21 ms·

Why might you run your own DNS server?

312 points by 0xedb 5y ago

encryptluks2 5y ago
DNS is decentralized about as well as TLDs are decentralized... they're not. You'd specifically have to run your own DNS to make it decentralized and use other upstream providers that allow the use of open TLDs.
- acdha 5y ago
  What is your definition of decentralized? There's no one system which controls of the DNS records or makes changes to them, and the root TLDs are run by an international consortium which has limited ability to force changes. Even if the U.S. government gets in a shooting war with Russia, there's no plausible outcome where .ru records come under the control of the U.S. government or vice versa. That's about as decentralized as a real system gets while still being usable.
  - encryptluks2 5y ago
    Decentralization usually requires some incentive to get people to run it and no single entity on charge of it. Since most ISPs incentive is to redirect failed entries incorrectly and DNS root servers are only reporting centralized TLD providers that require payment for registration, no it isn't decentralized by any standard compared to the decentralization of IPFS using Bitcoin.
    - acdha 5y ago
      > decentralization of DNS or Bitcoin. Uh, this is DNS. Bitcoin has a similar but far more expensive mechanism for social consent but more importantly it also doesn’t have equivalent functionality for a global namespace. That’s the underlying problem here: the purpose of the DNS system is to map human-meaningful names to addresses and that requires a mechanism for guaranteeing uniqueness and dealing with abuse. Bitcoin can’t do that and things like ENS have the usual problems handling abuse.
      - DarylZero 5y ago
        A decentralized system won't ever have a central place for a privileged censor role that can "handle abuse."
        acdha 5y ago
        What definition are you using for decentralized? Note that I didn’t say anything about a privileged central role - as you learn about how decentralized systems like DNS, email, the web, etc. work note how often that means something like selecting the work of a third-party aligned with your views (e.g. email server operators use black lists run following policies they agree with). This is why, for example, ICANN doesn’t have the ability to arbitrarily transfer domains — their operation of the root servers is limited to the terms agreed to, and if they tried to abuse their technical access they’d be replaced by an alt root. The Russian government has already done this for political reasons and it’s not especially hard to do given a reason.
        DarylZero 5y ago
        I'm talking about the structure of the technology. What you are replying with is a political science style defense of the idea of centralized power. Your argument is like the political science idea of the benevolent dictator, who is vulnerable to coup unless they can keep the factions happy. Political science also has the idea that the institutional democracy can be more resilient than that to such simple attacks as a coup by a would-be dictator. When I'm talking about decentralized I'm saying that the technology doesn't even have a place for the benevolent dictator to exist. Not that the node is constrained politically. The node is not even there. Centralization is easy to build and provides easy "solutions" to problems like abuse. Centralization simply reduces all problems to the one problem of choosing the center. Like you say: "selecting the work of a third-party aligned with your views." Centralization works, insofar as it does, because the human beings controlling the center have to maintain some kind of political alliance in outside society to maintain their spot. Fair enough, I guess, for some purposes. But it's like CAP theorem, sometimes you want a different set of tradeoffs for a different purpose. Not all systems work by choosing a center. Some systems fragment, some unify by non-political (mathematical) means.
Helmut10001 5y ago
Been using pfBlockerNG [1] for years and haven't seen ads for a long time. They are even filtered out from Youtube Videos, through DNS sink. I am using it from my offsite-server at my parents house through IPSEC. Also protects family members from accessing bad IPs, based on several global malicious IP filter lists. [1]: /r/pfBlockerNG
waplot 5y ago
I run dnsmasq backed by dnscrypt-proxy, haven't had issues.
eatonphil 5y ago
Another interesting way subdomains leak is through TLS cert registration. I.e. you can plug a domain into this search [0] and find subdomains that have public TLS certs. I just noticed a full blog post on this topic is also on the front of HN right now. [1] [0] https://transparencyreport.google.com/https/certificates?hl=en https://transparencyreport.google.com/https/certificates?hl=... [1] https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt-for-internal-hostnames/ https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt...
- HellsMaddy 5y ago
  Tangentially related: I’ve wondered what would happen if you purchased a domain name that had previously been owned by someone else and they had obtained a TLS certificate from a CA with an expiration date beyond when your ownership began. This seems like a good tool to find such a certificate, but if you found one what would you do? Would the holder of the certificate be able to MITM or otherwise impersonate you? Would there be a way to revoke the certificate (I’m guessing you could contact the CA that issued it?)? Do CAs automatically revoke certificates when domain ownership changes?
  - Rygian 5y ago
    How would you retrieve the private key for that certificate?
    - HellsMaddy 5y ago
      You wouldn’t. But the CA that issued the certificate could still revoke it, correct? E.g. https://letsencrypt.org/docs/revoking/#using-a-different-authorized-account https://letsencrypt.org/docs/revoking/#using-a-different-aut...
      - remram 5y ago
        Yes, from that same link you can see that whoever controls the domain can revoke those certificates (by asking Let's Encrypt to revoke it). All you need is the certificate itself (which you can get from the transparency logs e.g. crt.sh), not the private key.
Terry_Roll 5y ago
- ceejayoz 5y ago
  IPv4 vs IPv6 doesn't change anything in this regard.
- acdha 5y ago
  > Well lets brush over the limited nature of IPv4 and focus on IPv6 for this to apply. Can you explain what you think would be different if IPv4 was gone or IPv6 never existed? I can't think of a situation where that would matter: you'd be resolving AAAA records instead of A but the logical DNS hierarchy would be exactly the same.
sybercecurity 5y ago
Not expressly mentioned in the "user interface" bit: not all hosting services allow all possible RRTypes and you may want to deploy uncommon or newly specified RRTypes like TLSA or the possibly-soon-to-be-specified SVCB and HTTPS RRTypes.
Diederich 5y ago
The main reason I run my own name server is to support IP over DNS tunneling. Having direct and easy control over the normal records it serves is also nice.
quesera 5y ago
This is a good summary. I run both authoritative (nsd) and resolving (unbound) nameservers. They require literally zero maintenance. Before nsd, I ran djbdns, which also required zero maintenance. I've run BIND, back in the dark ages. Rumor has it that BIND doesn't suck any more, but I've seen no reason to confirm. If you are able keep sshd up and running on your hosted or colo'ed server, you have the skills required to run a nameserver reliably. It's that easy. I recommend nsd and/or unbound. If the article does not persuade you that you want to do so, then don't bother. But if you do want to, don't be dissuaded by assuming it will be difficult.
- ur-whale 5y ago
  > Before nsd, I ran djbdns Curious to know what made you switch (I still run djbdns).
  - fugue88 5y ago
    I still run djbdns as well, as both an authoritative server and a caching resolver. The biggest downside to djbdns, to me, is its lack of DNSSEC support. There are patches available for that, but my distro doesn't package them and I haven't gotten around to making my own package to include them. The next biggest is related: djbdns lacks direct support for some newer Resource Records (like type 257 CAA) in its data file. However, the data file does allow you to encode arbitrary records directly, it's just a hassle to do it and to verify correctness.
  - quesera 5y ago
    No technical reason, djbdns is great and I wouldn't hesitate to run it again. I did tire of building my own djbdns and daemontools packages. When I switched from qmail to Postfix, the others were collateral damage.
    - ur-whale 5y ago
      Ah, yeah, I was never a fan of daemontools either. I actually run djbdns (both cache and authoritative) under systemd (not my fave thing, but the thing my OS comes equipped with) and it works fine. The lack of native support for some record types (eg. IPV6) is a little bit of a pain, but it's manageable.
bauruine 5y ago
