Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I looked into self-hosting DNS and it doesn't seem like that big of a deal as long as you can ensure uptime to be honest. If you set up the two first on different hosts and possibly have #3/4 being cloud providers I think you're pretty good.

Does anyone here have experience with running their own DNS servers for their domains?



I've been self hosting DNS for 20+ years. It's easy as pie. I have a couple name servers on my home network (business cable) and another on a VPS.


Cool, do you have any software to recommend for a casual power user who would like something a bit more lean than BIND from a configuration perspective? pdns seems nice, and there's an official terraform provider for it as well.


I use BIND. It is actually fairly lean. I used to run it on 386 systems with 16 megs of RAM.


I've been self hosting for years. Currently using online.net secondary DNS service as my 3rd or 4th backup NS. They've lost my 10€/month box once (shitty cheap intel avoton hardware with everything soldered on I suspect) but the domain still resolved fine. I had backups and restored it in a day. You can also use a VPS image to self host DNS. Some providers offer automatic or manual snapshots. Hetzner comes to mind. They've annoyingly asked for a copy of my id card (welcome to Germany), but their services are fine.


You don't even need multiple servers (especially if both your website and mail run on the same server), it's a misconception debunked by the author of djbdns:

http://cr.yp.to/djbdns/third-party.html


These are some valid arguments against third-party providers. Assuming nobody's perfect, I still see benefit in having redundancy for cases of downtime. Could just be a duplicated setup on a separate physical network (if all your DNS records point to the same network your DNS is on, I guess it's pointless with network separation, but I don't think that is very common).


That talks about whether you have servers on multiple networks. If it debunks the idea that you should have at least two servers I can't find where.


Well, maybe because DJB takes it for granted that you don't actually need two servers in the first place, so, there's not much to debunk?

    % dig ns yp.to +short
    uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.
    %

If your provider requires more than one server, just make something up, within reason, of course:

  % dig @tonic.to yp.to ns 
  …
  ;; AUTHORITY SECTION:
  yp.to.   86400 IN NS uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.ns.yp.to.
  yp.to.   86400 IN NS uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.

  ;; ADDITIONAL SECTION:
  uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to. 86400 IN A 131.193.32.108
  uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.ns.yp.to. 86400 IN A 131.193.32.109


The question is whether you're violating the standard or doing something unreasonable. Clearly DNS can't prevent you from using one server, just like it can't prevent you from using one network you own.


That would solve the problem of losing DNS records. What do you do when you lose access to the domain name in the first place?


The main problem which people seem to have is that their domain name registrar decides to pull their domain. Luckily, there is ample competition in this space, my place of employment included, which should make it reasonable to pick a place which 1. doesn’t do that and 2. has reasonable real-live-person support.

Of course, if the registry (i.e. the TLD) wants your domain gone, you are out of luck whatever you do. If this is a concern then you should pick a TLD with what you consider reasonable management. There are a lot of ccTLDs and gTLDs to choose from.

Therefore, what you absolutely shouldn’t do is to pick whatever domain registrar is either cheapest or largest, and pick whatever domain name which happens to look cool and be available. Both are recipies for potential disaster.


Indeed. I am curious to see what comes out of attempts at decentralizing this such as Handshake[0] and ENS[1]. I think I saw something similar with prominent backers come up here on HN the other week but can't recall it now. Namecoin[2] was very early on this.

[0]: https://www.namebase.io/

[1]: https://ens.domains/

[2]: https://bit.namecoin.org/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: