6 ms·

You can run a DNS server (2025)

148 points by surprisetalk 8mo ago

gerdesj 8mo ago
I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to point at your zones and if you have dynamic DNS support on your zones (RFC 2136) then you can now support ACME ie Lets Encrypt and Zerossl and co. Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. However, acme.sh and simple-acme do and both are absolutely rock solid. Both of those projects are used by a lot of people and well trod. acme.sh is ideal for unix gear and if you follow this blokes method of installation: https://pieterbakker.com/acme-sh-installation-guide-2025/ https://pieterbakker.com/acme-sh-installation-guide-2025/ usefully centralised. simple-acme is for Windows. It has loads of add on scripts to deal with scenarios. Those scripts seem to be deprecated but work rather well. Quite a lot of magic here that an old school Linux sysadmin is glad of. PowerDNS auth server supports dynamic DNS and you can filter access by IP and TSIG-KEY, per zone and/or globally. Join the dots. [EDIT: Speling, conjunction switch]
- 9dev 8mo ago
  Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.
  - tryauuum 7mo ago
    just installed yesterday the certbot on ubuntu 24.04, from the default repos, without any snaps
    - mediumsmart 7mo ago
      same on debian trixie. certbot works fine for me. Zone records in bind, generate the dnskey, cronjob to re-sign it daily and your off to the races. no problems no snaps.
  - locknitpicker 7mo ago
    > starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.
    - jcgl 7mo ago
      Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/ https://certbot.eff.org/
      - pgporada 7mo ago
        Make a PR or an issue on the project.
        jcgl 7mo ago
        I feel no need to. I'm quite certain that the certbot folks are aware of the existence of distro packages and even know how to check https://pkgs.org/download/certbot https://pkgs.org/download/certbot for availability. One might guess that they only want to supply instructions for upstream-managed distribution channels rather than dealing with e.g. some ancient version being shipped on Debian.
- adiabatichottub 7mo ago
  I'm a fan of uACME: https://github.com/ndilieto/uacme https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?
  - DaSHacka 7mo ago
    Neat, I've used lego (https://github.com/go-acme/lego https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.
    - adiabatichottub 7mo ago
      Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere. The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.
      - Spivak 7mo ago
        I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?
    - catlifeonmars 7mo ago
      Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.
  - dwedge 7mo ago
    > don't expect it to automatically set up your webserver to use the certificates it obtains. This makes me so happy. Acme and certbot trying to do this is annoying, Caddy trying to get certs by default is annoying. I ended up on a mix of dehydrated and Apache mod_md but I think I like the look of uACME because dehydrated just feels clunky
- ozim 7mo ago
  I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.
  - dwedge 7mo ago
    Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs
    - rdevilla 7mo ago
      GP comment is just vague distilled model AI slop.
      - ozim 7mo ago
        I don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.
    - ozim 7mo ago
      People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.
      - dwedge 7mo ago
        Ok I asked for an example and you provided one, that's fair. It also makes the second domain a target. I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.
- rdevilla 7mo ago
  > Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation specific server or zone. ... which is a very common pattern I've seen hundreds (thousands?) of times. The issue you may have run into is that CNAME records are NOT allowed at the zone apex, for RFC 1033 states: The CNAME record is used for nicknames. [...] There must not be any other RRs associated with a nickname of the same class. ... of course making it impossible to enter NS, SOA, etc. records for the zone root when a CNAME exists there. P.S. doing literally fucking anything on mobile is like pulling teeth encased in concrete. Since this is how the vast majority of the world interfaces with computing I am totally unsurprised that people are claiming 10x speedups with LLMs. [0] https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/
  - jcalvinowens 7mo ago
    I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072 https://news.ycombinator.com/item?id=47066072
    - rdevilla 7mo ago
      I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.
      - jcalvinowens 7mo ago
        I remember being annoyed because the docs don't actually say you can't do it: https://certbot-dns-rfc2136.readthedocs.io/en/stable/ https://certbot-dns-rfc2136.readthedocs.io/en/stable/ ...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_nsupdate.sh#L10 https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME _acme-challenge.foo.bar.com ...I can make certbot talk to the foo.bar.com DNS server, but it tries to add the TXT record for _acme-challenge.foo.com, which that DNS server obviously rejects (and even if it accepted it, that obviously wouldn't work). I'd be happy to hear there's a way to do it that I missed. Also I'm specifically talking about the rfc2136 support, maybe some of the proprietary certbot backends do support this. EDIT: Here are more references: https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/6644 https://github.com/certbot/certbot/pull/6644