Another point I would add is DNSSEC. With your own authoritative server you actually own the keys and don't have to trust another company. What's also not mentioned is the possibility to run your own hidden master and use a DNS provider (or multiple!) as slaves. This way you have full control over your zone but you don't have to run your own network of nameservers.
- tptacek 5y ago
  Since almost nobody runs DNSSEC (try a list of popular domains, like the Moz 500, and `dig ds $domain +short`), this is unlikely to be a big issue for most people. There's also practically no upside to running DNSSEC, and a lot of downside (see: Slack disappearing from the Internet for a whole day).
  - Hello71 5y ago
    I don't run DNSSEC either, but as you know, the Slack issue was caused by haphazard implementation, followed by apparent panicked incorrect rollback. They would have had basically the same issue if they had added incorrect AAAA records with long expiry. There may well be reasons not to deploy IPv6, but I don't think this is a good one. Similarly, while I agree that DNSSEC offers few upsides, I don't think this particular example is a good one against DNSSEC itself.
    - jtl999 5y ago
      To quote from the Slack engineering report > This indicated there was likely a problem with the ‘*.slack.com’ wildcard record since we didn’t have a wildcard record in any of the other domains where we had rolled out DNSSEC on I'm not going to stick my hand in either camp for the sake of this discussion, but dynamic/wildcard DNS records are exactly the type of thing I'd suspect DNSSEC to have trouble with
      - teddyh 5y ago
        I, on the other hand, can speak from experience, and I say that where I work we currently have over 100 domains with DNSSEC and a wildcard record, and they all work just fine.
bullen 5y ago
I don't agree that it's decentralized, it tries to be but it's really distributed with a few root servers with a few people that have keys to them. Eventually there will be a decentralized name system for probably a decentralized P2P radio system, and I'm trying to build that: http://radiomesh.org http://radiomesh.org But it's proving more tricky than I could have ever dreamed, right now I have scrapped 433MHz LoRa on Rasperry Zero and I'm moving to 169MHz plain radio on Raspberry Pico. As for running your own it's very easy with these simplified lines of Java and dns4j (excluding port 53 UDP stuff): Message query = new Message(data); Header header = query.getHeader(); Record question = query.getQuestion(); Message response = new Message(query.getHeader().getID()); response.getHeader().setFlag(Flags.QR); response.addRecord(question, Section.QUESTION); Name name = question.getName(); int type = question.getType(); int dclass = question.getDClass(); String host = name.toString(true).toLowerCase(); ... response.addRecord(new ARecord(name, dclass, 300, "someIP"), Section.ANSWER); ... response.getHeader().setFlag(Flags.AA); return response.toWire(512); Everyone should run their own DNS on the same process as their HTTP and SMTP servers... because without DNS nothing exists. There are few things more frustrating than having your DNS provider be down for hours without recourse!
- sumtechguy 5y ago
  In a decentralized system how are you handling the bad actor problem? Such as 2 entities claiming they own a namespace?
  - bullen 5y ago
    Well it will probably be some sort of hashing on the old fiber internet but at a fixed very low energy rate per message, and a bit higher energy rate for names (in a first come, first served manner with some sort of public/private key signed distributed database, just trying to not use the b-word here and with spam protection I haven't choosen yet) so far I'm concentrating on the hardware and radio hopping protocol to make sure it could scale at all, that combined with reputation: because the system is relaying your messages, you can be increasingly punished as you missbehave; which makes it hard to abuse productively. But as with all radio you will be able to disturb locally, if you have a better suggestion I'm all ears.
cozzyd 5y ago
I thought more common would just be a caching server (e.g. dnsmasq) for small networks with slow connections to the outside world (and this also helps with local hostnames).
gorgoiler 5y ago
Have you ever wanted to build a toy nameserver that returns funny programmatic results? Then have a look at Python’s dnslib. Example where the magic happens in ~40 lines of code: https://github.com/paulc/dnslib/blob/master/dnslib/shellresolver.py https://github.com/paulc/dnslib/blob/master/dnslib/shellreso... Hurricane Electric can sit in front of it if you like (and your records are dynamically generated but bounded to a known finite set), god bless them <salute>: https://dns.he.net/ https://dns.he.net/ Example where you might want this: you wrote a nameserver that runs arbitrary shell commands!
- _paulc 5y ago
  dnslib author here - wasn’t expecting to see this so thanks for the reference. Key thing I learnt writing dnslib (which was originally to provide a DNS API for an application) is that DNS is actually a very dynamic protocol but the complexity of mainstream servers like BIND makes it hard to do a lot of the things that you can actually do. There are a lot of problems (in particular in the service discovery space) which can be solved much more easily using DNS rather than inventing something separate. As an aside if you want an authoritative DNS server I would look at KnotDNS [1] - you can avoid all the zone file cruft and interact with it using a sensible API. If you want to write a dynamic DNS app I would look at @miekg’s excellent Go library [2] [1] https://www.knot-dns.cz/ https://www.knot-dns.cz/ [2] https://github.com/miekg/dns https://github.com/miekg/dns
  - gorgoiler 5y ago
    Thank you for your work, _paulc! I used your library to broadcast weather readings via DNS in the park where I live. It was really nice to have all the protocol work done for me, leaving me to focus on my meteoprocrastination :) There’s a special place in my heart for tools where you learn by following examples, rather than by having to read abstract documentation.
samgranieri 5y ago
I'm enjoying running a pi-hole on my local network that also has unbound running on it for resolving dns queries. Works like a charm, and it's nice and quick.
- avgDev 5y ago
  Pi-hole is awesome. It did give me some issues with a few streaming services that I think used google ads.
  - samgranieri 5y ago
    Yeah, it borked paramount plus and I think hbo max on my apple tv. I just exempted that device and it's fine. Why'd I exempt my apple tv from the pi-hole? I don't want to screw things up when my wife or visitors are watching tv :)
    - FPGAhacker 5y ago
      > Why'd I exempt my apple tv from the pi-hole? I don't want to screw things up when my wife or visitors are watching tv :) Very wise. There are a lot of cool things I’d like to setup, but keeping things simple for guests and spouses matters.
- JonathanBuchh 5y ago
  I also use Pi-hole[1] and unbound[2]. You can even use tailscale[3] as a quick and easy way to use Pi-hole on all other networks through a WireGuard VPN tunnel. [1]: https://pi-hole.net https://pi-hole.net [2]: https://docs.pi-hole.net/guides/dns/unbound/ https://docs.pi-hole.net/guides/dns/unbound/ [3]: https://tailscale.com/kb/1114/pi-hole/ https://tailscale.com/kb/1114/pi-hole/
  - shepherdjerred 5y ago
    Tailscale gives me some irrational sense of happiness because it *just works* and lets you do cool things like this without having to worry (too much) about security.
raggi 5y ago
Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems that can consome or convert from bind format if thats what you want.
- psim1 5y ago
  BIND has a track record because it has existed for decades. At present, what's wrong with it?
  - raggi 5y ago
    Here are a couple of more recent RCE's: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25216 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2521... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 There are numerous DoS CVE's over the same time period.
    - egberts1 5y ago
      SPNEGO, (and GSS-API) used by less than 1% of the Bind users (by observatory) and exploitable if configured as enabled that the entire code segment got removed by the maintainer from its code permanently. The rest is pretty solid and well tested.
- brian_cunnie 5y ago
  I've been running BIND on the internet for a quarter century (ns-he.nono.io, ns-digitalocean.nono.io). Sure, I got burned 20 years ago with, IIRC, a zone-transfer exploit, but in those days BIND ran as root (remember: the internet was new then). Nowadays BIND runs as a non-privileged user in a chroot'ed environment, so even if it's compromised the blast radius is tightly constrained. And I like BIND. I like editing zone files by hand. It never fails to make me happy.
asimops 5y ago
Some warning. Please do not put a resolver directly onto the internet. As nice as it might be to have a DNS ad-blocker or your own names reachable all over the internet, the server will be part of DDOS attacks through traffic amplification and you don't want that.
- gitgrump 5y ago
