5 ms·

Honestly I think I'll be sticking to the big-boys: Knot DNS, Knot Resolver, Unbound and NSD. Those projects are well established, open-source, well maintained,

Honestly I think I'll be sticking to the big-boys: Knot DNS, Knot Resolver, Unbound and NSD. Those projects are well established, open-source, well maintained, battle-tested and as secure as a DNS server can be. I'm not sure what MaraDNS brings to the table that makes it exponentially better. A single-maintainer project DNS server is not something I would be comfortable leaving exposed on the internet. Perhaps especially as there appear to be a few odd coding decisions, such as rolling your own crypto (RNG).

kanisae 3y ago
I've been a fan of the powerdns project for many years. I have used it for authoritative, recursive and load balancing projects with great success. These days I use their dnsdist project to have fine grained control of DNS at my house to account for my various homelab shenanigans and provide that 99.99999% uptime the family demands.
- traceroute66 3y ago
  > their dnsdist project Wow. Never heard of dnsdist, that looks cool. I will shortly be embarking on an infra-refresh that is due to include DNS, so will be sure to evaluate it ! Thanks for highlighting it.
  - kanisae 3y ago
    My particular "killer app" for dnsdist right now is at my house I have 2 machines running dnsdist, set to forward to my pihole by default with health checks. If the health checks fail, the dnsdist daemons failover to google/cloudflare/etc. This lets me run a single instance of pihole (avoiding all the issues with trying to replicate configs across multiple pihole instances) and still having a solid backup if my pihole server goes down as it is by far the most likely piece of infra to just stop working. I also use it to route requests to my internal authoritative servers and failover to my external secondary authoritative mirrors as needed. This lets me keep all my local traffic local and still have my external failover as a catch all if my homelab infra is down to my own screw ups or some hardware failures.
mekster 3y ago
Right but you forgot PowerDNS which is rare to be able to support RDBMS as its native backend with third party web UI and there's also CoreDNS which is pluggable and graduated as a CNCF project.
- traceroute66 3y ago
  > you forgot PowerDNS I didn't forget it, I know the name, however from the comments received thus-far I've not had the (genuine) pleasure of using it. I will make an effort to ensure that changes. :)
JdeBP 3y ago
I'm fairly confident that MaraDNS, first written in 2001 and still around today, counts as well established. It's a decade older than Knot DNS.
- mrweasel 3y ago
  It's old than Knot, NSD, Unbound and the current iteration of Bind (not sure how much they rewrote for Bind 10, but it's a lot I believe.)
  - teddyh 3y ago
    Your information may simply be out of date, but: There is no ”BIND 10”. There was an aborted attempt some years ago with that name, but the current BIND is BIND 9, and there is, AFAIK, no current plans for a BIND 10.
    - mike_d 3y ago
      Eh, no? BIND 10 was under active development for years before ISC ran out of money. The continued work on BIND 9 is only happening thanks to numerous sponsors and large organizations with maintenance contracts. You can download BIND 10 release 1.2 here: https://downloads.isc.org/isc/bind10/latest/ https://downloads.isc.org/isc/bind10/latest/
      - teddyh 3y ago
        That latest release of that “BIND 10” is nine years old. The way I heard it, “BIND 10” was created at a time when BIND 9 development had stagnated, and BIND 10 was one of those “let’s rewrite it all” projects that you should never do¹. Consequently, it was a boondoggle, and was relatively quickly abandoned in favor of restarting BIND 9 development, which has continued very nicely ever since. There was indeed something called “BIND 10”. There is no BIND 10. 1. <https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...>
cvalka 3y ago
Please also consider coredns.

kanisae 3y ago

I've been a fan of the powerdns project for many years. I have used it for authoritative, recursive and load balancing projects with great success. These days I use their dnsdist project to have fine grained control of DNS at my house to account for my various homelab shenanigans and provide that 99.99999% uptime the family demands.

traceroute66 3y ago
> their dnsdist project Wow. Never heard of dnsdist, that looks cool. I will shortly be embarking on an infra-refresh that is due to include DNS, so will be sure to evaluate it ! Thanks for highlighting it.
- kanisae 3y ago
  My particular "killer app" for dnsdist right now is at my house I have 2 machines running dnsdist, set to forward to my pihole by default with health checks. If the health checks fail, the dnsdist daemons failover to google/cloudflare/etc. This lets me run a single instance of pihole (avoiding all the issues with trying to replicate configs across multiple pihole instances) and still having a solid backup if my pihole server goes down as it is by far the most likely piece of infra to just stop working. I also use it to route requests to my internal authoritative servers and failover to my external secondary authoritative mirrors as needed. This lets me keep all my local traffic local and still have my external failover as a catch all if my homelab infra is down to my own screw ups or some hardware failures.

mekster 3y ago

Right but you forgot PowerDNS which is rare to be able to support RDBMS as its native backend with third party web UI and there's also CoreDNS which is pluggable and graduated as a CNCF project.

traceroute66 3y ago
> you forgot PowerDNS I didn't forget it, I know the name, however from the comments received thus-far I've not had the (genuine) pleasure of using it. I will make an effort to ensure that changes. :)

JdeBP 3y ago

I'm fairly confident that MaraDNS, first written in 2001 and still around today, counts as well established. It's a decade older than Knot DNS.

mrweasel 3y ago
It's old than Knot, NSD, Unbound and the current iteration of Bind (not sure how much they rewrote for Bind 10, but it's a lot I believe.)
- teddyh 3y ago
  Your information may simply be out of date, but: There is no ”BIND 10”. There was an aborted attempt some years ago with that name, but the current BIND is BIND 9, and there is, AFAIK, no current plans for a BIND 10.
  - mike_d 3y ago
    Eh, no? BIND 10 was under active development for years before ISC ran out of money. The continued work on BIND 9 is only happening thanks to numerous sponsors and large organizations with maintenance contracts. You can download BIND 10 release 1.2 here: https://downloads.isc.org/isc/bind10/latest/ https://downloads.isc.org/isc/bind10/latest/
    - teddyh 3y ago
      That latest release of that “BIND 10” is nine years old. The way I heard it, “BIND 10” was created at a time when BIND 9 development had stagnated, and BIND 10 was one of those “let’s rewrite it all” projects that you should never do¹. Consequently, it was a boondoggle, and was relatively quickly abandoned in favor of restarting BIND 9 development, which has continued very nicely ever since. There was indeed something called “BIND 10”. There is no BIND 10. 1. <https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/ https://www.joelonsoftware.com/2000/04/06/things-you-should-...>

cvalka 3y ago

Please also consider coredns.