deepsun 7mo ago
How to make it DNSSEC?
- adiabatichottub 7mo ago
  If you don't absolutely have to, then don't. That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.
  - deepsun 7mo ago
    I consider it as basic security measure as SSL. Otherwise any MitM can easily redirect users to a phishing resource. Did DNSSEC for company website, worked with zero maintenance for several years. On a cloud-provided DNS. Would want the same on self-hosted DNS too.
    - 0x073 7mo ago
      "Otherwise any MitM can easily redirect users to a phishing resource." Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites. If bad actors can create valid tls certs they can solve the dnssec problem.
      - throw0101d 7mo ago
        > If bad actors can create valid tls certs they can solve the dnssec problem. I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs. It is now mandated that public CAs have to verify DNSSEC before issuing a cert: * https://news.ycombinator.com/item?id=47392510 https://news.ycombinator.com/item?id=47392510 So if you want to reduce the risk of someone creating a fake cert for one of your properties, you want to protect your DNS responses.
        0x073 7mo ago
emithq 7mo ago
[flagged]
defanor 7mo ago
I prefer and use the knot DNS server for authoritative DNS (and either knot-resolver or Unbound for caching DNS servers) myself: it is quite feature-rich, including DNSSEC, RFC 2136 support, an easy master-slave setup. Apparently it does support database-based configuration and zone definitions, too, but I find file-based storage to be simpler.
- adiabatichottub 7mo ago
  The database for configuration and zone data is strictly internal and not tied to an external relational database, like what's shown in the article.
WaitWaitWha 7mo ago
Running DNSMasq on an old RasPI & USB SSD. No problems no issues. Just quietly runs in the background.
- henrebotha 7mo ago
  dnsmasq on an RPi Zero 2W is the backbone of my self-hosted setup. Combined with Tailscale, it gives me access from anywhere to arbitrary domains I define myself, with full HTTPS thanks to Caddy.
  - ssl-3 7mo ago
    At home, I put all of my network infrastructure software in one basket because that seems like the right path towards maximizing availability[1]: It provides one point of potential hardware failure instead of many. For me, that means doing routing, DNS, VPN, and associated stuff with one box running OpenWRT. It works. It's ridiculously stable. And rather than having a number of things that could break the network when they die, I only have 1 thing that can do so. That box currently happens to be a Raspberry Pi 4 that uses VLANs as Ethernet port expanders, but it is also stable AF with a [shock! horror!] USB NIC. I picked that direction years ago mostly because I have a strong affinity towards avoiding critical moving parts (like cooling fans) in infrastructure. But those details don't matter. Any single box running OpenWRT, OPNsense, pfSense, Debian, FreeBSD, or whatever, can behave more-or-less similarly. [1]: Yeah, so about that. If the real-world MTBF for a system that relies upon 1 box is 10 years, then the MTBF for a system relying on 2 boxes to both keep working is only 5 years. Less is more.
- teddyh 7mo ago
  DNSMasq is a DNS resolver, not a DNS server.
  - nine_k 7mo ago
    It's both, and more, in a way. But it's primarily a DNS tweaking tool, and does not support things like zone transfers. Which you usually don't need with a small-scale personal setup anyway.
micw 7mo ago
I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?
- slow_typist 7mo ago
  SSH tunnels is a possibility.
- khoirul 7mo ago
  You could run it within a Tailscale VPN network. In fact Headscale (Tailscale server) has a very basic DNS server built-in.
  - Xylakant 7mo ago
    That assumes a device that can enter a VPN. I’d like to run a DNS server for a group of kids playing Minecraft on a switch. Since they’re not in the same (W)LAN, I can’t do it on the local network level. And the switch doesn’t have a VPN client.
    - albertgoeswoof 7mo ago
      Why do you want to do this? What would you redirect / override on this?
    - ssl-3 7mo ago
      Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefing-resistant while still letting kids play the game together). And AXFR zone transfers are one way that DNS addresses leak. (AXFR is a feature, not a bug.) As a potential solution: You can set up DNS that resolves the magic hardcoded Minecraft server name (whatever that is) to the address of your choosing, and that has AXFR disabled. In this way, nobody will be able to discover the game server's address unless they ask that particular DNS server for the address of that particular name. It's not airtight (obscurity never is), but it's probably fine. It increases the size of the haystack. (Or... Lacking VPN, you can whitelist only the networks that the kids use to play from. But in my experience with whitelisting, the juice isn't worth the squeeze in a world of uncontrollably-dynamic IP addresses. All someone wants to do is play the game/access the server/whatever Right Now, but the WAN address has changed so that doesn't work until they get someone's attention and wait for them to make time to update the whitelist. By the time this happens, Right Now is in the past. Whitelisting generally seems antithetical towards getting things done in a casual fashion.)