  If anyone wants to learn more, here's why open recursive resolvers are a bad idea: https://www.cloudflare.com/learning/dns/what-is-recursive-dns/ https://www.cloudflare.com/learning/dns/what-is-recursive-dn...
- zinekeller 5y ago
  > Please do not put a resolver directly onto the internet. Consider using DoT or DoH instead, or at the very least disable UDP queries (there's a slight penalty though).
emptybottle 5y ago
On my LAN the only DNS server I'm running are resolvers. I have a pihole instance that is backed by stubby to filter out ads/trackers and send queries outside my network via DNS-over-TLS.
withinrafael 5y ago
The blog post indicates running a resolver would have privacy enhancing benefits. Am I misunderstanding something here? Isn't the resolver mostly unusable without an upstream source that could then log all queries? Or is there a records bulk download option?
- petee 5y ago
  In the end you need to ask an authoritative server anyway, but this let's you skip your ISP being the middleman for all your general queries. Unbound is nice because you can have it verify dnssec
- zionic 5y ago
  Think of it like downloading the dictionary and keeping fast local access nearby instead of looking up every word on Google.
peanut-walrus 5y ago
I have lately started to call dns "a global distributed database", rather than decentralized. Decentralized implies some properties that the dns system most definitely does not have.
- acdha 5y ago
  This seems like redefining the term: DNS is fully decentralized in normal operation — the hierarchy has fewer parties involved, but no one entity owns the entire data set the way you’d have in most distributed databases.
  - peanut-walrus 5y ago
    In normal operation - true. However, from a technical perspective, any zone operator above yours has the capability to take over your domain(s). While I agree that the root zone operators abusing this power is highly unlikely, for TLD operators under some legal/government pressure this can be quite likely. In fact, domain name seizure is quite a common procedure around the world.
    - acdha 5y ago
      > However, from a technical perspective, any zone operator above yours has the capability to take over your domain(s). That doesn't mean it's not decentralized. If the .kz operator has a heavy hand, it affects people in their legal jurisdiction but not anyone else, and that's true of everything else as well. A system which doesn't allow enforcement of legal requirements will be blocked, and this isn't a technical problem with a technical solution no matter what the blockchain salespeople say.
      - DarylZero 5y ago
        It's centralized because owner of `.` can take over `kz.`
        acdha 5y ago
fareesh 5y ago
Hypothetically if some scary evil person were to register a domain with some accredited registrar - say GoDaddy or Tucows - could they arbitrarily seize it for "content policy" reasons? Like "your site has Dave Chapelle jokes which we don't like" so we took your domain. Or do they stand to lose something in a major way if they do this?
- southerntofu 5y ago
  Depends on the jurisdiction, your contract with the registrar, the TLD's registration policies... Some TLDs like .ml (Mali) which gives away domain names as a public service (why doesn't every TLD do that?!) have very explicit content policies: http://www.point.ml/en/ml_contentpolicy_combined_v0100.pdf http://www.point.ml/en/ml_contentpolicy_combined_v0100.pdf
brian_cunnie 5y ago
Another reason you might want to run your own BIND server is to enable reverse-lookups for your internal machines. On my home network, a reverse-lookup for 10.0.9.30 resolves to tara.nono.io (i.e. `dig 30.9.0.10.in-addr.arpa ptr` → tara.nono.io.)
m3047 5y ago
Run your own recursive server and instrument the crap out of it: https://github.com/m3047/rear_view_rpz https://github.com/m3047/rear_view_rpz You can't get local knowledge from anywhere else. The latest BIND has DoT (DNS over TLS) out of the box, or you can put nginx in front of any decent DNS server to terminate TLS just like you do with a web server (this is fundamentally TCP not UDP however).
vesinisa 5y ago
Another good reason to run your own private DNS resolver is censorship. I originally set it up after my ISP was sued to block access to thepiratebay.com. The court was satisfied that a DNS blackhole was good enough..
- bhelkey 5y ago
  I imagine that it would be easier to use the Google or Cloudflare DNS (8.8.8.8 or 1.1.1.1 respectively). Disclaimer: I work for Google.
  - zionic 5y ago
    But then you’re sending all your DNS queries to hostile companies, so that’s a pretty big loss. We need to normalize people using Pi’s for at-home DNS just like we did HTTPS.
    - frakkingcylons 5y ago
      Describing the public DNS resolvers of Google and Cloudflare as "hostile" is textbook shit-HN-says hyperbole.
      - spurtrenolds 5y ago
        Ummmm Can you explain why giving a complete list of URLs you visit to the worlds largest advertising and data gathering company isn't dodgy? If you can't see why, then you appear to have drunk the SV Koolaid. tldr; If millions of people do a silly thing, it is still a silly thing.
      - DyslexicAtheist 5y ago
        I'm using Cloudflare on and off. But it depends what/who you trust. Say you're based in the US work for Google and want to whistle-blow about some nefarious defense/Pentagon contracts, then staying away from Google (or US based Tech firm) infra as much as possible would be sound advice. Even if you're just a consumer you should be interested in degoogling your life including not just google DNS but their stupid web-fonts and google auth API's. Google is still going to get lot of your traffic no matter what you do but every data point you can remove is good - even if it adds zero to your bottom line at least you will maintain awareness of how you get milked every day.
NKosmatos 5y ago
Silly question coming from someone not very experienced with DNS servers/resolvers, is there a way to download/cache/resolve all country specific domains (ccTLDs)? I know there are many sites that sell zone files, like https://zonefiles.io https://zonefiles.io, but aren’t the DNS records supposed to be something freely available?
- AndyMcConachie 5y ago
  What precisely are you interested in? If you just want the NS records and glue for all the ccTLDs they're in the root zone. https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone If you want the complete zone files from every ccTLD that is a much bigger ask. I'm not sure but I imagine you would have to look into each ccTLD and find out if they're available.
- elliottinvent 5y ago
  You can download zone files for lots of gTLDs using ICANN’s Centralized Zone Data Service [0]. For ccTLDs there’s no centralised system and availability depends on the country registry. For example, Nominet make the UK zone file and others available for UK registrars for a fee I think. Another approach is to buy WHOIS files from providers like Whoxy [1], the registrant data shouldn’t be used because of GDPR and other restrictions but as a domain list it can be useful. I’ve done a fair bit in this area so if anyone wants any help feel free to send an email - details in profile. 0. https://czds.icann.org/home https://czds.icann.org/home 1. https://www.whoxy.com https://www.whoxy.com
  - NKosmatos 5y ago
    Thanks for the hints. I’m interested in collecting all sites/domains for a specific ccTLD (.gr) purely for statistics/curiosity. I know that some countries publish their zones files, but for the GR registry (like many other countries) this is not available. I’m not interested in the WHOIS data, sine as you correctly mention contain sensitive data. I was thinking that somehow if I had my own DNS server I would be able to download all available domains, but after some reading I understood that this is not how DNS servers work. A request from a local client (inside my own LAN) would need to perform an nslookup or web access for each domain, so that the result could be cached.
Ologn 5y ago
I started running DNS servers 25 years ago so it doesn't take much mental effort for me. It is easy for me to do, and I have full control over it. I can do it in my sleep. The biggest effort for me was about 24 years ago, when BIND 8 replaced BIND 4. Probably the last thing I had to learn was putting AAAA records in (easy enough) and putting SPF records (yes, I run my own personal postfix as well).
commandlinefan 5y ago
> it’s almost 40 years old I was shocked that DNS was only almost 40 years old - I would have guessed it was at least older than me, but she's right. According to https://datatracker.ietf.org/doc/html/rfc882 https://datatracker.ietf.org/doc/html/rfc882 it's almost 10 years younger...
- betterunix2 5y ago
  The Internet is not much older; it is reasonable to say that the Internet started in 1982 when TCP/IP was first standardized, though some would say that the Internet started a few years later with the creation of NSFNet and its interconnection with other networks.
  - egberts1 5y ago
    .ARPA domain is older than 1982, so TCP/IP was in force before standardization. Fun times.
