I used them since early 2000. They were much better before FreeNOM started managing the TLD. As long as you don't need to change or don't have any issue they are ok as any other domain. Their interface is horrible, it took me a while until I figured out the right step order to properly set up glue records. If you have an issue, their support can be hit or miss, I have feeling that they just ignore whenever a ticket is opened and only respond when you follow up. It also doesn't send notification by email when they respond so often it might take days to resolve a simple issue. This is especially bad if they block the service and domain no longer resolves. TK also doesn't support DNSSEC. The nice thing is that it is free, but you need to make sure you have a working web server that returns some content otherwise they will block the service. This restriction doesn't apply if you pay for the domain. To summarize, it's ok for free service, but if you pay you might as well just use better managed registrar, their price is not better compared to other registrars that have better support and better interface.
belthesar 9y ago
I've got a little script that runs on my home router that makes zone updates to CloudFlare over its API. Cost per month: $0, infrastructure to manage: $0.
rsync 9y ago
Responding to several comments in this thread RE: what is the point of doing this ... The point of running your own email and dns server is so that you are a peer on the network.[1] This is important and is becoming lost in the current era of Internet adoption. By many measures the Internet is the largest cultural and commercial force in the world today and by an accident of history, the researchers at (D)ARPA gave us a network that allowed normal citizens to be peers on the network. Don't lose this. [1] As opposed to, for instance, the telephone network. You can own your own domain and perform the first level of network interaction on your Internet systems, but the analogy on the phone network (owning your own phone number and controlling the first touch from other networks) by creating a CLEC is administratively and financially ($100k +) impossible.
- Santosh83 9y ago
  I get where you're coming from but wouldn't being a proper peer on the Internet imply that you would need some kind of backbone access and be an ISP yourself?
  - adreamingsoul 9y ago
    No.
  - kevindqc 9y ago
    Maybe once net neutrality goes down the drain
  - zrm 9y ago
    Comcast has a huge network but none of their customers are only talking to each other, they're talking to Verizon's customers and Google and Facebook and Amazon. Everyone has to interconnect with everyone else regardless of how big they are. All it takes to be a proper peer on the internet is a public IP address.
    - bpicolo 9y ago
      My ISP rotates through ipv6 addresses now (and frequently, at least several times a day). Makes that tough
adreamingsoul 9y ago
Lately, I've been feeling the urge to rent colo space for my own servers. I used to have my own colo space & servers, but like everyone else was "sold" on the benefits of moving to the cloud. Now, I have a different perspective and believe more people should be owning their own data and servers.
linsomniac 9y ago
On the other side: I run my own DNS recursive resolver on my laptop/desktop, and it's one of the things I really miss on the ChromeBook. I've done this for a long time, originally starting with BIND, then switching to powerdns, but lately I've used dnsmasq and it works great. It has a really nice way to set up multiple resolution zones, so I can have my work IPs resolve using the private DNS servers over the VPN. The down side is sometimes wireless hotspots will block all traffic until you hit their portal, including DNS resolution, and some captive portals don't work when you can't resolve the name. I've worked around this by letting NetworkManager poke the DNS settings in, and then my VPN will update the resolv.conf once the VPN is up. Means I don't end up getting weird DNS responses from clever hotspots or ISPs.
- sliken 9y ago