kev009 7mo ago
unbound and nsd for me, always run my own recursor and authority.
dwedge 7mo ago
I've been tempted by this because I self host everything else, but "adding an entry to postgres instead of using namecheap gui" is overkill, just use a DNS with an API. Last few days I've been migrating everything to luadns format, stored in github and then I have github actions triggering a script to convert it to octodns and apply it. I could have just used either, but I like the luadns format but didn't want to be stuck using them as a provider
- megous 7mo ago
  DNS servers are manageable via standard utilities/protocol, with tools like nsupdate, if you enable it.
- zyberzero 7mo ago
  I selfhost DNS as well, but I just use plain old bind zone files and it works well enough across a bunch of domains (and RFC2136 for my dynamic IP at home) that I haven't bothered to look into database stored records. I just need to remember the pesky serial number so that the changes get properly replicated :)
rmoriz 7mo ago
Still running DNS without a database and immutable. Push-based deployment.
- deltarholamda 7mo ago
  I do this as well. I have a decent number of domains in my control, but not hundreds, so editing a text file and updating a hidden master is a perfectly reasonable workflow.
  - rmoriz 7mo ago
    I built a ruby cli (back when Thor was a thing) that does most of the stuff, but I still edit the zone itself using vim („dns edit <zone>“ launches vim). PowerDNS has nice cli to deal with DNSSEC and bind (file) backend so I don’t have to deal with it by hand. Of course I am the only user. But YAGNI works for me.
Pythius 7mo ago
[flagged]
BatteryMountain 7mo ago
Get a mini-pc with 2x LAN ports + a mediatek Wifi 6/7 module. Install Proxmox. Make 3 VM's: OpenWrt (or router firmware of choice), unbound and adguard home. Plug your fibre into lan port, plug rest of network into other lan port. In proxmox, set pcie passthrough for one of the Lan ports and the wifi card. Setup openwrt to connect to your isp and points its dns to you adguard home server. Point your adguard home server to your unbound server as upstream. This is a good starting point if you want to get a feel for running your own router + dns. You don't need to use off the shelf garbage routers; x86/x64 routers are the best. On openwrt I configure a special traffic queue so that I don't have buffer overflows, so my connection is super stable and low latency. Combined with the adguard + unbound dns setup, my internet connection is amazingly fast compared to traditional routers. Better yet, set up ssh to the proxmox server and ask claude code to set it up for you, works like a charm! claude can call ssh and dig and verify that your dns chains work, it can test your firewall and ports (basically running pen tests against yourself..), it can sort out almost any issue (I had intel wifi card and had firmware locks on broadcasting in 5GHZ spectrum in AP Mode - mediatek doesn't - claude helped try to override firmware in kernel but intel firmware won't budge). It can setup automatic nightly updates that are safe, it can help you setup recovery/backup plans (which runs before updates), it can automate certain proxmox tasks (periodic snapshotting of vm's) and best of all, it can document the entire infrastructure comprehensively each time I make changes to it.
- ssl-3 7mo ago
  That seems like a lot of steps that could be reduced to: 1. Run OpenWRT 2. Use it for the DNS of one's own choosing
  - BatteryMountain 7mo ago
    Sorry had too much caffeine this morning before I typed that.
tzury 7mo ago
Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alone prevent. Unless of course you will invest 5-6 figures worth of US dollars worth of equipment, which by then you can look back and ask yourself, was I better off with Google Cloud DNS, AWS Route 53 and the likes.
- jcgl 7mo ago
  Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.
  - tzury 7mo ago
    Large scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).
    - megous 7mo ago
      Virtual private cloud services where you host the DNS server may also include DDoS protection.
      - tzury 7mo ago
        May or may not. You open the UDP ports, you get flooded, they block all incoming traffic, and this way or another your assets are not resolvable. One must distinguish between application layer attacks HTTP/S and UDP, cloud vendors won’t protect you implicitly for network layer attacks unless you purchased such service from them.
        megous 7mo ago
karel-3d 7mo ago
If you run powerdns auth, consider front-running it with dnsdist (also from powerdns). (disclaimer: I contribute a tiny bit to dnsdist.)
bpbp-mango 7mo ago
I run PowerDNS as both authoritative and recursing at my ISP job. Great piece of software.
icedchai 7mo ago
I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.
fullstop 7mo ago
I've been running tinydns for decades now. I don't even think about it anymore.