3np 5y ago
> I wrote a custom DNS server for mess with dns Weird flex but ok
samcrawford 5y ago
We use the excellent gdnsd (https://github.com/gdnsd/gdnsd https://github.com/gdnsd/gdnsd), mainly for its geo-DNS configurability. Have been using it for probably 5-6 years now, handling hundreds of millions of queries per day, and never had an issue with it.
KronisLV 5y ago
One use case that i can think of is split DNS, when you'd like to return different data to different clients, about which i wrote on my blog: https://blog.kronis.dev/tutorials/how-to-run-a-split-dns-server https://blog.kronis.dev/tutorials/how-to-run-a-split-dns-ser... That said, outside of serious enterprise settings, you can do all sorts of things without hosting your own DNS servers - even odd ones, like making records on public DNS servers for your internal network. Sometimes using a dynamic DNS client (e.g. ddclient) is actually easier than caring about setting static IP addresses (if you just want to let DHCP handle everything), when you don't care about that sort of data being exposed. Of course, that's not to say that people should actually do stuff like that, just that they can. On a more practical note, if you use the DNS servers of someone like NameCheap or GoDaddy, you might run into limits for how many records for a domain you can create. For example, NameCheap allows up to 150 records (https://www.namecheap.com/support/knowledgebase/article.aspx/10058/10/namecheap-dns-limits/ https://www.namecheap.com/support/knowledgebase/article.aspx...).
deleted 5y ago
[deleted]
1vuio0pswjnm7 5y ago
reason: you want to route application traffic through a local daemon but the computing device will not allow you to access /etc/hosts or run a firewall like iptables/nftables/pf One way to redirect application traffic to a local daemon, e.g., something like sslsplit or stunnel, is using firewall rules. Another way is to use DNS. Running DNS for oneself with a custom root.zone allows one to redirect traffic, for example, to a loopback address where the daemon is listening. The DNS server can run locally on a loopback or private address (for use while at home/office), or remotely on a public address (for use when travelling). For example, I use a local proxy server instead of remote DNS lookups. When I visit example.com, there is a local DNS lookup to a local DNS server listening on the loopback. No DNS packets leave the computer. The local DNS server returns the loopback address of the proxy. The proxy, which has the remote address of example.com stored in memory, then accesses example.com.
deleted 5y ago
[deleted]
z3t4 5y ago
reason: You want to use dynamic wildcard SSL certificates via Letsencrypt. Because they need to be validated via DNS. reason: You want to use anycast (rent cheap VPS servers that support BGP) The anycast managed services that exist will takes days to sync all servers, thus you can't use DNS validation with Letsencrypt. Solution: Run your own Anycast ... That said, anycast is overkill, because DNS has caching built in to it's protocol, if the user has looked up your IP once, it will be cached on the user machine next time he/she looks it up. And if you have a fairly popular domain, it will also be cached at the ISP or whatever DNS resolver the user has.
deleted 5y ago
[deleted]
mleonhard 5y ago
I'm writing a safe Rust DNS server library: https://gitlab.com/leonhard-llc/ops/-/tree/safe-dns/safe-dns https://gitlab.com/leonhard-llc/ops/-/tree/safe-dns/safe-dns My goal is to have libraries for all the common services. Then I can run web, APIs, DNS, and email from a single static binary, with no config files. Then the next stage is to run the server in a unikernel in a VM, eliminating the OS. The following stage is to run the server directly on bare metal, eliminating the hypervisor kernel and OS. The final stage is to run the server as firmware directly on the CPU, shipping built-from-source firmware for all peripherals, eliminating all unauditable binary blobs from the server.
- southerntofu 5y ago
  I don't think i'd like to go this way, but that's pretty cool. Please keep us posted!
jacob019 5y ago
I run BIND on the router at each site I administer. The router gets a real domain name and is the authoritative nameserver for that domain. isc-dhcp-server is configured to assign a publicly routable IPv6 to each client, and update the BIND zone records with the client hostnames, so each client automatically has a publicly routable domain name, hostname.domain.com, with AAAA records pointing to their IPv6. They are firewalled of course.
ananonymoususer 5y ago
One thing the fine article does not list as a reason to run your own DNS is if you need a secondary name server. There are plenty of options (Route 53, etc.) if you only need a primary, but all Internet domains should have at least two authoritative servers (for redundancy). There are far fewer secondary server options available from DNS providers, so it is often a good idea to run your own.
- amarshall 5y ago
  Perhaps of interest: https://github.com/octodns/octodns https://github.com/octodns/octodns
- egberts1 5y ago
  Far fewer … secondary DNS servers … options? seems to me that they are increasing in numbers, both public and private.
  - egberts1 5y ago
    Think DNS over TLS/TCP.
kristianpaul 5y ago
Because you can self-host many floss software and you don't need to call it Web3
kureikain 5y ago
I found one of challenge when running a public dns resolver(and authoritative name server if we're being target) is DNS Backscatter. Up till nowsaday I don't really know how people solve this problem. Anyone can lighten me up on how to defend this kind of attack? I really want to run my own dns server
- deleted 5y ago
  [deleted]
RandomBK 5y ago
This is a good list for running DNS servers for publicly resolvable domains. Another common reason is to run a server for internal domains only accessible via VPN.
slim 5y ago
report : Just installed a DNS resolver on my laptop after reading this thread. I'm surprised that every website I visit feels 2x faster. Try it.
lormayna 5y ago
I have been managed for years a cluster of recursive authoritative DNS cluster for a broadband ISP (around 30k subscribers). We have also 2 authoritative DNS servers running bind, but the operations were fully automated through a bunch of custom python scripts (the NOC operators can request a new record by themselves). For the recursives one, I started with bind, but after a few months I replaced it to unbound and it's works like a charm. The only problem that I experienced was about DDoS, mainly generated by ultra cheap chineses home router with buggy firmware. Anyway after a few attacks, we start implementing an application monitoring solution and we were able to mitigate the attacks in a short time. On my laptop I run a a docker container with grimd (https://github.com/looterz/grimd https://github.com/looterz/grimd) as recursive DNS and DoH proxy. I can filter out lot of dab requests and tracking and have visibility of what my DNS traffic is. It's not hard to configure
known 5y ago
southerntofu 5y ago
Thanks for this great article! My two cents: > reason: do something weird and custom Oh yes please! Previous discussions on this topic: https://news.ycombinator.com/item?id=28218406 https://news.ycombinator.com/item?id=28218406 (HTML over DNS) https://news.ycombinator.com/item?id=25620411 https://news.ycombinator.com/item?id=25620411 (DNS Key Value Storage) https://news.ycombinator.com/item?id=22808121 https://news.ycombinator.com/item?id=22808121 (Wikipedia over DNS) > reason: geo DNS Please don't do this! IP addresses aren't geolocated in the common sense. The good way to get content closer to your users is to announce your IP space from your different locations. Then client ISPs can choose the best route depending on peering policy and number of hops. If your DNS lies depending on the IP who asks, you're going to have quite a bunch of people redirected to the "wrong" (far/slow from their perspective) server. The only exception i can think of is for split-horizon DNS where your local resolver advertises local IP addresses.
Firehawke 5y ago
There's a fundamental mistake in this article. I quote: "But the “phone book” mental model might make you think that if you make a DNS query for google.com, you’ll always get the same result. And that’s not true at all!" Phone books are not a static model either. If you were to look up "Walmart" in your local phone book, you're going to get a different set of phone numbers for the Walmart stores around you as compared to five states to the West or East of where you are. As such, the mental model really is apt.
- zimpenfish 5y ago
  Doesn't the sentence from the article mean "even from the same place, you can get different results" though? As in you're looking in (ostensibly) the same phone book but getting different numbers - not that you're looking in different phone books. I can look up www.google.com from 3 different machines here on my local network (behind a single ipv4 nat'd address) and get 3 different IPs as a result.