  Unbound is pretty slick as well. Not sure if dnsmasq supports DNSSEC, but unbound does.
dboreham 9y ago
Although the article does cover this, perhaps it doesn't emphasize the point strongly enough: The IP addresses for your authoritative servers are going to be stored in the glue record for your zone, which is physically held in the root servers (i.e. not your servers). Those glue records can't be changed quickly. Therefore you need to be very sure that your servers' IP addresses are really static. We run our own DNS (for mostly historical and paranoia about reliability reasons). One of our servers is on a subnet that we own, so that totally under our control. The other is at a provider where I have had a detailed back-and-forth with the support staff about the circumstances under which its IP might change, and how to ensure it won't change, specifically mentioning that we are going to run an authoritative DNS server on their infrastructure (currently IBM/Softlayer, moving to Packet.net soon). I am skeptical that a low-cost provider (DO, etc) can give a strong enough guarantee that the machine's IP address won't change. Makes Route53 look very attractive for common/garden purposes.
- takeda 9y ago
  DNS doesn't require you to use a glue records though you can just provide name and the resolver will another query to figure the IP. It's of course less efficient and probably you shouldn't do it, but DNS itself doesn't stop you from that. As for authoritative servers what I did in the past is essentially working together with friends, I was backup name server for their domains and they were backup for mine. There are also some free public DNS servers as well.
  - dboreham 9y ago
    True. I didn't mention that because as you say you shouldn't do it. A big problem with free/cheap DNS services is that (as far as I have seen) they do not support either secondaries off their network, nor being a secondary to some other primary. So you end up in an all-or-nothing situation where you either rely entirely on one provider, or you have to host yourself.
sidhu1f 9y ago
Modern alternatives to BIND that I have had good (though limited) experience with: - unbound (recursive resolver) https://www.unbound.net https://www.unbound.net - nsd (authoritative server) https://www.nlnetlabs.nl/projects/nsd https://www.nlnetlabs.nl/projects/nsd
- DrPhish 9y ago
  You can also run NSD as an authoratative frontend to your BIND servers, and unbound as a caching resolver with forward-zone entries to your BIND server for your domains. This is what I do, which allows me the full gamut of BIND features without exposing those servers directly to any networks (there is a non-routed vlan that nsd/unbound/bind servers use). This is using split-horizon, DDNS from ISC DHCP and DNSSEC, so not a non-trivial setup, but it is also my home network setup so not so heavy duty as to be particularly hard to set up and automate. I also have a round-robin DNSCRYPT setup hooked into the whole thing for semi-anonymity of queries.
0x7f800000 9y ago
I use Route53 for two reasons: 1. $$$ 2. certbot certonly --dns-route53 [...]
alexellisuk 9y ago
Came here because of this advice: > setup a strong root password You should ideally disable root login over SSH and only allow key-based login. Checkout /etc/ssh/sshd_config for more info on that. I don't think this has been suggested yet.
alexellisuk 9y ago
While this is an entertaining read - i.e. all the technical details, it can be made so much less work. If you register a domain or transfer it to a registrar that supports dynamic DNS updates you just run a daemon inside your network and forget about it. I have several domains on Namecheap with a dynamic IP at home and do this [1]. [1] https://www.namecheap.com/support/knowledgebase/article.aspx/36/11/how-do-i-start-using-dynamic-dns https://www.namecheap.com/support/knowledgebase/article.aspx...
mouthfullofbees 9y ago
tl,dr: 1. host them on the cheapest dodgy vps provider you can find 2. host primary and secondary on the same provider 3. use a free throwaway domain registrar 4. use the dns server software with the worst security track record