- adiabatichottub 7mo ago
  We did as well for about 20 years. It is a very solid program and does everything it promises. Unfortunately it lacks modern features, and development is sparse to say the least, so we ended up moving to Knot. I'd still recommend tinydns for really simple deployments, though.
stego-tech 7mo ago
I've found that teaching DNS is an excellent gateway to learning about how the internet itself works, especially to "green" tech folks who go blank-faced when you get into protocols, IPs, etc. Break out a piece of mail, connect the dots, and you see their eyes light up with comprehension. "Oh, so that's how my computer gets to google.com; it's just like how my postman knows where to deliver my mail!" Then a critical component is demystified, and they want to learn more. Running a DNS server is honestly such a good activity for folks in general.
Adachi91 7mo ago
I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whatsmydns.net/ https://www.whatsmydns.net/ reported it could not query A names, while 30% were like "Yeah here you go" from their cache. I fixed the glue and got everything back up, I need to write an automated script to check every day if my IP has changed and alert me to update my glue record at my registar. I use a lot of mix and match scripts to maintain other aspects like challenges for DNS e.g. Letsencrypt, I'll use their hooks to update my DNS, resign it (DNSSEC), complete the challenge, then cleanup. My more personal domains I don't use DNSSEC so I just skip right ahead. I quite enjoy handling my own DNS records, BIND has been really good to me and I love their `view "external"` and `view "internal"` scopes so I can give the world my authoritative records, and internally serve my intranet and other services like pihole (which sits behind BIND)
justsomehnguy 7mo ago
> writing zone files with some arcane syntax that BIND 9 is apparently famous of gawd just install webmin ffs
vardalab 7mo ago
I have run technitium for 4 or so years now, in a recursive mode, handles all my homelab needs and it is faster as well. Now that it has clustering support I have three instances in my proxmox cluster.
1vuio0pswjnm7 7mo ago
You can also serve a root.zone on that DNS server and it does not have to a carbon copy of ICANN's root.zone. I have been doing this for over 15 years. I've tried many DNS server software projects over that time and I always come back to djbdns Multiple comments in this thread refer to TLS certificates Why is payment to and/or permission from a third party "necessary" to encrypt data in transit over the a computer network, whether it's a LAN or an internet. What does this phoney "requirement" achieve For example, why is it "necessary" to purchase a domain name registration from an "ICANN-approved" registrar in order to use a TLS certificate Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication". What purpose does _purchasing_ a registration serve. For example, similar to "free" Let's Encrypt certificates, domain names could also be "free" Whatever "authentication" ICANN and its "approved" registries and registrars are doing, e.g., none, is it possible someone else could do it better using a different approach This comment is not asking for answers to these questions; the question are rhetorical. Of course the questions may trigger defensive replies; everyone is entitled to an opinion and opinions may differ
- m3047 7mo ago
  Yes, you can have a different root zone which includes some or all of ICANN's root servers, or none of them. However if the root zone doesn't match ICANN's then DNSSEC will fail ("fruit of the poisoned tree"). But you could sign your alternate, custom root, and issue DNSSEC keys all the way down. You don't need ICANN for TLS or encryption. You can create your own CA and sign your own certs. In fact, this is typically how it's done to authenticate for example clients of a web server using certs (you install the cert in the browser). You can use your CA to sign a cert for your ICANN-registered domain and install it in the web server; there are no internet police who are gonna stop you. Web browsers will complain about this "self-signed cert", unless you install your CA's public key in your browser. (Security-wise, you probably shouldn't go around installing random people's CA certs in your browser. You need to trust them not to issue certs for e.g. google.com. On the other hand you need to trust China and Morocco not to do that already, so maybe you're willing to accept that risk.) > Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication". People make the mistake of conflating an FQDN or address with identity all the time. People point at resources in domains which don't exist (this includes DNS resources), and people register those abandoned domains and then click "forgot password" and take over whatever account was tied to that email address in that domain. I don't know that ICANN requires any proof. There are CAs which have enhanced identity verification, this applies to the certs they issue for both servers and clients / people. > What purpose does _purchasing_ a registration serve. Makes you a member of ICANN's club. There are pseudo-TLDs which are registered in ICANN's tree where you can register a (sub)domain, without interacting with ICANN at all. Rhetorically speaking, of course.