312 points by 0xedb 5y ago

DNS is decentralized about as well as TLDs are decentralized... they're not. You'd specifically have to run your own DNS to make it decentralized and use other upstream providers that allow the use of open TLDs.

acdha 5y ago
What is your definition of decentralized? There's no one system which controls of the DNS records or makes changes to them, and the root TLDs are run by an international consortium which has limited ability to force changes. Even if the U.S. government gets in a shooting war with Russia, there's no plausible outcome where .ru records come under the control of the U.S. government or vice versa. That's about as decentralized as a real system gets while still being usable.
- encryptluks2 5y ago
  Decentralization usually requires some incentive to get people to run it and no single entity on charge of it. Since most ISPs incentive is to redirect failed entries incorrectly and DNS root servers are only reporting centralized TLD providers that require payment for registration, no it isn't decentralized by any standard compared to the decentralization of IPFS using Bitcoin.
  - acdha 5y ago
    > decentralization of DNS or Bitcoin. Uh, this is DNS. Bitcoin has a similar but far more expensive mechanism for social consent but more importantly it also doesn’t have equivalent functionality for a global namespace. That’s the underlying problem here: the purpose of the DNS system is to map human-meaningful names to addresses and that requires a mechanism for guaranteeing uniqueness and dealing with abuse. Bitcoin can’t do that and things like ENS have the usual problems handling abuse.
    - DarylZero 5y ago
      A decentralized system won't ever have a central place for a privileged censor role that can "handle abuse."
      - acdha 5y ago
        What definition are you using for decentralized? Note that I didn’t say anything about a privileged central role - as you learn about how decentralized systems like DNS, email, the web, etc. work note how often that means something like selecting the work of a third-party aligned with your views (e.g. email server operators use black lists run following policies they agree with). This is why, for example, ICANN doesn’t have the ability to arbitrarily transfer domains — their operation of the root servers is limited to the terms agreed to, and if they tried to abuse their technical access they’d be replaced by an alt root. The Russian government has already done this for political reasons and it’s not especially hard to do given a reason.
        DarylZero 5y ago
        I'm talking about the structure of the technology. What you are replying with is a political science style defense of the idea of centralized power. Your argument is like the political science idea of the benevolent dictator, who is vulnerable to coup unless they can keep the factions happy. Political science also has the idea that the institutional democracy can be more resilient than that to such simple attacks as a coup by a would-be dictator. When I'm talking about decentralized I'm saying that the technology doesn't even have a place for the benevolent dictator to exist. Not that the node is constrained politically. The node is not even there. Centralization is easy to build and provides easy "solutions" to problems like abuse. Centralization simply reduces all problems to the one problem of choosing the center. Like you say: "selecting the work of a third-party aligned with your views." Centralization works, insofar as it does, because the human beings controlling the center have to maintain some kind of political alliance in outside society to maintain their spot. Fair enough, I guess, for some purposes. But it's like CAP theorem, sometimes you want a different set of tradeoffs for a different purpose. Not all systems work by choosing a center. Some systems fragment, some unify by non-political (mathematical) means.

Helmut10001 5y ago

Been using pfBlockerNG [1] for years and haven't seen ads for a long time. They are even filtered out from Youtube Videos, through DNS sink. I am using it from my offsite-server at my parents house through IPSEC. Also protects family members from accessing bad IPs, based on several global malicious IP filter lists. [1]: /r/pfBlockerNG

waplot 5y ago

I run dnsmasq backed by dnscrypt-proxy, haven't had issues.

eatonphil 5y ago

Another interesting way subdomains leak is through TLS cert registration. I.e. you can plug a domain into this search [0] and find subdomains that have public TLS certs. I just noticed a full blog post on this topic is also on the front of HN right now. [1] [0] https://transparencyreport.google.com/https/certificates?hl=en https://transparencyreport.google.com/https/certificates?hl=... [1] https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt-for-internal-hostnames/ https://shkspr.mobi/blog/2022/01/should-you-use-lets-encrypt...

HellsMaddy 5y ago
Tangentially related: I’ve wondered what would happen if you purchased a domain name that had previously been owned by someone else and they had obtained a TLS certificate from a CA with an expiration date beyond when your ownership began. This seems like a good tool to find such a certificate, but if you found one what would you do? Would the holder of the certificate be able to MITM or otherwise impersonate you? Would there be a way to revoke the certificate (I’m guessing you could contact the CA that issued it?)? Do CAs automatically revoke certificates when domain ownership changes?
- Rygian 5y ago
  How would you retrieve the private key for that certificate?
  - HellsMaddy 5y ago
    You wouldn’t. But the CA that issued the certificate could still revoke it, correct? E.g. https://letsencrypt.org/docs/revoking/#using-a-different-authorized-account https://letsencrypt.org/docs/revoking/#using-a-different-aut...
    - remram 5y ago
      Yes, from that same link you can see that whoever controls the domain can revoke those certificates (by asking Let's Encrypt to revoke it). All you need is the certificate itself (which you can get from the transparency logs e.g. crt.sh), not the private key.

Terry_Roll 5y ago

ceejayoz 5y ago
IPv4 vs IPv6 doesn't change anything in this regard.
acdha 5y ago
> Well lets brush over the limited nature of IPv4 and focus on IPv6 for this to apply. Can you explain what you think would be different if IPv4 was gone or IPv6 never existed? I can't think of a situation where that would matter: you'd be resolving AAAA records instead of A but the logical DNS hierarchy would be exactly the same.

sybercecurity 5y ago

Not expressly mentioned in the "user interface" bit: not all hosting services allow all possible RRTypes and you may want to deploy uncommon or newly specified RRTypes like TLSA or the possibly-soon-to-be-specified SVCB and HTTPS RRTypes.

Diederich 5y ago

The main reason I run my own name server is to support IP over DNS tunneling. Having direct and easy control over the normal records it serves is also nice.

quesera 5y ago

This is a good summary. I run both authoritative (nsd) and resolving (unbound) nameservers. They require literally zero maintenance. Before nsd, I ran djbdns, which also required zero maintenance. I've run BIND, back in the dark ages. Rumor has it that BIND doesn't suck any more, but I've seen no reason to confirm. If you are able keep sshd up and running on your hosted or colo'ed server, you have the skills required to run a nameserver reliably. It's that easy. I recommend nsd and/or unbound. If the article does not persuade you that you want to do so, then don't bother. But if you do want to, don't be dissuaded by assuming it will be difficult.

ur-whale 5y ago
> Before nsd, I ran djbdns Curious to know what made you switch (I still run djbdns).
- fugue88 5y ago
  I still run djbdns as well, as both an authoritative server and a caching resolver. The biggest downside to djbdns, to me, is its lack of DNSSEC support. There are patches available for that, but my distro doesn't package them and I haven't gotten around to making my own package to include them. The next biggest is related: djbdns lacks direct support for some newer Resource Records (like type 257 CAA) in its data file. However, the data file does allow you to encode arbitrary records directly, it's just a hassle to do it and to verify correctness.
- quesera 5y ago
  No technical reason, djbdns is great and I wouldn't hesitate to run it again. I did tire of building my own djbdns and daemontools packages. When I switched from qmail to Postfix, the others were collateral damage.
  - ur-whale 5y ago
    Ah, yeah, I was never a fan of daemontools either. I actually run djbdns (both cache and authoritative) under systemd (not my fave thing, but the thing my OS comes equipped with) and it works fine. The lack of native support for some record types (eg. IPV6) is a little bit of a pain, but it's manageable.

bauruine 5y ago

Another point I would add is DNSSEC. With your own authoritative server you actually own the keys and don't have to trust another company. What's also not mentioned is the possibility to run your own hidden master and use a DNS provider (or multiple!) as slaves. This way you have full control over your zone but you don't have to run your own network of nameservers.

