4 ms·

Interesting perspective, but it seems like this is just an ad for easyDNS and their "Proactive Nameservers," though I couldn't imagine a better time than the mi

by badRNG 6y ago

Interesting perspective, but it seems like this is just an ad for easyDNS and their "Proactive Nameservers," though I couldn't imagine a better time than the misstep of a behemoth of a competitor in this space. Not to detract from the more important discussion about the internet's dependence on Cloudflare overall.

nvahalik 6y ago
Hey, never let a competitors misfortune (misstep?) go to waste!
sradman 6y ago
It may be just an ad for easyDNS' Proactive Nameservers [1] product but it provides a roadmap for one possible solution to this type of problem. From a quick reading of the marketing info, the solution can be summarized as "Provision, Monitor, and Fail-Over DNS Name Servers across multiple DNS-as-a-Service providers". The question I have is whether the following constraint is artificially introduced or not: > We must be your domain registrar for this to work... IIRC, Netflix OSS published some tools quite some time ago to support multiple DNS providers but I don't know/remember if they tackled the availability problem. The question comes down to build vs buy and whether the solution is general enough to warrant an Open Source Software solution. [1] https://easydns.com/dns/proactive-nameservers/ https://easydns.com/dns/proactive-nameservers/
- Semaphor 6y ago
  From TFA: > The only requirement to use Proactive Nameservers is that we have to be your registrar, because we need to connect to the registry to update your nameserver delegation. So I guess technically this could be achieved with an API for your domain settings.
- chronid 6y ago
  > IIRC, Netflix OSS published some tools quite some time ago to support multiple DNS providers but I don't know/remember if they tackled the availability problem. The classic way of doing this is AXFR (your own DNS server is a "hidden master" and the DNS providers are the slaves). The problem is you won't be able to have redundancy at the registrar level, but that has historically at least been less of an issue.
- pas 6y ago
  They want to be the registrar to be able to update your NS records. But ... that's not really important nor needed (So the answer to your question yes, it's likely artificial). Just use two anycast-ed IPs/domains. (Like Cloudflare.) The magic happens at BGP level. I considered CF as a domain registrar, but they don't allow setting the NS records. So you must use them. (They basically use sane no-nonsense domain registration as a way to gain leads for their main product. Pretty smart actually, because it's a great high-level add-on for their main product, but they just went ahead and made that the bait for everyone.) Anyway, ideally, if you add 2 separate sets of NS servers to your NS records then you eliminated this SPoF, great. Sure, it's your job to keep them updated, and in sync (preferably, to avoid problems like half of your users landing on a different CNAME/IP/etc). And recursive nameservers will handle the failover.
  - 1996 6y ago
    > Just use two anycast-ed IPs/domains What are the brands offering DNS at a flat rate over anycasted IP over a few continents? Most of the offers I see are per query at high rates. Setting up my own ASN to do this would be too expansive in IPv4
    - pas 6y ago
      I meant that easyDNS should handle the BGP for its clients, without requiring their clients to use them as registrars. There's HE.net's free DNS, and though they don't explicitly advertise as, it's anycasted. (Check via https://tools.keycdn.com/ping https://tools.keycdn.com/ping , try 216.66.80.18 [ns5.he.net].) https://www.cloudns.net/premium/ https://www.cloudns.net/premium/ seems to be quite affordable with no query limits :o
  - StuntPope 6y ago
    easyDNS has to be the registrar because only your registrar can change your nameserver delegation with the registry. This is, in essence, the registrar's job. To maintain your domain record and info, including nameserver delegation, with the registry. You could do it with BGP, but it is non-trivial and you need your own ASN to do that.
donmcronald 6y ago
> Proactive Nameservers is a patent-pending system that optimizes the nameserver delegation for your mission critical domain names. That's a huge negative and I can't believe they think it's a good marketing point. I don't want a patent encumbered, non-standard solution for critical infrastructure. > We must be your domain registrar for this to work. So they're updating the domain record at the registry level to facilitate failover? That's the only scenario I can think of where they _need_ to be your registrar. Assuming that's the case... I've always seen 24-48 hours quoted as the worst case wait when updating nameservers at the registry. I've never seen an explanation of how it works, what's allowed to be cached, how long it actually takes to update, etc.. How do they do it in a way that's suitable for failover? Do they have a special SLA with registries? How would the registries handle a deluge of nameserver updates? Imagine a Cloudflare scale failure and corresponding registry updates. Would the registry servers be able to handle it? I'd love to see a technical explanation of how their proactive nameservers system works.