268 points by zwischenzug 9y ago

zwischenzug 9y ago

Somebody pointed out to me that you can get a free DNS service here: https://dns.he.net/ https://dns.he.net/

alex_hitchins 9y ago
Still good to go through the process of setting this up and making yourself less reliant on third parties.
- zwischenzug 9y ago
  Yes, totally agree. All the pain put the knowledge in my bones.
- gruez 9y ago
  You're "less reliant", but chances are, you'll end up having worse reliability.
  - alex_hitchins 9y ago
    Why do you think that? There is nothing to prevent one from running two, three or four DNS servers each with different providers. The internet was designed to be decentralised and run in such a manor, no?
JepZ 9y ago
After dyndns.org decided to remove the free service, I was so pissed that I had to update all my devices including git checkouts etc. So I decided not to go with any free providers anymore and get my own domain instead. So far no regret.
- j_s 9y ago
  For anyone willing to take the risk, another 3rd party service currently free was promoted on HN 6 months ago: https://news.ycombinator.com/item?id=14856277#14858784 https://news.ycombinator.com/item?id=14856277#14858784 >opie34: A friend and I put together a free dynamic DNS service [1] offering cool custom domains aimed at the Raspberry Pi community (and similar hardware hackers.) It's not strictly a hardware project, but it's a crucial building block for any network-enabled Raspberry Pi project, and we'd love your feedback. [1]: https://www.legitdns.com https://www.legitdns.com
- cheez 9y ago
  Why didn't you just pay dyndns? That's what I did.
  - reacweb 9y ago
    It seems dyndns is €24 per year. My baremetal hosting (4 Dedicated ARM Cores, 2GB memory, 200Mbit/s Unmetered, 50GB HD) is €43.2 per year. I am not ready to pay more than €10 per year for a domain name. For the moment, I enjoy 3 free domain names from no-ip.org.
    - pnutjam 9y ago
      I use duckdns.org. They are free and simple.
  - wila 9y ago
    Not TS, but I did pay dyn for several years. The problem with them however was that they did rack up the price over time and not just a little bit. In 2006, I had to pay $9.95 for their yearly "Pro" offering. In 2008 the deal became "only $23.00 for 2 years", humm OK. Two years later in 2010 it was "$30 for 2 years", in 2012 the bill became $40.00 and when 2016 came the price was upgraded again... (yet again without any other benefits from a customer point of view) That's when I figured that it was too much and moved over to he.net. Which still is free and still works great for the dynamic DNS needed. For static DNS services I also happen to run my own DNS servers, if needed then the he.net services could be moved over to their, but not seeing the need for now.
andmarios 9y ago
Good thing with Hurricane Electric's service is that they also provide slave DNS capability. So you can run your own DNS master server and rely on HE for availability when your server is down or even give preference to the slave DNS, so your users can get the results quick.
amorphid 9y ago
+1 for Hurricane Electric's free DNS. I ordered a .ninja domain, which they didn't support at the time. I contacted customer service, and they added it within a few hours. I love service when I have a problem!

alex_hitchins 9y ago

Thinking about all the servers I've run over the years, I think DNS is one that was most satisfying in a weird way. Incredibly handy also for making amendments to a bunch of records.

JepZ 9y ago

Anybody knows why he uses ssh to update the records and not nsupdate?

millettjon 9y ago
Not sure in his case, but I keep my dns configuration in git and deploy over ssh git pull followed by a dns server restart. I prefer ssh as I know better how to secure that and it seems like less attack surface.
sliken 9y ago
I use both, ssh <host> "nsupdate -l". That way I don't trust nsupdates security model, yet I can still automate updates from any machine I choose.

craig1f 9y ago

How does this compare to pi-hole?

moviuro 9y ago
That's really not the point of the article. He updates the A records for his home machine that doesn't have a static IP.
- yorby 9y ago
  the title is pretty bad for that article... I would never have guessed
organsnyder 9y ago
Pi-hole is a DNS resolver: it takes questions from clients, such as "what's the IP address for google.com"? And takes care of contacting an authoritative server (or passes it to downstream resolver, which does the work) to get the answer. An authoritative server is responsible for answering that same question, but it's been labeled as authoritative for a domain, via the domain registrar system. To see what servers are authoritative for a domain, you can use commands like dig or host; here's an example host command (I'm running OSX, but this should work on any *nix that has it installed): $ host -t ns ycombinator.com ycombinator.com name server ns-1411.awsdns-48.org. ycombinator.com name server ns-1914.awsdns-47.co.uk. ycombinator.com name server ns-225.awsdns-28.com. ycombinator.com name server ns-556.awsdns-05.net.

