6 ms·

This is a good summary. I run both authoritative (nsd) and resolving (unbound) nameservers. They require literally zero maintenance. Before nsd, I ran djbdns,

This is a good summary. I run both authoritative (nsd) and resolving (unbound) nameservers. They require literally zero maintenance. Before nsd, I ran djbdns, which also required zero maintenance. I've run BIND, back in the dark ages. Rumor has it that BIND doesn't suck any more, but I've seen no reason to confirm. If you are able keep sshd up and running on your hosted or colo'ed server, you have the skills required to run a nameserver reliably. It's that easy. I recommend nsd and/or unbound. If the article does not persuade you that you want to do so, then don't bother. But if you do want to, don't be dissuaded by assuming it will be difficult.

ur-whale 5y ago
> Before nsd, I ran djbdns Curious to know what made you switch (I still run djbdns).
- fugue88 5y ago
  I still run djbdns as well, as both an authoritative server and a caching resolver. The biggest downside to djbdns, to me, is its lack of DNSSEC support. There are patches available for that, but my distro doesn't package them and I haven't gotten around to making my own package to include them. The next biggest is related: djbdns lacks direct support for some newer Resource Records (like type 257 CAA) in its data file. However, the data file does allow you to encode arbitrary records directly, it's just a hassle to do it and to verify correctness.
- quesera 5y ago
  No technical reason, djbdns is great and I wouldn't hesitate to run it again. I did tire of building my own djbdns and daemontools packages. When I switched from qmail to Postfix, the others were collateral damage.
  - ur-whale 5y ago
    Ah, yeah, I was never a fan of daemontools either. I actually run djbdns (both cache and authoritative) under systemd (not my fave thing, but the thing my OS comes equipped with) and it works fine. The lack of native support for some record types (eg. IPV6) is a little bit of a pain, but it's manageable.
pgporada 5y ago
What version of unbound are you running? With our traffic load we restart unbound 1.13.x daily to "fix" a memory leak.
- quesera 5y ago
  unbound-1.14.0 (newest). But I should have qualified -- I run a caching resolver for use by half a dozen users (so about 20 devices). Load is negligible, but it works perfectly! YMMV. As an added benefit, my unbound instance is also faster than 1.1.1.1, 8.8.8.8, or my ISP's resolver farm.
- citrin_ru 5y ago
  I've run relatively loaded unbound in the past - I would suggest to use minimum num-threads with which a single thread uses less than 50% CPU at peaks. And set number of slab to the same value (if it is power of 2) or lower. High number of slabs increases memory usage (may be it can grow over long time because of fragmentation, but I've not noticed this). Unbound Howto Optimize [1] suggests to set num-threads equal to number of cores but IMHO it makes sense only if: server runs no other software except Unbound (even in this case some cores will be utilized by the kernel so better give to Unbound less than total core count) and it has more than enough RAM so possible memory fragmentation is not a concern. [1] https://www.nlnetlabs.nl/documentation/unbound/howto-optimise/ https://www.nlnetlabs.nl/documentation/unbound/howto-optimis...
lnxg33k1 5y ago
I also used to run bind back in the time, but now reading this article I just got up a container with powerdns seems quite easy to maintain
remram 5y ago
How much difficulty is added by DNSSEC?
- petee 5y ago
  Not much but you should have a good grasp first, and the implications (easy to add, tougher to remove) There are tools to automate resigning, but personally I just do it manually once a year for fun.