tptacek 5y ago
Since almost nobody runs DNSSEC (try a list of popular domains, like the Moz 500, and `dig ds $domain +short`), this is unlikely to be a big issue for most people. There's also practically no upside to running DNSSEC, and a lot of downside (see: Slack disappearing from the Internet for a whole day).
- Hello71 5y ago
  I don't run DNSSEC either, but as you know, the Slack issue was caused by haphazard implementation, followed by apparent panicked incorrect rollback. They would have had basically the same issue if they had added incorrect AAAA records with long expiry. There may well be reasons not to deploy IPv6, but I don't think this is a good one. Similarly, while I agree that DNSSEC offers few upsides, I don't think this particular example is a good one against DNSSEC itself.
  - jtl999 5y ago
    To quote from the Slack engineering report > This indicated there was likely a problem with the ‘*.slack.com’ wildcard record since we didn’t have a wildcard record in any of the other domains where we had rolled out DNSSEC on I'm not going to stick my hand in either camp for the sake of this discussion, but dynamic/wildcard DNS records are exactly the type of thing I'd suspect DNSSEC to have trouble with
    - teddyh 5y ago
      I, on the other hand, can speak from experience, and I say that where I work we currently have over 100 domains with DNSSEC and a wildcard record, and they all work just fine.

bullen 5y ago

I don't agree that it's decentralized, it tries to be but it's really distributed with a few root servers with a few people that have keys to them. Eventually there will be a decentralized name system for probably a decentralized P2P radio system, and I'm trying to build that: http://radiomesh.org http://radiomesh.org But it's proving more tricky than I could have ever dreamed, right now I have scrapped 433MHz LoRa on Rasperry Zero and I'm moving to 169MHz plain radio on Raspberry Pico. As for running your own it's very easy with these simplified lines of Java and dns4j (excluding port 53 UDP stuff): Message query = new Message(data); Header header = query.getHeader(); Record question = query.getQuestion(); Message response = new Message(query.getHeader().getID()); response.getHeader().setFlag(Flags.QR); response.addRecord(question, Section.QUESTION); Name name = question.getName(); int type = question.getType(); int dclass = question.getDClass(); String host = name.toString(true).toLowerCase(); ... response.addRecord(new ARecord(name, dclass, 300, "someIP"), Section.ANSWER); ... response.getHeader().setFlag(Flags.AA); return response.toWire(512); Everyone should run their own DNS on the same process as their HTTP and SMTP servers... because without DNS nothing exists. There are few things more frustrating than having your DNS provider be down for hours without recourse!

sumtechguy 5y ago
In a decentralized system how are you handling the bad actor problem? Such as 2 entities claiming they own a namespace?
- bullen 5y ago
  Well it will probably be some sort of hashing on the old fiber internet but at a fixed very low energy rate per message, and a bit higher energy rate for names (in a first come, first served manner with some sort of public/private key signed distributed database, just trying to not use the b-word here and with spam protection I haven't choosen yet) so far I'm concentrating on the hardware and radio hopping protocol to make sure it could scale at all, that combined with reputation: because the system is relaying your messages, you can be increasingly punished as you missbehave; which makes it hard to abuse productively. But as with all radio you will be able to disturb locally, if you have a better suggestion I'm all ears.

cozzyd 5y ago

I thought more common would just be a caching server (e.g. dnsmasq) for small networks with slow connections to the outside world (and this also helps with local hostnames).

gorgoiler 5y ago

Have you ever wanted to build a toy nameserver that returns funny programmatic results? Then have a look at Python’s dnslib. Example where the magic happens in ~40 lines of code: https://github.com/paulc/dnslib/blob/master/dnslib/shellresolver.py https://github.com/paulc/dnslib/blob/master/dnslib/shellreso... Hurricane Electric can sit in front of it if you like (and your records are dynamically generated but bounded to a known finite set), god bless them <salute>: https://dns.he.net/ https://dns.he.net/ Example where you might want this: you wrote a nameserver that runs arbitrary shell commands!

_paulc 5y ago
dnslib author here - wasn’t expecting to see this so thanks for the reference. Key thing I learnt writing dnslib (which was originally to provide a DNS API for an application) is that DNS is actually a very dynamic protocol but the complexity of mainstream servers like BIND makes it hard to do a lot of the things that you can actually do. There are a lot of problems (in particular in the service discovery space) which can be solved much more easily using DNS rather than inventing something separate. As an aside if you want an authoritative DNS server I would look at KnotDNS [1] - you can avoid all the zone file cruft and interact with it using a sensible API. If you want to write a dynamic DNS app I would look at @miekg’s excellent Go library [2] [1] https://www.knot-dns.cz/ https://www.knot-dns.cz/ [2] https://github.com/miekg/dns https://github.com/miekg/dns
- gorgoiler 5y ago
  Thank you for your work, _paulc! I used your library to broadcast weather readings via DNS in the park where I live. It was really nice to have all the protocol work done for me, leaving me to focus on my meteoprocrastination :) There’s a special place in my heart for tools where you learn by following examples, rather than by having to read abstract documentation.

samgranieri 5y ago

I'm enjoying running a pi-hole on my local network that also has unbound running on it for resolving dns queries. Works like a charm, and it's nice and quick.

avgDev 5y ago
Pi-hole is awesome. It did give me some issues with a few streaming services that I think used google ads.
- samgranieri 5y ago
  Yeah, it borked paramount plus and I think hbo max on my apple tv. I just exempted that device and it's fine. Why'd I exempt my apple tv from the pi-hole? I don't want to screw things up when my wife or visitors are watching tv :)
  - FPGAhacker 5y ago
    > Why'd I exempt my apple tv from the pi-hole? I don't want to screw things up when my wife or visitors are watching tv :) Very wise. There are a lot of cool things I’d like to setup, but keeping things simple for guests and spouses matters.
JonathanBuchh 5y ago
I also use Pi-hole[1] and unbound[2]. You can even use tailscale[3] as a quick and easy way to use Pi-hole on all other networks through a WireGuard VPN tunnel. [1]: https://pi-hole.net https://pi-hole.net [2]: https://docs.pi-hole.net/guides/dns/unbound/ https://docs.pi-hole.net/guides/dns/unbound/ [3]: https://tailscale.com/kb/1114/pi-hole/ https://tailscale.com/kb/1114/pi-hole/
- shepherdjerred 5y ago
  Tailscale gives me some irrational sense of happiness because it *just works* and lets you do cool things like this without having to worry (too much) about security.

raggi 5y ago

Lost me at wanting to run BIND. BINDs security track record is poor and does not show promise of improvement. Run something else. There are plenty of systems that can consome or convert from bind format if thats what you want.

psim1 5y ago
BIND has a track record because it has existed for decades. At present, what's wrong with it?
- raggi 5y ago
  Here are a couple of more recent RCE's: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25216 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2521... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8625 There are numerous DoS CVE's over the same time period.
  - egberts1 5y ago
    SPNEGO, (and GSS-API) used by less than 1% of the Bind users (by observatory) and exploitable if configured as enabled that the entire code segment got removed by the maintainer from its code permanently. The rest is pretty solid and well tested.
brian_cunnie 5y ago
I've been running BIND on the internet for a quarter century (ns-he.nono.io, ns-digitalocean.nono.io). Sure, I got burned 20 years ago with, IIRC, a zone-transfer exploit, but in those days BIND ran as root (remember: the internet was new then). Nowadays BIND runs as a non-privileged user in a chroot'ed environment, so even if it's compromised the blast radius is tightly constrained. And I like BIND. I like editing zone files by hand. It never fails to make me happy.

asimops 5y ago

Some warning. Please do not put a resolver directly onto the internet. As nice as it might be to have a DNS ad-blocker or your own names reachable all over the internet, the server will be part of DDOS attacks through traffic amplification and you don't want that.

