3 ms·
Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alo
by tzury 7mo ago
Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alone prevent.
Unless of course you will invest 5-6 figures worth of US dollars worth of equipment, which by then you can look back and ask yourself, was I better off with Google Cloud DNS, AWS Route 53 and the likes.
- jcgl 7mo agoNot that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.
- tzury 7mo agoLarge scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).
- megous 7mo agoVirtual private cloud services where you host the DNS server may also include DDoS protection.
- tzury 7mo agoMay or may not. You open the UDP ports, you get flooded, they block all incoming traffic, and this way or another your assets are not resolvable. One must distinguish between application layer attacks HTTP/S and UDP, cloud vendors won’t protect you implicitly for network layer attacks unless you purchased such service from them.
- megous 7mo agoSo you buy it. I checked the prices at our provider, and it's something like $20+/month extra and they use some HW from https://www.riorey.com/ https://www.riorey.com/ Far cry from needing $1e6 HW ourselves.
- jcgl 7mo agoSure, but if the services are available, you can just purchase as-needed. If the problem never comes up, you're golden.
- mlhpdx 7mo agoDoes that mean running your own DNS in the cloud is a better answer? This is what I do.
- jcgl 7mo agoYes, of course. But my question was why are you focusing on DNS here? Everything you've said so far is true of setting up literally any public service. Considering how cheap DNS is to serve in the common case, running an authoritative DNS server seems no less risky than running, say, a web server.