- rhizome 5y ago
  Less than the amount of difficulty added to driving a car that can only be adjusted by poking at a TV mounted some place where you aren't looking at the road. Sure, fixing that squeaky door is "easy," but have you ever heard the adage that every home project involves three trips to the hardware store? There may be technical aspects that few of us can implement from scratch and on the first try, but at the same time I also don't know how to build a good broom. These concerns are not insurmountable, especially with the network effects of people being in the same boat. How easy is it to find a good handyman without asking anybody? You don't have to.
  - remram 5y ago
    The question was about DNSSEC.
- brian_cunnie 5y ago
  I don't know how difficult it is to set up DNSSEC, but I do know I had to disable it on my internal BIND DNS server because it wasn't resolving google.com ("query failed (broken trust chain) for www.google.com/IN/A at query.c"): I had to modify my default BIND options to disable DNSSEC: options { dnssec-enable no; dnssec-validation no;
  - m3047 5y ago
    If you want DNSSEC to work, be sure you set up NTP and that it's working properly.
mads 5y ago
I was hacked one single time in my entire 25 year long career. Someone hacked a bind server I was running and installed some sort of bot node. That was in the 90’ies.
- qwertyuiop_ 5y ago
  The pi-hole I was running on Raspberry Pi got hacked. I only noticed the traffic when something unusual showed up on my node app console
  - haswell 5y ago
    Was the Pi running public facing services? How did this occur?
    - qwertyuiop_ 5y ago
      No it was internal facing behind cable router. There must have been some vulnerability in the pinhole or os. They breached the router
      - chrisfinazzo 5y ago
        Yikes. As much as I want to look into PiVPN, things like this give me pause.
        purpmint008 5y ago
        Wireguard is the only service that I bother to expose. It's stealth and has mitigations for DOS attacks.
        chrisfinazzo 5y ago
        Do you have a good guide for this? I sort of grok that the Pi (server) setup is different from the devices (clients) that will use it, but it’s always good to check assumptions. I already run PiHole, but I might run this on a different box just to keep things simple. Also, last I checked - port 51820 is reasonably well known, is it safe to use this default when forwarding traffic?
jmspring 5y ago
It is a good summary. My first reaction was "for pain and suffering". If you are hosting a server in some cloud provider, you probably still want to have your primary DNS not on that server. Yes, there are caveats.
- icedchai 5y ago
  I've been running my own DNS servers for 25+ years (BIND, though I did mess around with nsd and unbound for a bit locally.) It is basically painless, set-and-forget, other than the usual OS/package updates.
1vuio0pswjnm7 5y ago
reason: offer users of your website the option of per packet encrypted DNS CurveDNS is also not difficult to set up, so if you run your own authoritative DNS for your website, you can provide optional per packet encrypted DNS. There are very few websites that offer this option.^1 If every website provided this option, users would have a better alternative than DoT or DoH.^2 Neither DoT, DoH nor DNSSEC provide per packet encryption and they focus on DNS caches run by third parties, not authoritative servers. 1. One example is https://ianix.com https://ianix.com 2. Users could query the authoritative servers directly using stub resolvers and/or recursive resolvers that support dnscurve protocol, such as dq and dqcache, respectively.
reshie 5y ago
even just cashed is useful for normal users.