Coding_Cat 9y ago

>The YOUREMAIL.YOUREMAILDOMAIN. part must be replaced by your own email. For example, my email address: ian.miell@gmail.com becomes ianmiell.gmail.com.. Note also that the dot between first and last name is dropped. email ignores those anyway! Isn't that only the case for gmail (and maybe some others)? As an aside I'm surprised someone setting up their own dns-server would still be using gmail. I've found running my own email-server to be very useful and satisfying. (0-configuration throwaway addresses, automatic sorting with sieve, personal and professional mail on the same account, etc. etc.)

zwischenzug 9y ago
I haven't ever got comfortable with running mail. Interested in any good guides I haven't already read.
- perlgod 9y ago
  I've spent years tweaking my mail server setup (Postfix, Dovecot, RSPAMD, LDAP...) and did a full writeup a few months ago. I've used other guides online but found most of the rest lacking on details. https://www.c0ffee.net/blog/mail-server-guide https://www.c0ffee.net/blog/mail-server-guide
  - j_s 9y ago
    I've submitted this for discussion and asked the mods to give you the credit you deserve for putting in so much effort! https://news.ycombinator.com/item?id=16238937 https://news.ycombinator.com/item?id=16238937
  - zwischenzug 9y ago
    That looks great, thanks.
  - herbst 9y ago
    Curious why you settled for Postfix? I know its basically the standard but its a pain to configure and modify. I recently started to work with Haraka and its so much more of a plessure (even thought i am no JS fan, i prefer JS to cryptic/ancient config files) Just curious if you went through a evaluation process

perlgod 9y ago

I've been down this route but ultimately found much more stability running BIND as a hidden master and pushing NOTIFYs to secondary nameservers (I use DNSMadeEasy) whenever the zone is modified. Supports DNSSEC as well. I wrote up my setup here: https://www.c0ffee.net/blog/dns-hidden-master https://www.c0ffee.net/blog/dns-hidden-master I host mostly static IPs, but I also use this setup with shared keys and PFSense's RFC2136 feature to push dynamic DNS updates for my home network.

JeanMarcS 9y ago
I’m stuck on the DNSSEC part with OVH as a registar, as they won’t let you add DNSSEC records if you don’t use their DNS. Not cool. But your post gave me an idea to try, so anyway, thank you, either it will work or not.
- psz 9y ago
  Enable DNS zone, you don't even need to use it. Then, you'll be able to set custom DS records on a domain. I asked them. It's not a bug, it's a feature!

moviuro 9y ago

I have a similar problem, but there's just no way I'm running a DNS server in the open (amplification attacks, etc.). I was thinking of using https://icanhazip.com https://icanhazip.com + OVH's API to regularly update my A records. However, I still didn't get around to finding (or writing) a CLI for their DNS offering (it is possible, because acme.sh does it [0] -- maybe I'll just use this as a base?) [0] https://github.com/Neilpang/acme.sh/tree/master/dnsapi https://github.com/Neilpang/acme.sh/tree/master/dnsapi

zwischenzug 9y ago
Contact me if you want. nsupdate (mentioned below) may help also.
herbst 9y ago
Just a random input. I use Cloudflare for this. Mostly because changes are more or less instant. I've used Namecheap and OVH before and both could end up with longer delays (~1h)
zzzcpan 9y ago
> there's just no way I'm running a DNS server in the open (amplification attacks, etc.) Why not? Bind has rate limiting to make it useless for amplification attacks. You can also use smaller than 4k udp response sizes, forcing clients to switch to tcp. Nothing to be afraid of, your dns hosting provider probably does the same thing.

crims0n 9y ago

I know it is not the point of the article, but it is possible to do this with one VPS if the provider offers an API to update DNS records. I have this working with Digital Ocean: https://developers.digitalocean.com/documentation/v2/#update-a-domain-record https://developers.digitalocean.com/documentation/v2/#update...

nrki 9y ago

This is pretty simple stuff, and the two ads for your book make this look like an ad rather than something not otherwise posted on tens of other blogs.

lisper 9y ago
Everything is simple once you know how.

conorrr 9y ago

Good article on How, pretty bad at describing why # It’s Cheap There are plenty of cheap & free DNS hosts out there. # More Control Every DNS host I've ever used has offered full control of DNS records. If all you've ever experienced is poor shared hosting maybe this looks is something new. A why not section would be good * High latency for people who do not live near one of your servers. * Time to set up * Cost (lots of cheaper alternatives) * Some overhead. Running any server that is public facing has some overhead even if it's just installing patches. Interestingly zwischenzugs.com isn't hosted on authors own DNS (maybe a restriction of wordpress.com?)

