Hacker News Reader

Comment by dessant | Hacker News Reader

A great example for why you shouldn't transfer your domain to Cloudflare Registrar if you're also using their CDN. Those who have transferred their domains cannot change DNS servers to mitigate the outage.

View on HN

You can setup your domains using their CNAME method. You do not have to delegate your entire domain to them. https://support.cloudflare.com/hc/en-us/articles/36002061511...

Together with a short TTL we were able to recover without relying on their dashboards.

Only if you are a paid customer. The free service does not allow this, and this is why I do not use Cloudflare for personal use.

Ah, used to be an Enterprise only feature. We have access to that, but didn't realise it's now available to Business. Perhaps time for them to consider offering it more widely!

For personal use you also probably don't need the high availability of switching over your domain the moment they are having problems?

One thing is not every free or pro plan on cloudflare is personal use.

I'm running the web servers, official wiki, and game external resource portal for the most active open source video game on github, through cloudflare, and maybe we might not want our 60 million requests a month website to go down when cloudflare does.

Because I can tell you right now our 300 a month budget (that mind you, is capable of covering 7 game servers that can handle 100 connected players (each)) can't take the 80 dollar hit just to make cloudflare not a single point of failure.

If you don’t count this as a personal or hobby project it’s a community project. They don’t have a pricing plan for that so you either have to go pro or go to some other provider who gives you this much for free. Why should a company give you even more pro features for free if you are already getting a lot of things for free?

Pro($20) does not give you the cname feature, business ($100) does.

he’s not arguing that they should. he’s just pointing out the need for your own plan b.

No good if your Registrar (Namecheap) is behind CF as well!

That would seem like a solid reason to avoid Namecheap.

Edit: Wait, do they use Cloudflare?

  $ dig namecheap.com +short
  198.54.117.250

whois:

  CIDR:           198.54.112.0/20
  NetName:        NAMEC-4
  Organization:   Namecheap, Inc. (NAMEC-4)
  Updated:        2015-11-13

https://whois.arin.net/rest/net/NET-198-54-112-0-1.html

I've got Cloudflare captcha just yesterday when logging in to Namecheap

They don't seem to use CF's nameservers, but try the www. subdomain:

    $ kdig +short www.namecheap.com
    www.namecheap.com.cdn.cloudflare.net.
    104.16.99.56
    104.16.100.56

Changing your NS records at the registry could help, but keep in mind most TLDs are serving NS records with 1-2 day TTLs, so you'll still see a lot of traffic going to the old server.

If this is something you want to be able to mitigate, you really need to be running a seperate DNS infra from your hosting/CDN and use short TTL cnames to delegate hostnames to the CDN. This becomes a big challenge if you host on an apex domain (eg example.org instead of www.example.org), so don't do that.

I use namecheap to manage my name servers. It's also down.

Yeah, I'm regretting that very choice now.

Problem is not just about using Cloudflare as your DNS registrar really. Even if you have a different registrar, the Cloudflare model is to have the NS (nameserver) records set up to point to Cloudflare, and then they in turn resolve the DNS. You cannot really use Cloudflare without that set up. Changes to nameservers at a registrar level are rarely quick, at least quick enough to mitigate a disaster like this. It's why we've used two completely different domains at Ably (ably.io and ably-realtime.com) for all services we provide.

We wrote about a strategy to circumvent this sort of thing a little while back https://www.ably.io/blog/routing-around-single-point-of-fail.... Given two incidents in a matter of weeks, I think a revisit of that article in light of most businesses who operate on a single domain would be useful :)

we were able to recover by submitting an API call rather than their UX, it was slow but the API requests work

I'm guessing that they're going to be back up again before those changes can "propagate", given the relatively high TTLs most TLDs run with.

Really good point. I debated about switching, and this exactly reason is why I didn't. Its one thing I didn't want to have in the same bucket.

Reply on news.ycombinator.com