148 points by surprisetalk 8mo ago

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to point at your zones and if you have dynamic DNS support on your zones (RFC 2136) then you can now support ACME ie Lets Encrypt and Zerossl and co. Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. However, acme.sh and simple-acme do and both are absolutely rock solid. Both of those projects are used by a lot of people and well trod. acme.sh is ideal for unix gear and if you follow this blokes method of installation: https://pieterbakker.com/acme-sh-installation-guide-2025/ https://pieterbakker.com/acme-sh-installation-guide-2025/ usefully centralised. simple-acme is for Windows. It has loads of add on scripts to deal with scenarios. Those scripts seem to be deprecated but work rather well. Quite a lot of magic here that an old school Linux sysadmin is glad of. PowerDNS auth server supports dynamic DNS and you can filter access by IP and TSIG-KEY, per zone and/or globally. Join the dots. [EDIT: Speling, conjunction switch]

9dev 8mo ago
Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.
- tryauuum 7mo ago
  just installed yesterday the certbot on ubuntu 24.04, from the default repos, without any snaps
  - mediumsmart 7mo ago
    same on debian trixie. certbot works fine for me. Zone records in bind, generate the dnskey, cronjob to re-sign it daily and your off to the races. no problems no snaps.
- locknitpicker 7mo ago
  > starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.
  - jcgl 7mo ago
    Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/ https://certbot.eff.org/
    - pgporada 7mo ago
      Make a PR or an issue on the project.
      - jcgl 7mo ago
        I feel no need to. I'm quite certain that the certbot folks are aware of the existence of distro packages and even know how to check https://pkgs.org/download/certbot https://pkgs.org/download/certbot for availability. One might guess that they only want to supply instructions for upstream-managed distribution channels rather than dealing with e.g. some ancient version being shipped on Debian.
adiabatichottub 7mo ago
I'm a fan of uACME: https://github.com/ndilieto/uacme https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?
- DaSHacka 7mo ago
  Neat, I've used lego (https://github.com/go-acme/lego https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.
  - adiabatichottub 7mo ago
    Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere. The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.
    - Spivak 7mo ago
      I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?
  - catlifeonmars 7mo ago
    Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.
- dwedge 7mo ago
  > don't expect it to automatically set up your webserver to use the certificates it obtains. This makes me so happy. Acme and certbot trying to do this is annoying, Caddy trying to get certs by default is annoying. I ended up on a mix of dehydrated and Apache mod_md but I think I like the look of uACME because dehydrated just feels clunky
ozim 7mo ago
I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.
- dwedge 7mo ago
  Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs
  - rdevilla 7mo ago
    GP comment is just vague distilled model AI slop.
    - ozim 7mo ago
      I don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.
  - ozim 7mo ago
    People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.
    - dwedge 7mo ago
      Ok I asked for an example and you provided one, that's fair. It also makes the second domain a target. I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.
rdevilla 7mo ago
> Sadly certbot doesn't do (or it didn't) CNAME redirects for ACME. Are you certain? Not at a real machine at the moment so hard for me to dig into the details but CNAMEing the challenge response to another domain is absolutely supported via DNS-01 [0] and certbot is Let's Encrypt's recommended ACME client: [1] Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation specific server or zone. ... which is a very common pattern I've seen hundreds (thousands?) of times. The issue you may have run into is that CNAME records are NOT allowed at the zone apex, for RFC 1033 states: The CNAME record is used for nicknames. [...] There must not be any other RRs associated with a nickname of the same class. ... of course making it impossible to enter NS, SOA, etc. records for the zone root when a CNAME exists there. P.S. doing literally fucking anything on mobile is like pulling teeth encased in concrete. Since this is how the vast majority of the world interfaces with computing I am totally unsurprised that people are claiming 10x speedups with LLMs. [0] https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ [1] https://letsencrypt.org/docs/client-options/ https://letsencrypt.org/docs/client-options/
- jcalvinowens 7mo ago
  I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072 https://news.ycombinator.com/item?id=47066072
  - rdevilla 7mo ago
    I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.
    - jcalvinowens 7mo ago
      I remember being annoyed because the docs don't actually say you can't do it: https://certbot-dns-rfc2136.readthedocs.io/en/stable/ https://certbot-dns-rfc2136.readthedocs.io/en/stable/ ...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_nsupdate.sh#L10 https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME _acme-challenge.foo.bar.com ...I can make certbot talk to the foo.bar.com DNS server, but it tries to add the TXT record for _acme-challenge.foo.com, which that DNS server obviously rejects (and even if it accepted it, that obviously wouldn't work). I'd be happy to hear there's a way to do it that I missed. Also I'm specifically talking about the rfc2136 support, maybe some of the proprietary certbot backends do support this. EDIT: Here are more references: https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/issues/6566 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/5350 https://github.com/certbot/certbot/pull/6644 https://github.com/certbot/certbot/pull/6644

deepsun 7mo ago

How to make it DNSSEC?

adiabatichottub 7mo ago
If you don't absolutely have to, then don't. That is to say, if you misconfigure it, or try to turn it off, you will have an invalid domain until the TTL runs out, and it's really just not worth the headache unless you have a real use case.
- deepsun 7mo ago
  I consider it as basic security measure as SSL. Otherwise any MitM can easily redirect users to a phishing resource. Did DNSSEC for company website, worked with zero maintenance for several years. On a cloud-provided DNS. Would want the same on self-hosted DNS too.
  - 0x073 7mo ago
    "Otherwise any MitM can easily redirect users to a phishing resource." Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites. If bad actors can create valid tls certs they can solve the dnssec problem.
    - throw0101d 7mo ago
      > If bad actors can create valid tls certs they can solve the dnssec problem. I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs. It is now mandated that public CAs have to verify DNSSEC before issuing a cert: * https://news.ycombinator.com/item?id=47392510 https://news.ycombinator.com/item?id=47392510 So if you want to reduce the risk of someone creating a fake cert for one of your properties, you want to protect your DNS responses.
      - 0x073 7mo ago

emithq 7mo ago

[flagged]

defanor 7mo ago

I prefer and use the knot DNS server for authoritative DNS (and either knot-resolver or Unbound for caching DNS servers) myself: it is quite feature-rich, including DNSSEC, RFC 2136 support, an easy master-slave setup. Apparently it does support database-based configuration and zone definitions, too, but I find file-based storage to be simpler.

adiabatichottub 7mo ago
The database for configuration and zone data is strictly internal and not tied to an external relational database, like what's shown in the article.

WaitWaitWha 7mo ago

Running DNSMasq on an old RasPI & USB SSD. No problems no issues. Just quietly runs in the background.

henrebotha 7mo ago
dnsmasq on an RPi Zero 2W is the backbone of my self-hosted setup. Combined with Tailscale, it gives me access from anywhere to arbitrary domains I define myself, with full HTTPS thanks to Caddy.
- ssl-3 7mo ago
  At home, I put all of my network infrastructure software in one basket because that seems like the right path towards maximizing availability[1]: It provides one point of potential hardware failure instead of many. For me, that means doing routing, DNS, VPN, and associated stuff with one box running OpenWRT. It works. It's ridiculously stable. And rather than having a number of things that could break the network when they die, I only have 1 thing that can do so. That box currently happens to be a Raspberry Pi 4 that uses VLANs as Ethernet port expanders, but it is also stable AF with a [shock! horror!] USB NIC. I picked that direction years ago mostly because I have a strong affinity towards avoiding critical moving parts (like cooling fans) in infrastructure. But those details don't matter. Any single box running OpenWRT, OPNsense, pfSense, Debian, FreeBSD, or whatever, can behave more-or-less similarly. [1]: Yeah, so about that. If the real-world MTBF for a system that relies upon 1 box is 10 years, then the MTBF for a system relying on 2 boxes to both keep working is only 5 years. Less is more.
teddyh 7mo ago
DNSMasq is a DNS resolver, not a DNS server.
- nine_k 7mo ago
  It's both, and more, in a way. But it's primarily a DNS tweaking tool, and does not support things like zone transfers. Which you usually don't need with a small-scale personal setup anyway.

micw 7mo ago

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

slow_typist 7mo ago
SSH tunnels is a possibility.
khoirul 7mo ago
You could run it within a Tailscale VPN network. In fact Headscale (Tailscale server) has a very basic DNS server built-in.
- Xylakant 7mo ago
  That assumes a device that can enter a VPN. I’d like to run a DNS server for a group of kids playing Minecraft on a switch. Since they’re not in the same (W)LAN, I can’t do it on the local network level. And the switch doesn’t have a VPN client.
  - albertgoeswoof 7mo ago
    Why do you want to do this? What would you redirect / override on this?
  - ssl-3 7mo ago
    Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefing-resistant while still letting kids play the game together). And AXFR zone transfers are one way that DNS addresses leak. (AXFR is a feature, not a bug.) As a potential solution: You can set up DNS that resolves the magic hardcoded Minecraft server name (whatever that is) to the address of your choosing, and that has AXFR disabled. In this way, nobody will be able to discover the game server's address unless they ask that particular DNS server for the address of that particular name. It's not airtight (obscurity never is), but it's probably fine. It increases the size of the haystack. (Or... Lacking VPN, you can whitelist only the networks that the kids use to play from. But in my experience with whitelisting, the juice isn't worth the squeeze in a world of uncontrollably-dynamic IP addresses. All someone wants to do is play the game/access the server/whatever Right Now, but the WAN address has changed so that doesn't work until they get someone's attention and wait for them to make time to update the whitelist. By the time this happens, Right Now is in the past. Whitelisting generally seems antithetical towards getting things done in a casual fashion.)