zwischenzug 9y ago
Yeah, wordpress. Also my home server is for from 5 9s (but it's good enough for my services).
upofadown 9y ago
We are missing the most important reason: >I’ve learned a lot by doing this, probably far more than any course would have taught me. It is quite obvious that the world needs more people with a deep knowledge of how DNS works. Doing something like this is a quick and effective way to make the world a better place.
- ksk 9y ago
  >It is quite obvious that the world needs more people with a deep knowledge of how DNS works. Doing something like this is a quick and effective way to make the world a better place. I think you're overstating your case here. I found it interesting too, and us geeks like to dabble in many things, but you can never achieve specialized knowledge and expertise through mere tinkering. Using C++ didn't make me a language designer or even an expert on C++.
  - ryandrake 9y ago
    The point is there's now one more person in the world who knows C++, which is better than there being one less person in the world who knows it. The fewer people who learn these systems, the fewer people there will be available to innovate/maintain these things going forward. Entire trades are facing slow extinction for lack of people who bothered to learn. Almost 3/4 of electrical or electronics repairmen are over 45 years old, and 30% of them are over 55 years old [1]. It would be a shame to wake up one day in 2030 and realize there are only a handful of (presumably very well paid) people on earth who know how DNS works. 1: https://www.lincolntech.edu/news/skilled-trades/baby-boomers-skilled-trades-opps https://www.lincolntech.edu/news/skilled-trades/baby-boomers...

ebbv 9y ago

This is not really a great idea. It's just adding more brittleness to your system. Leave DNS to people with distributed DNS networks and redundancy. I mean obviously you can do it if you want to, I'm not stopping you, but to me it's silly.

zzzcpan 9y ago
DNS is only distributed if you run it yourself, not when you rely on a centralized service.
- zrail 9y ago
  That's... that's not what "distributed" means. DNS is distributed because it's arranged as a tree, with the root nodes delegating to the TLDs delegating to individual name servers for each zone. Just because someone chooses to use a service instead of running a nameserver themselves doesn't make DNS centralized.
  - sp332 9y ago
    I pretty sure that's not what eebv meant. They're talking about redundancy for high-availability.
    - zzzcpan 9y ago
      Redundancy and high-availability is something DNS has by design. DNS providers are incentivized to highlight those things as if they were unique to them, but actually the only thing they can offer is anycast for lower latency. Incidentally anycast also makes them less reliable, not more.
  - zzzcpan 9y ago
    If a bunch of people choose a single DNS provider they all create a centralized point in this tree, through witch all of the clients wanting to access their services have to go through. This is exactly what centralization is and is exactly what caused downtime for a lot of websites when Dyn was DDoSed.

icedchai 9y ago

I've run my own DNS servers since the mid 90's. Anyone doing this should check out the "DNS and BIND" O'Reilly book.

zrail 9y ago

I used to do this as well, with tinydns. I even wrote an article with a similar name[1]. Then I wrote another article with a similar name[2] when I decided that I was being silly. I use Route53 now with a little cron that periodically updates the record that points at my home IP[3]. Route53 is bulletproof in a way that I'm unable to accomplish on my own. edit: Route53 is not actually cheaper than this person's setup. That said, $0.50 per hosted zone is a bargain for what you get and there's a volume break to $0.10 after 25 zones. We're talking about global 100% DNS uptime with an SLA[4] for $0.50/mo. [1]: https://www.petekeen.net/how-i-run-my-own-dns https://www.petekeen.net/how-i-run-my-own-dns [2]: https://www.petekeen.net/how-and-why-im-not-running-my-own-dns https://www.petekeen.net/how-and-why-im-not-running-my-own-d... [3]: https://github.com/peterkeen/route53_ddns https://github.com/peterkeen/route53_ddns [4]: https://aws.amazon.com/route53/sla/ https://aws.amazon.com/route53/sla/

