5 ms·

I really do not understand the issue with DNS. It is a dead-simple protocol, and the level of caching at various levels between your server and the user would

I really do not understand the issue with DNS. It is a dead-simple protocol, and the level of caching at various levels between your server and the user would seem to make super-fast DNS serving irrelevant to the browser experience. As it is, queries on a 2004 level server box running lots of other services are under 2ms on a local network, so really network latency is the issue... having 2 simple 1U boxes colocated in NYC and LA, would cost under $200 per month and give you full control and the ability to host thousands if not tens of thousands of domains.

flyt 15y ago
You're right, it would be cheap to colocate two boxes to run DNS. Unfortunately you still have to: - Purchase the hardware - Receive the hardware - Install an OS on the hardware - Harden the OS from intruders - Decide how to manage the servers and setup that infrastructure (puppet/chef/cfengine/ssh/etc) - Install BIND - Load in all your zones - Ship the server(s) to each of the colo facilities - Pay for smart hands to install/configure the hosts - Setup a procedure to reliably sync zones from your RCS to the hosts and safely load zone changes without crashing BIND - Monitor the service and hosts - Setup alerting and escalations for when there are problems - Subscribe to BIND mailing lists and keep up with the community - ~once every couple years perform an ASAP update to BIND after a massive security hole is discovered (without getting compromised during this time) - Update BIND regularly - Deal with occasional outages at facilities - Configure anycast routing for your IP's Route 53 reduces this to: - Make an API call - Go back to developing your actual product.
- patrickgzill 15y ago
  I use djbdns / tinydns. So really, I don't have to do any of that. What you really would do, given your list above, would be - Buy hardware from vendor, ship direct to colo. - When racked, they hook up a KVM/IP device that has virtual media support to the system. - You install your OS from your desktop machine. - Turn off all services except DNS and public key SSH with hosts.deny and hosts.allow setup appropriately - Use automated scripts to move zones from current setup to djbdns format . - Tweak Makefile for djbdns (included in the distribution) to use ssh to move both the datafile and a text-version backup of the file, to each system. You can keep your original files on a machine local to you and push the changes via SSH that way. - you should have a machine or two outside your facility to run e.g. smokeping or other measurement/monitoring tools anyways; so run smokeping etc. on the same machine and if you are paranoid, run the webserver on 127.0.0.1 and use SSH tunneling to view the pages. Usually for $100/month per server, you can get outage monitoring and 30 minutes of remote hands per month, included.
jread 15y ago
True, but without Anycast you wont' be able to control which server users query, and your latency for EU or APAC users will probably be in the range of 200-800ms. Route 53 uses Anycast network infrastructure with many geographically dispersed POPs so users will hit the closest POP dramatically reducing latency. For $200/mo you could host a hundred domains and billions of queries with much better performance using Route 53.

flyt 15y ago

You're right, it would be cheap to colocate two boxes to run DNS. Unfortunately you still have to: - Purchase the hardware - Receive the hardware - Install an OS on the hardware - Harden the OS from intruders - Decide how to manage the servers and setup that infrastructure (puppet/chef/cfengine/ssh/etc) - Install BIND - Load in all your zones - Ship the server(s) to each of the colo facilities - Pay for smart hands to install/configure the hosts - Setup a procedure to reliably sync zones from your RCS to the hosts and safely load zone changes without crashing BIND - Monitor the service and hosts - Setup alerting and escalations for when there are problems - Subscribe to BIND mailing lists and keep up with the community - ~once every couple years perform an ASAP update to BIND after a massive security hole is discovered (without getting compromised during this time) - Update BIND regularly - Deal with occasional outages at facilities - Configure anycast routing for your IP's Route 53 reduces this to: - Make an API call - Go back to developing your actual product.

patrickgzill 15y ago
I use djbdns / tinydns. So really, I don't have to do any of that. What you really would do, given your list above, would be - Buy hardware from vendor, ship direct to colo. - When racked, they hook up a KVM/IP device that has virtual media support to the system. - You install your OS from your desktop machine. - Turn off all services except DNS and public key SSH with hosts.deny and hosts.allow setup appropriately - Use automated scripts to move zones from current setup to djbdns format . - Tweak Makefile for djbdns (included in the distribution) to use ssh to move both the datafile and a text-version backup of the file, to each system. You can keep your original files on a machine local to you and push the changes via SSH that way. - you should have a machine or two outside your facility to run e.g. smokeping or other measurement/monitoring tools anyways; so run smokeping etc. on the same machine and if you are paranoid, run the webserver on 127.0.0.1 and use SSH tunneling to view the pages. Usually for $100/month per server, you can get outage monitoring and 30 minutes of remote hands per month, included.

jread 15y ago

True, but without Anycast you wont' be able to control which server users query, and your latency for EU or APAC users will probably be in the range of 200-800ms. Route 53 uses Anycast network infrastructure with many geographically dispersed POPs so users will hit the closest POP dramatically reducing latency. For $200/mo you could host a hundred domains and billions of queries with much better performance using Route 53.