5 ms·
There are some benefits (incentives) to running your own DNS server with the ability to perform recursive queries, but best practices dictate that these servers
by bradleyland 14y ago
There are some benefits (incentives) to running your own DNS server with the ability to perform recursive queries, but best practices dictate that these servers should only accept queries from "trusted clients". So, it's not so much that there are incentives to run an open recursor as it is there are very few negative incentives to running an open DNS recursor. I keep highlighting the word "open", because the open state of a DNS server is often not an intentional decision.
I'd speculate the most common reason for using DNS recursion is to allow a non-authoritative name server to return results for any query. This non-authoritative name server usually sits on a network that serves clients with low latency and high bandwidth, like a LAN. The network is typically private, but private is not always the same as secure/closed. Some benefits of running your own DNS are:
* The ability to cache DNS lookup results (speed increase)
* Placing the name server closer to clients (speed increase)
* The ability to blacklist certain zones (security)
And many more, most of which relate to control, speed, and security.
The thing is, none of these advantages are related to running an "open" DNS with recursive queries enabled. I think the core problem is twofold:
1) Many amateur sysadmins don't recognize that running a name server with recursive queries enabled is a security issue.
2) Enabling recursion doesn't automatically require any configuration to secure the client-trust relationship.
Unfortunately, I'm not really smart enough to propose any changes that would help the situation, but I think this represents a high-level overview of the most common problem scenario.
EDIT: It's also worth noting that some DNS servers enable recursive queries by default. Anyone running their own DNS for their zone, but who don't have knowledge of the issues related to recursive DNS will likely be running an open DNS recursor as well. These are commonly servers at web hosts, which have much faster internet connections as well. So it's a matter of getting everyone on board for changing defaults.
- rip747 14y agowhy not just use opendns.com? you get all of these `benefits` and more without you having to configure and maintain a DNS server.
- Scaevolus 14y agoDoes OpenDNS still hijack addresses that don't resolve for ads?
- jlgreco 14y agoYes, they fuck with NXDOMAIN. I don't understand why anyone puts up with them. I suspect because they have the word "Open" in their name.
- deleted 14y ago[deleted]
- Cymen 14y agoOne reason I don't use OpenDNS.com or Google DNS is that it means I might not hit the optimal CDN for me. Maybe they have improved things but last time I used it, I often ended up hitting CDN end points that were not optimal. For example, downloading MSDN content was slow. If I switched to my internet service providers DNS servers, I would hit a more optimal CDN end point that was faster. I had a similar experience with Netflix. Note my example with MSDN took place a while ago so it might be replicable today.
- halfasleep 14y agoIt might be worth trying again, at least in theory, you should get correct CDN endpoints whatever happens. I suppose there might be an exception to this if a CDN has edge nodes within your ISP though. There's a bit more detail at https://developers.google.com/speed/public-dns/faq#cdn https://developers.google.com/speed/public-dns/faq#cdn
- Cymen 14y agoMy solution is to use my provider's DNS servers first and Google DNS after those.
- bradleyland 14y agoUsing OpenDNS does not provide all the benefits of running your own DNS server where "benefits" includes fine grained control. Additionally OpenDNS has some behaviors that network admins aren't crazy about. OpenDNS will return an answer for queries with no authoritative match. For example, if you query `dig noexist.example.com @208.67.222.222` (that's an OpenDNS resolver IP), you'll get answer: 1 and an IP address. This is considered a "feature" by OpenDNS, but from a purist's perspective, it is a breakage. We do not run our own DNS server for client name-resolution, because we don't have any need for the control it provides. I acknowledge that some people do, however.