HorizonXP 9y ago
Furthermore, lots of FOSS router software, like pfSense, have support for Route53 for a Dynamic DNS target, built-in.
- francis-io 9y ago
  This is exactly what I do with PfSense. I run multiple services from home, so get PfSense to keep a Route 53 address of home.<domain>.com updated to point to my home IP, then create CNAMEs for each service that point to that home record. It's then just a case of using HAProxy (which is also on the same box) to route to different internal services. I don't host anything important, just time saving things running in docker containers on a separate box. Things like email and personal site always go on cloud hosting or a service, since these need to be up for me. Make sure your firewall rules are setup well, and look into some logging and monitoring.
__david__ 9y ago
Are you sure it's cheaper than $2/month? I also run route53 and it comes out to about $20/month for 30ish domains.

sideproject 9y ago

I've done this for my domain parking company too. For my need, it's (probably) a must, since you want to make sure you have a reliable DNS server which you can fully control. I've used PowerDNS, which was a breeze for me. It's super efficient too. So I set up my DNS on a very cheap VPS on Vultr ($5/month) and everything has been running well. I do wish PowerDNS had a better web interface, but hey it does the job.

wohlergehen 9y ago

Does anyone have experience with using dot.tk domains as described in the article?

blacksqr 9y ago
tcl.tk has been running without a hitch for 15+ years. I know the admins and they are satisfied with the service.
takeda 9y ago
I used them since early 2000. They were much better before FreeNOM started managing the TLD. As long as you don't need to change or don't have any issue they are ok as any other domain. Their interface is horrible, it took me a while until I figured out the right step order to properly set up glue records. If you have an issue, their support can be hit or miss, I have feeling that they just ignore whenever a ticket is opened and only respond when you follow up. It also doesn't send notification by email when they respond so often it might take days to resolve a simple issue. This is especially bad if they block the service and domain no longer resolves. TK also doesn't support DNSSEC. The nice thing is that it is free, but you need to make sure you have a working web server that returns some content otherwise they will block the service. This restriction doesn't apply if you pay for the domain. To summarize, it's ok for free service, but if you pay you might as well just use better managed registrar, their price is not better compared to other registrars that have better support and better interface.

belthesar 9y ago

I've got a little script that runs on my home router that makes zone updates to CloudFlare over its API. Cost per month: $0, infrastructure to manage: $0.

rsync 9y ago

Responding to several comments in this thread RE: what is the point of doing this ... The point of running your own email and dns server is so that you are a peer on the network.[1] This is important and is becoming lost in the current era of Internet adoption. By many measures the Internet is the largest cultural and commercial force in the world today and by an accident of history, the researchers at (D)ARPA gave us a network that allowed normal citizens to be peers on the network. Don't lose this. [1] As opposed to, for instance, the telephone network. You can own your own domain and perform the first level of network interaction on your Internet systems, but the analogy on the phone network (owning your own phone number and controlling the first touch from other networks) by creating a CLEC is administratively and financially ($100k +) impossible.

Santosh83 9y ago
I get where you're coming from but wouldn't being a proper peer on the Internet imply that you would need some kind of backbone access and be an ISP yourself?
- adreamingsoul 9y ago
  No.
- kevindqc 9y ago
  Maybe once net neutrality goes down the drain
- zrm 9y ago
  Comcast has a huge network but none of their customers are only talking to each other, they're talking to Verizon's customers and Google and Facebook and Amazon. Everyone has to interconnect with everyone else regardless of how big they are. All it takes to be a proper peer on the internet is a public IP address.
  - bpicolo 9y ago
    My ISP rotates through ipv6 addresses now (and frequently, at least several times a day). Makes that tough

adreamingsoul 9y ago

Lately, I've been feeling the urge to rent colo space for my own servers. I used to have my own colo space & servers, but like everyone else was "sold" on the benefits of moving to the cloud. Now, I have a different perspective and believe more people should be owning their own data and servers.