by badRNG 6y ago

nvahalik 6y ago

Hey, never let a competitors misfortune (misstep?) go to waste!

sradman 6y ago

It may be just an ad for easyDNS' Proactive Nameservers [1] product but it provides a roadmap for one possible solution to this type of problem. From a quick reading of the marketing info, the solution can be summarized as "Provision, Monitor, and Fail-Over DNS Name Servers across multiple DNS-as-a-Service providers". The question I have is whether the following constraint is artificially introduced or not: > We must be your domain registrar for this to work... IIRC, Netflix OSS published some tools quite some time ago to support multiple DNS providers but I don't know/remember if they tackled the availability problem. The question comes down to build vs buy and whether the solution is general enough to warrant an Open Source Software solution. [1] https://easydns.com/dns/proactive-nameservers/ https://easydns.com/dns/proactive-nameservers/

Semaphor 6y ago
From TFA: > The only requirement to use Proactive Nameservers is that we have to be your registrar, because we need to connect to the registry to update your nameserver delegation. So I guess technically this could be achieved with an API for your domain settings.
chronid 6y ago
> IIRC, Netflix OSS published some tools quite some time ago to support multiple DNS providers but I don't know/remember if they tackled the availability problem. The classic way of doing this is AXFR (your own DNS server is a "hidden master" and the DNS providers are the slaves). The problem is you won't be able to have redundancy at the registrar level, but that has historically at least been less of an issue.
pas 6y ago
They want to be the registrar to be able to update your NS records. But ... that's not really important nor needed (So the answer to your question yes, it's likely artificial). Just use two anycast-ed IPs/domains. (Like Cloudflare.) The magic happens at BGP level. I considered CF as a domain registrar, but they don't allow setting the NS records. So you must use them. (They basically use sane no-nonsense domain registration as a way to gain leads for their main product. Pretty smart actually, because it's a great high-level add-on for their main product, but they just went ahead and made that the bait for everyone.) Anyway, ideally, if you add 2 separate sets of NS servers to your NS records then you eliminated this SPoF, great. Sure, it's your job to keep them updated, and in sync (preferably, to avoid problems like half of your users landing on a different CNAME/IP/etc). And recursive nameservers will handle the failover.
- 1996 6y ago
  > Just use two anycast-ed IPs/domains What are the brands offering DNS at a flat rate over anycasted IP over a few continents? Most of the offers I see are per query at high rates. Setting up my own ASN to do this would be too expansive in IPv4
  - pas 6y ago
    I meant that easyDNS should handle the BGP for its clients, without requiring their clients to use them as registrars. There's HE.net's free DNS, and though they don't explicitly advertise as, it's anycasted. (Check via https://tools.keycdn.com/ping https://tools.keycdn.com/ping , try 216.66.80.18 [ns5.he.net].) https://www.cloudns.net/premium/ https://www.cloudns.net/premium/ seems to be quite affordable with no query limits :o
- StuntPope 6y ago
  easyDNS has to be the registrar because only your registrar can change your nameserver delegation with the registry. This is, in essence, the registrar's job. To maintain your domain record and info, including nameserver delegation, with the registry. You could do it with BGP, but it is non-trivial and you need your own ASN to do that.

donmcronald 6y ago

> Proactive Nameservers is a patent-pending system that optimizes the nameserver delegation for your mission critical domain names. That's a huge negative and I can't believe they think it's a good marketing point. I don't want a patent encumbered, non-standard solution for critical infrastructure. > We must be your domain registrar for this to work. So they're updating the domain record at the registry level to facilitate failover? That's the only scenario I can think of where they _need_ to be your registrar. Assuming that's the case... I've always seen 24-48 hours quoted as the worst case wait when updating nameservers at the registry. I've never seen an explanation of how it works, what's allowed to be cached, how long it actually takes to update, etc.. How do they do it in a way that's suitable for failover? Do they have a special SLA with registries? How would the registries handle a deluge of nameserver updates? Imagine a Cloudflare scale failure and corresponding registry updates. Would the registry servers be able to handle it? I'd love to see a technical explanation of how their proactive nameservers system works.