kev009 7mo ago

unbound and nsd for me, always run my own recursor and authority.

dwedge 7mo ago

I've been tempted by this because I self host everything else, but "adding an entry to postgres instead of using namecheap gui" is overkill, just use a DNS with an API. Last few days I've been migrating everything to luadns format, stored in github and then I have github actions triggering a script to convert it to octodns and apply it. I could have just used either, but I like the luadns format but didn't want to be stuck using them as a provider

megous 7mo ago
DNS servers are manageable via standard utilities/protocol, with tools like nsupdate, if you enable it.
zyberzero 7mo ago
I selfhost DNS as well, but I just use plain old bind zone files and it works well enough across a bunch of domains (and RFC2136 for my dynamic IP at home) that I haven't bothered to look into database stored records. I just need to remember the pesky serial number so that the changes get properly replicated :)

rmoriz 7mo ago

Still running DNS without a database and immutable. Push-based deployment.

deltarholamda 7mo ago
I do this as well. I have a decent number of domains in my control, but not hundreds, so editing a text file and updating a hidden master is a perfectly reasonable workflow.
- rmoriz 7mo ago
  I built a ruby cli (back when Thor was a thing) that does most of the stuff, but I still edit the zone itself using vim („dns edit <zone>“ launches vim). PowerDNS has nice cli to deal with DNSSEC and bind (file) backend so I don’t have to deal with it by hand. Of course I am the only user. But YAGNI works for me.

Pythius 7mo ago

[flagged]

BatteryMountain 7mo ago

Get a mini-pc with 2x LAN ports + a mediatek Wifi 6/7 module. Install Proxmox. Make 3 VM's: OpenWrt (or router firmware of choice), unbound and adguard home. Plug your fibre into lan port, plug rest of network into other lan port. In proxmox, set pcie passthrough for one of the Lan ports and the wifi card. Setup openwrt to connect to your isp and points its dns to you adguard home server. Point your adguard home server to your unbound server as upstream. This is a good starting point if you want to get a feel for running your own router + dns. You don't need to use off the shelf garbage routers; x86/x64 routers are the best. On openwrt I configure a special traffic queue so that I don't have buffer overflows, so my connection is super stable and low latency. Combined with the adguard + unbound dns setup, my internet connection is amazingly fast compared to traditional routers. Better yet, set up ssh to the proxmox server and ask claude code to set it up for you, works like a charm! claude can call ssh and dig and verify that your dns chains work, it can test your firewall and ports (basically running pen tests against yourself..), it can sort out almost any issue (I had intel wifi card and had firmware locks on broadcasting in 5GHZ spectrum in AP Mode - mediatek doesn't - claude helped try to override firmware in kernel but intel firmware won't budge). It can setup automatic nightly updates that are safe, it can help you setup recovery/backup plans (which runs before updates), it can automate certain proxmox tasks (periodic snapshotting of vm's) and best of all, it can document the entire infrastructure comprehensively each time I make changes to it.

ssl-3 7mo ago
That seems like a lot of steps that could be reduced to: 1. Run OpenWRT 2. Use it for the DNS of one's own choosing
- BatteryMountain 7mo ago
  Sorry had too much caffeine this morning before I typed that.

tzury 7mo ago

Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alone prevent. Unless of course you will invest 5-6 figures worth of US dollars worth of equipment, which by then you can look back and ask yourself, was I better off with Google Cloud DNS, AWS Route 53 and the likes.

jcgl 7mo ago
Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.
- tzury 7mo ago
  Large scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).
  - megous 7mo ago
    Virtual private cloud services where you host the DNS server may also include DDoS protection.
    - tzury 7mo ago
      May or may not. You open the UDP ports, you get flooded, they block all incoming traffic, and this way or another your assets are not resolvable. One must distinguish between application layer attacks HTTP/S and UDP, cloud vendors won’t protect you implicitly for network layer attacks unless you purchased such service from them.
      - megous 7mo ago

karel-3d 7mo ago

If you run powerdns auth, consider front-running it with dnsdist (also from powerdns). (disclaimer: I contribute a tiny bit to dnsdist.)

bpbp-mango 7mo ago

I run PowerDNS as both authoritative and recursing at my ISP job. Great piece of software.

icedchai 7mo ago

I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.

fullstop 7mo ago

I've been running tinydns for decades now. I don't even think about it anymore.

adiabatichottub 7mo ago
We did as well for about 20 years. It is a very solid program and does everything it promises. Unfortunately it lacks modern features, and development is sparse to say the least, so we ended up moving to Knot. I'd still recommend tinydns for really simple deployments, though.

stego-tech 7mo ago

I've found that teaching DNS is an excellent gateway to learning about how the internet itself works, especially to "green" tech folks who go blank-faced when you get into protocols, IPs, etc. Break out a piece of mail, connect the dots, and you see their eyes light up with comprehension. "Oh, so that's how my computer gets to google.com; it's just like how my postman knows where to deliver my mail!" Then a critical component is demystified, and they want to learn more. Running a DNS server is honestly such a good activity for folks in general.

Adachi91 7mo ago

I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whatsmydns.net/ https://www.whatsmydns.net/ reported it could not query A names, while 30% were like "Yeah here you go" from their cache. I fixed the glue and got everything back up, I need to write an automated script to check every day if my IP has changed and alert me to update my glue record at my registar. I use a lot of mix and match scripts to maintain other aspects like challenges for DNS e.g. Letsencrypt, I'll use their hooks to update my DNS, resign it (DNSSEC), complete the challenge, then cleanup. My more personal domains I don't use DNSSEC so I just skip right ahead. I quite enjoy handling my own DNS records, BIND has been really good to me and I love their `view "external"` and `view "internal"` scopes so I can give the world my authoritative records, and internally serve my intranet and other services like pihole (which sits behind BIND)

justsomehnguy 7mo ago

> writing zone files with some arcane syntax that BIND 9 is apparently famous of gawd just install webmin ffs

vardalab 7mo ago

I have run technitium for 4 or so years now, in a recursive mode, handles all my homelab needs and it is faster as well. Now that it has clustering support I have three instances in my proxmox cluster.

1vuio0pswjnm7 7mo ago

You can also serve a root.zone on that DNS server and it does not have to a carbon copy of ICANN's root.zone. I have been doing this for over 15 years. I've tried many DNS server software projects over that time and I always come back to djbdns Multiple comments in this thread refer to TLS certificates Why is payment to and/or permission from a third party "necessary" to encrypt data in transit over the a computer network, whether it's a LAN or an internet. What does this phoney "requirement" achieve For example, why is it "necessary" to purchase a domain name registration from an "ICANN-approved" registrar in order to use a TLS certificate Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication". What purpose does _purchasing_ a registration serve. For example, similar to "free" Let's Encrypt certificates, domain names could also be "free" Whatever "authentication" ICANN and its "approved" registries and registrars are doing, e.g., none, is it possible someone else could do it better using a different approach This comment is not asking for answers to these questions; the question are rhetorical. Of course the questions may trigger defensive replies; everyone is entitled to an opinion and opinions may differ

m3047 7mo ago
Yes, you can have a different root zone which includes some or all of ICANN's root servers, or none of them. However if the root zone doesn't match ICANN's then DNSSEC will fail ("fruit of the poisoned tree"). But you could sign your alternate, custom root, and issue DNSSEC keys all the way down. You don't need ICANN for TLS or encryption. You can create your own CA and sign your own certs. In fact, this is typically how it's done to authenticate for example clients of a web server using certs (you install the cert in the browser). You can use your CA to sign a cert for your ICANN-registered domain and install it in the web server; there are no internet police who are gonna stop you. Web browsers will complain about this "self-signed cert", unless you install your CA's public key in your browser. (Security-wise, you probably shouldn't go around installing random people's CA certs in your browser. You need to trust them not to issue certs for e.g. google.com. On the other hand you need to trust China and Morocco not to do that already, so maybe you're willing to accept that risk.) > Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication". People make the mistake of conflating an FQDN or address with identity all the time. People point at resources in domains which don't exist (this includes DNS resources), and people register those abandoned domains and then click "forgot password" and take over whatever account was tied to that email address in that domain. I don't know that ICANN requires any proof. There are CAs which have enhanced identity verification, this applies to the certs they issue for both servers and clients / people. > What purpose does _purchasing_ a registration serve. Makes you a member of ICANN's club. There are pseudo-TLDs which are registered in ICANN's tree where you can register a (sub)domain, without interacting with ICANN at all. Rhetorically speaking, of course.