linsomniac 9y ago

On the other side: I run my own DNS recursive resolver on my laptop/desktop, and it's one of the things I really miss on the ChromeBook. I've done this for a long time, originally starting with BIND, then switching to powerdns, but lately I've used dnsmasq and it works great. It has a really nice way to set up multiple resolution zones, so I can have my work IPs resolve using the private DNS servers over the VPN. The down side is sometimes wireless hotspots will block all traffic until you hit their portal, including DNS resolution, and some captive portals don't work when you can't resolve the name. I've worked around this by letting NetworkManager poke the DNS settings in, and then my VPN will update the resolv.conf once the VPN is up. Means I don't end up getting weird DNS responses from clever hotspots or ISPs.

sliken 9y ago
Unbound is pretty slick as well. Not sure if dnsmasq supports DNSSEC, but unbound does.

dboreham 9y ago

Although the article does cover this, perhaps it doesn't emphasize the point strongly enough: The IP addresses for your authoritative servers are going to be stored in the glue record for your zone, which is physically held in the root servers (i.e. not your servers). Those glue records can't be changed quickly. Therefore you need to be very sure that your servers' IP addresses are really static. We run our own DNS (for mostly historical and paranoia about reliability reasons). One of our servers is on a subnet that we own, so that totally under our control. The other is at a provider where I have had a detailed back-and-forth with the support staff about the circumstances under which its IP might change, and how to ensure it won't change, specifically mentioning that we are going to run an authoritative DNS server on their infrastructure (currently IBM/Softlayer, moving to Packet.net soon). I am skeptical that a low-cost provider (DO, etc) can give a strong enough guarantee that the machine's IP address won't change. Makes Route53 look very attractive for common/garden purposes.

takeda 9y ago
DNS doesn't require you to use a glue records though you can just provide name and the resolver will another query to figure the IP. It's of course less efficient and probably you shouldn't do it, but DNS itself doesn't stop you from that. As for authoritative servers what I did in the past is essentially working together with friends, I was backup name server for their domains and they were backup for mine. There are also some free public DNS servers as well.
- dboreham 9y ago
  True. I didn't mention that because as you say you shouldn't do it. A big problem with free/cheap DNS services is that (as far as I have seen) they do not support either secondaries off their network, nor being a secondary to some other primary. So you end up in an all-or-nothing situation where you either rely entirely on one provider, or you have to host yourself.

sidhu1f 9y ago

Modern alternatives to BIND that I have had good (though limited) experience with: - unbound (recursive resolver) https://www.unbound.net https://www.unbound.net - nsd (authoritative server) https://www.nlnetlabs.nl/projects/nsd https://www.nlnetlabs.nl/projects/nsd

DrPhish 9y ago
You can also run NSD as an authoratative frontend to your BIND servers, and unbound as a caching resolver with forward-zone entries to your BIND server for your domains. This is what I do, which allows me the full gamut of BIND features without exposing those servers directly to any networks (there is a non-routed vlan that nsd/unbound/bind servers use). This is using split-horizon, DDNS from ISC DHCP and DNSSEC, so not a non-trivial setup, but it is also my home network setup so not so heavy duty as to be particularly hard to set up and automate. I also have a round-robin DNSCRYPT setup hooked into the whole thing for semi-anonymity of queries.

0x7f800000 9y ago

I use Route53 for two reasons: 1. $$$ 2. certbot certonly --dns-route53 [...]

alexellisuk 9y ago

Came here because of this advice: > setup a strong root password You should ideally disable root login over SSH and only allow key-based login. Checkout /etc/ssh/sshd_config for more info on that. I don't think this has been suggested yet.

alexellisuk 9y ago

While this is an entertaining read - i.e. all the technical details, it can be made so much less work. If you register a domain or transfer it to a registrar that supports dynamic DNS updates you just run a daemon inside your network and forget about it. I have several domains on Namecheap with a dynamic IP at home and do this [1]. [1] https://www.namecheap.com/support/knowledgebase/article.aspx/36/11/how-do-i-start-using-dynamic-dns https://www.namecheap.com/support/knowledgebase/article.aspx...

mouthfullofbees 9y ago

tl,dr: 1. host them on the cheapest dodgy vps provider you can find 2. host primary and secondary on the same provider 3. use a free throwaway domain registrar 4. use the dns server software with the worst security track record