gitgrump 5y ago
If anyone wants to learn more, here's why open recursive resolvers are a bad idea: https://www.cloudflare.com/learning/dns/what-is-recursive-dns/ https://www.cloudflare.com/learning/dns/what-is-recursive-dn...
zinekeller 5y ago
> Please do not put a resolver directly onto the internet. Consider using DoT or DoH instead, or at the very least disable UDP queries (there's a slight penalty though).

emptybottle 5y ago

On my LAN the only DNS server I'm running are resolvers. I have a pihole instance that is backed by stubby to filter out ads/trackers and send queries outside my network via DNS-over-TLS.

withinrafael 5y ago

The blog post indicates running a resolver would have privacy enhancing benefits. Am I misunderstanding something here? Isn't the resolver mostly unusable without an upstream source that could then log all queries? Or is there a records bulk download option?

petee 5y ago
In the end you need to ask an authoritative server anyway, but this let's you skip your ISP being the middleman for all your general queries. Unbound is nice because you can have it verify dnssec
zionic 5y ago
Think of it like downloading the dictionary and keeping fast local access nearby instead of looking up every word on Google.

peanut-walrus 5y ago

I have lately started to call dns "a global distributed database", rather than decentralized. Decentralized implies some properties that the dns system most definitely does not have.

acdha 5y ago
This seems like redefining the term: DNS is fully decentralized in normal operation — the hierarchy has fewer parties involved, but no one entity owns the entire data set the way you’d have in most distributed databases.
- peanut-walrus 5y ago
  In normal operation - true. However, from a technical perspective, any zone operator above yours has the capability to take over your domain(s). While I agree that the root zone operators abusing this power is highly unlikely, for TLD operators under some legal/government pressure this can be quite likely. In fact, domain name seizure is quite a common procedure around the world.
  - acdha 5y ago
    > However, from a technical perspective, any zone operator above yours has the capability to take over your domain(s). That doesn't mean it's not decentralized. If the .kz operator has a heavy hand, it affects people in their legal jurisdiction but not anyone else, and that's true of everything else as well. A system which doesn't allow enforcement of legal requirements will be blocked, and this isn't a technical problem with a technical solution no matter what the blockchain salespeople say.
    - DarylZero 5y ago
      It's centralized because owner of `.` can take over `kz.`
      - acdha 5y ago

fareesh 5y ago

Hypothetically if some scary evil person were to register a domain with some accredited registrar - say GoDaddy or Tucows - could they arbitrarily seize it for "content policy" reasons? Like "your site has Dave Chapelle jokes which we don't like" so we took your domain. Or do they stand to lose something in a major way if they do this?

southerntofu 5y ago
Depends on the jurisdiction, your contract with the registrar, the TLD's registration policies... Some TLDs like .ml (Mali) which gives away domain names as a public service (why doesn't every TLD do that?!) have very explicit content policies: http://www.point.ml/en/ml_contentpolicy_combined_v0100.pdf http://www.point.ml/en/ml_contentpolicy_combined_v0100.pdf

brian_cunnie 5y ago

Another reason you might want to run your own BIND server is to enable reverse-lookups for your internal machines. On my home network, a reverse-lookup for 10.0.9.30 resolves to tara.nono.io (i.e. `dig 30.9.0.10.in-addr.arpa ptr` → tara.nono.io.)

m3047 5y ago

Run your own recursive server and instrument the crap out of it: https://github.com/m3047/rear_view_rpz https://github.com/m3047/rear_view_rpz You can't get local knowledge from anywhere else. The latest BIND has DoT (DNS over TLS) out of the box, or you can put nginx in front of any decent DNS server to terminate TLS just like you do with a web server (this is fundamentally TCP not UDP however).

vesinisa 5y ago

Another good reason to run your own private DNS resolver is censorship. I originally set it up after my ISP was sued to block access to thepiratebay.com. The court was satisfied that a DNS blackhole was good enough..

bhelkey 5y ago
I imagine that it would be easier to use the Google or Cloudflare DNS (8.8.8.8 or 1.1.1.1 respectively). Disclaimer: I work for Google.
- zionic 5y ago
  But then you’re sending all your DNS queries to hostile companies, so that’s a pretty big loss. We need to normalize people using Pi’s for at-home DNS just like we did HTTPS.
  - frakkingcylons 5y ago
    Describing the public DNS resolvers of Google and Cloudflare as "hostile" is textbook shit-HN-says hyperbole.
    - spurtrenolds 5y ago
      Ummmm Can you explain why giving a complete list of URLs you visit to the worlds largest advertising and data gathering company isn't dodgy? If you can't see why, then you appear to have drunk the SV Koolaid. tldr; If millions of people do a silly thing, it is still a silly thing.
    - DyslexicAtheist 5y ago
      I'm using Cloudflare on and off. But it depends what/who you trust. Say you're based in the US work for Google and want to whistle-blow about some nefarious defense/Pentagon contracts, then staying away from Google (or US based Tech firm) infra as much as possible would be sound advice. Even if you're just a consumer you should be interested in degoogling your life including not just google DNS but their stupid web-fonts and google auth API's. Google is still going to get lot of your traffic no matter what you do but every data point you can remove is good - even if it adds zero to your bottom line at least you will maintain awareness of how you get milked every day.

NKosmatos 5y ago

Silly question coming from someone not very experienced with DNS servers/resolvers, is there a way to download/cache/resolve all country specific domains (ccTLDs)? I know there are many sites that sell zone files, like https://zonefiles.io https://zonefiles.io, but aren’t the DNS records supposed to be something freely available?

AndyMcConachie 5y ago
What precisely are you interested in? If you just want the NS records and glue for all the ccTLDs they're in the root zone. https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone If you want the complete zone files from every ccTLD that is a much bigger ask. I'm not sure but I imagine you would have to look into each ccTLD and find out if they're available.
elliottinvent 5y ago
You can download zone files for lots of gTLDs using ICANN’s Centralized Zone Data Service [0]. For ccTLDs there’s no centralised system and availability depends on the country registry. For example, Nominet make the UK zone file and others available for UK registrars for a fee I think. Another approach is to buy WHOIS files from providers like Whoxy [1], the registrant data shouldn’t be used because of GDPR and other restrictions but as a domain list it can be useful. I’ve done a fair bit in this area so if anyone wants any help feel free to send an email - details in profile. 0. https://czds.icann.org/home https://czds.icann.org/home 1. https://www.whoxy.com https://www.whoxy.com
- NKosmatos 5y ago
  Thanks for the hints. I’m interested in collecting all sites/domains for a specific ccTLD (.gr) purely for statistics/curiosity. I know that some countries publish their zones files, but for the GR registry (like many other countries) this is not available. I’m not interested in the WHOIS data, sine as you correctly mention contain sensitive data. I was thinking that somehow if I had my own DNS server I would be able to download all available domains, but after some reading I understood that this is not how DNS servers work. A request from a local client (inside my own LAN) would need to perform an nslookup or web access for each domain, so that the result could be cached.

Ologn 5y ago

I started running DNS servers 25 years ago so it doesn't take much mental effort for me. It is easy for me to do, and I have full control over it. I can do it in my sleep. The biggest effort for me was about 24 years ago, when BIND 8 replaced BIND 4. Probably the last thing I had to learn was putting AAAA records in (easy enough) and putting SPF records (yes, I run my own personal postfix as well).

commandlinefan 5y ago

> it’s almost 40 years old I was shocked that DNS was only almost 40 years old - I would have guessed it was at least older than me, but she's right. According to https://datatracker.ietf.org/doc/html/rfc882 https://datatracker.ietf.org/doc/html/rfc882 it's almost 10 years younger...

betterunix2 5y ago
The Internet is not much older; it is reasonable to say that the Internet started in 1982 when TCP/IP was first standardized, though some would say that the Internet started a few years later with the creation of NSFNet and its interconnection with other networks.
- egberts1 5y ago
  .ARPA domain is older than 1982, so TCP/IP was in force before standardization. Fun times.