ur-whale 5y ago

> Before nsd, I ran djbdns Curious to know what made you switch (I still run djbdns).

fugue88 5y ago
I still run djbdns as well, as both an authoritative server and a caching resolver. The biggest downside to djbdns, to me, is its lack of DNSSEC support. There are patches available for that, but my distro doesn't package them and I haven't gotten around to making my own package to include them. The next biggest is related: djbdns lacks direct support for some newer Resource Records (like type 257 CAA) in its data file. However, the data file does allow you to encode arbitrary records directly, it's just a hassle to do it and to verify correctness.
quesera 5y ago
No technical reason, djbdns is great and I wouldn't hesitate to run it again. I did tire of building my own djbdns and daemontools packages. When I switched from qmail to Postfix, the others were collateral damage.
- ur-whale 5y ago
  Ah, yeah, I was never a fan of daemontools either. I actually run djbdns (both cache and authoritative) under systemd (not my fave thing, but the thing my OS comes equipped with) and it works fine. The lack of native support for some record types (eg. IPV6) is a little bit of a pain, but it's manageable.

pgporada 5y ago

What version of unbound are you running? With our traffic load we restart unbound 1.13.x daily to "fix" a memory leak.

quesera 5y ago
unbound-1.14.0 (newest). But I should have qualified -- I run a caching resolver for use by half a dozen users (so about 20 devices). Load is negligible, but it works perfectly! YMMV. As an added benefit, my unbound instance is also faster than 1.1.1.1, 8.8.8.8, or my ISP's resolver farm.
citrin_ru 5y ago
I've run relatively loaded unbound in the past - I would suggest to use minimum num-threads with which a single thread uses less than 50% CPU at peaks. And set number of slab to the same value (if it is power of 2) or lower. High number of slabs increases memory usage (may be it can grow over long time because of fragmentation, but I've not noticed this). Unbound Howto Optimize [1] suggests to set num-threads equal to number of cores but IMHO it makes sense only if: server runs no other software except Unbound (even in this case some cores will be utilized by the kernel so better give to Unbound less than total core count) and it has more than enough RAM so possible memory fragmentation is not a concern. [1] https://www.nlnetlabs.nl/documentation/unbound/howto-optimise/ https://www.nlnetlabs.nl/documentation/unbound/howto-optimis...

lnxg33k1 5y ago

I also used to run bind back in the time, but now reading this article I just got up a container with powerdns seems quite easy to maintain

remram 5y ago

How much difficulty is added by DNSSEC?

petee 5y ago
Not much but you should have a good grasp first, and the implications (easy to add, tougher to remove) There are tools to automate resigning, but personally I just do it manually once a year for fun.
rhizome 5y ago
Less than the amount of difficulty added to driving a car that can only be adjusted by poking at a TV mounted some place where you aren't looking at the road. Sure, fixing that squeaky door is "easy," but have you ever heard the adage that every home project involves three trips to the hardware store? There may be technical aspects that few of us can implement from scratch and on the first try, but at the same time I also don't know how to build a good broom. These concerns are not insurmountable, especially with the network effects of people being in the same boat. How easy is it to find a good handyman without asking anybody? You don't have to.
- remram 5y ago
  The question was about DNSSEC.
brian_cunnie 5y ago
I don't know how difficult it is to set up DNSSEC, but I do know I had to disable it on my internal BIND DNS server because it wasn't resolving google.com ("query failed (broken trust chain) for www.google.com/IN/A at query.c"): I had to modify my default BIND options to disable DNSSEC: options { dnssec-enable no; dnssec-validation no;
- m3047 5y ago
  If you want DNSSEC to work, be sure you set up NTP and that it's working properly.

mads 5y ago

I was hacked one single time in my entire 25 year long career. Someone hacked a bind server I was running and installed some sort of bot node. That was in the 90’ies.

qwertyuiop_ 5y ago
The pi-hole I was running on Raspberry Pi got hacked. I only noticed the traffic when something unusual showed up on my node app console
- haswell 5y ago
  Was the Pi running public facing services? How did this occur?
  - qwertyuiop_ 5y ago
    No it was internal facing behind cable router. There must have been some vulnerability in the pinhole or os. They breached the router
    - chrisfinazzo 5y ago
      Yikes. As much as I want to look into PiVPN, things like this give me pause.
      - purpmint008 5y ago
        Wireguard is the only service that I bother to expose. It's stealth and has mitigations for DOS attacks.
        chrisfinazzo 5y ago
        Do you have a good guide for this? I sort of grok that the Pi (server) setup is different from the devices (clients) that will use it, but it’s always good to check assumptions. I already run PiHole, but I might run this on a different box just to keep things simple. Also, last I checked - port 51820 is reasonably well known, is it safe to use this default when forwarding traffic?

jmspring 5y ago

It is a good summary. My first reaction was "for pain and suffering". If you are hosting a server in some cloud provider, you probably still want to have your primary DNS not on that server. Yes, there are caveats.

icedchai 5y ago
I've been running my own DNS servers for 25+ years (BIND, though I did mess around with nsd and unbound for a bit locally.) It is basically painless, set-and-forget, other than the usual OS/package updates.

1vuio0pswjnm7 5y ago

reason: offer users of your website the option of per packet encrypted DNS CurveDNS is also not difficult to set up, so if you run your own authoritative DNS for your website, you can provide optional per packet encrypted DNS. There are very few websites that offer this option.^1 If every website provided this option, users would have a better alternative than DoT or DoH.^2 Neither DoT, DoH nor DNSSEC provide per packet encryption and they focus on DNS caches run by third parties, not authoritative servers. 1. One example is https://ianix.com https://ianix.com 2. Users could query the authoritative servers directly using stub resolvers and/or recursive resolvers that support dnscurve protocol, such as dq and dqcache, respectively.

reshie 5y ago

even just cashed is useful for normal users.