3np 5y ago

> I wrote a custom DNS server for mess with dns Weird flex but ok

samcrawford 5y ago

We use the excellent gdnsd (https://github.com/gdnsd/gdnsd https://github.com/gdnsd/gdnsd), mainly for its geo-DNS configurability. Have been using it for probably 5-6 years now, handling hundreds of millions of queries per day, and never had an issue with it.

KronisLV 5y ago

One use case that i can think of is split DNS, when you'd like to return different data to different clients, about which i wrote on my blog: https://blog.kronis.dev/tutorials/how-to-run-a-split-dns-server https://blog.kronis.dev/tutorials/how-to-run-a-split-dns-ser... That said, outside of serious enterprise settings, you can do all sorts of things without hosting your own DNS servers - even odd ones, like making records on public DNS servers for your internal network. Sometimes using a dynamic DNS client (e.g. ddclient) is actually easier than caring about setting static IP addresses (if you just want to let DHCP handle everything), when you don't care about that sort of data being exposed. Of course, that's not to say that people should actually do stuff like that, just that they can. On a more practical note, if you use the DNS servers of someone like NameCheap or GoDaddy, you might run into limits for how many records for a domain you can create. For example, NameCheap allows up to 150 records (https://www.namecheap.com/support/knowledgebase/article.aspx/10058/10/namecheap-dns-limits/ https://www.namecheap.com/support/knowledgebase/article.aspx...).

deleted 5y ago

[deleted]

1vuio0pswjnm7 5y ago

reason: you want to route application traffic through a local daemon but the computing device will not allow you to access /etc/hosts or run a firewall like iptables/nftables/pf One way to redirect application traffic to a local daemon, e.g., something like sslsplit or stunnel, is using firewall rules. Another way is to use DNS. Running DNS for oneself with a custom root.zone allows one to redirect traffic, for example, to a loopback address where the daemon is listening. The DNS server can run locally on a loopback or private address (for use while at home/office), or remotely on a public address (for use when travelling). For example, I use a local proxy server instead of remote DNS lookups. When I visit example.com, there is a local DNS lookup to a local DNS server listening on the loopback. No DNS packets leave the computer. The local DNS server returns the loopback address of the proxy. The proxy, which has the remote address of example.com stored in memory, then accesses example.com.

deleted 5y ago

[deleted]

z3t4 5y ago

reason: You want to use dynamic wildcard SSL certificates via Letsencrypt. Because they need to be validated via DNS. reason: You want to use anycast (rent cheap VPS servers that support BGP) The anycast managed services that exist will takes days to sync all servers, thus you can't use DNS validation with Letsencrypt. Solution: Run your own Anycast ... That said, anycast is overkill, because DNS has caching built in to it's protocol, if the user has looked up your IP once, it will be cached on the user machine next time he/she looks it up. And if you have a fairly popular domain, it will also be cached at the ISP or whatever DNS resolver the user has.

deleted 5y ago

[deleted]

mleonhard 5y ago

I'm writing a safe Rust DNS server library: https://gitlab.com/leonhard-llc/ops/-/tree/safe-dns/safe-dns https://gitlab.com/leonhard-llc/ops/-/tree/safe-dns/safe-dns My goal is to have libraries for all the common services. Then I can run web, APIs, DNS, and email from a single static binary, with no config files. Then the next stage is to run the server in a unikernel in a VM, eliminating the OS. The following stage is to run the server directly on bare metal, eliminating the hypervisor kernel and OS. The final stage is to run the server as firmware directly on the CPU, shipping built-from-source firmware for all peripherals, eliminating all unauditable binary blobs from the server.

southerntofu 5y ago
I don't think i'd like to go this way, but that's pretty cool. Please keep us posted!

jacob019 5y ago

I run BIND on the router at each site I administer. The router gets a real domain name and is the authoritative nameserver for that domain. isc-dhcp-server is configured to assign a publicly routable IPv6 to each client, and update the BIND zone records with the client hostnames, so each client automatically has a publicly routable domain name, hostname.domain.com, with AAAA records pointing to their IPv6. They are firewalled of course.

ananonymoususer 5y ago

One thing the fine article does not list as a reason to run your own DNS is if you need a secondary name server. There are plenty of options (Route 53, etc.) if you only need a primary, but all Internet domains should have at least two authoritative servers (for redundancy). There are far fewer secondary server options available from DNS providers, so it is often a good idea to run your own.

amarshall 5y ago
Perhaps of interest: https://github.com/octodns/octodns https://github.com/octodns/octodns
egberts1 5y ago
Far fewer … secondary DNS servers … options? seems to me that they are increasing in numbers, both public and private.
- egberts1 5y ago
  Think DNS over TLS/TCP.

kristianpaul 5y ago

Because you can self-host many floss software and you don't need to call it Web3

kureikain 5y ago

I found one of challenge when running a public dns resolver(and authoritative name server if we're being target) is DNS Backscatter. Up till nowsaday I don't really know how people solve this problem. Anyone can lighten me up on how to defend this kind of attack? I really want to run my own dns server

deleted 5y ago
[deleted]

RandomBK 5y ago

This is a good list for running DNS servers for publicly resolvable domains. Another common reason is to run a server for internal domains only accessible via VPN.

slim 5y ago

report : Just installed a DNS resolver on my laptop after reading this thread. I'm surprised that every website I visit feels 2x faster. Try it.

lormayna 5y ago

I have been managed for years a cluster of recursive authoritative DNS cluster for a broadband ISP (around 30k subscribers). We have also 2 authoritative DNS servers running bind, but the operations were fully automated through a bunch of custom python scripts (the NOC operators can request a new record by themselves). For the recursives one, I started with bind, but after a few months I replaced it to unbound and it's works like a charm. The only problem that I experienced was about DDoS, mainly generated by ultra cheap chineses home router with buggy firmware. Anyway after a few attacks, we start implementing an application monitoring solution and we were able to mitigate the attacks in a short time. On my laptop I run a a docker container with grimd (https://github.com/looterz/grimd https://github.com/looterz/grimd) as recursive DNS and DoH proxy. I can filter out lot of dab requests and tracking and have visibility of what my DNS traffic is. It's not hard to configure

known 5y ago

southerntofu 5y ago

Thanks for this great article! My two cents: > reason: do something weird and custom Oh yes please! Previous discussions on this topic: https://news.ycombinator.com/item?id=28218406 https://news.ycombinator.com/item?id=28218406 (HTML over DNS) https://news.ycombinator.com/item?id=25620411 https://news.ycombinator.com/item?id=25620411 (DNS Key Value Storage) https://news.ycombinator.com/item?id=22808121 https://news.ycombinator.com/item?id=22808121 (Wikipedia over DNS) > reason: geo DNS Please don't do this! IP addresses aren't geolocated in the common sense. The good way to get content closer to your users is to announce your IP space from your different locations. Then client ISPs can choose the best route depending on peering policy and number of hops. If your DNS lies depending on the IP who asks, you're going to have quite a bunch of people redirected to the "wrong" (far/slow from their perspective) server. The only exception i can think of is for split-horizon DNS where your local resolver advertises local IP addresses.

Firehawke 5y ago

There's a fundamental mistake in this article. I quote: "But the “phone book” mental model might make you think that if you make a DNS query for google.com, you’ll always get the same result. And that’s not true at all!" Phone books are not a static model either. If you were to look up "Walmart" in your local phone book, you're going to get a different set of phone numbers for the Walmart stores around you as compared to five states to the West or East of where you are. As such, the mental model really is apt.

zimpenfish 5y ago
Doesn't the sentence from the article mean "even from the same place, you can get different results" though? As in you're looking in (ostensibly) the same phone book but getting different numbers - not that you're looking in different phone books. I can look up www.google.com from 3 different machines here on my local network (behind a single ipv4 nat'd address) and get 3 different IPs as a result.