Hacker News Reader

Comment by throwawaydns101 | Hacker News Reader

DNS has become frighteningly unreliable. Here are previous stories that show how it is possible to lose access to your domain for no fault of yours:

(1) https://news.ycombinator.com/item?id=21700139 - Sinkholed

(2) https://news.ycombinator.com/item?id=19322966 - I lost my domain and everything that goes with it

No different than this story where the author's DNS records were deleted because of so called "anomaly".

Here are so many more stories: https://news.ycombinator.com/item?id=21710939

DNS was a good idea but now there are organizations that have the power to arbitrarily take control and even remove your domain names and records. We really need to come up with a peer-to-peer solution and take back control of the naming system from these authorities.

View on HN

>DNS has become frighteningly unreliable. Here are previous stories that show how it is possible to lose access to your domain for no fault of yours:

The second story you posted is about a user who forgot to renew their domain and did not wish to pay the overly-inflated fee to re-register it while it was in the grace period.

I hold no love for any registrar that jacks up rates for getting back an expired domain and agree that they should have sent a reminder email, but describing this as someone "losing their domain through no fault of their own" is, frankly, incredibly misleading.

The user:

1) forgot to renew their domain 2) had full right to recover their domain but objected to the price 3) had full right to transfer the domain out to another registrar for the original 15EUR price and 4) eventually got back full control of the domain

I looked into self-hosting DNS and it doesn't seem like that big of a deal as long as you can ensure uptime to be honest. If you set up the two first on different hosts and possibly have #3/4 being cloud providers I think you're pretty good.

Does anyone here have experience with running their own DNS servers for their domains?

That would solve the problem of losing DNS records. What do you do when you lose access to the domain name in the first place?

Indeed. I am curious to see what comes out of attempts at decentralizing this such as Handshake[0] and ENS[1]. I think I saw something similar with prominent backers come up here on HN the other week but can't recall it now. Namecoin[2] was very early on this.

[0]: https://www.namebase.io/

[1]: https://ens.domains/

[2]: https://bit.namecoin.org/

The main problem which people seem to have is that their domain name registrar decides to pull their domain. Luckily, there is ample competition in this space, my place of employment included, which should make it reasonable to pick a place which 1. doesn’t do that and 2. has reasonable real-live-person support.

Of course, if the registry (i.e. the TLD) wants your domain gone, you are out of luck whatever you do. If this is a concern then you should pick a TLD with what you consider reasonable management. There are a lot of ccTLDs and gTLDs to choose from.

Therefore, what you absolutely shouldn’t do is to pick whatever domain registrar is either cheapest or largest, and pick whatever domain name which happens to look cool and be available. Both are recipies for potential disaster.

I've been self hosting DNS for 20+ years. It's easy as pie. I have a couple name servers on my home network (business cable) and another on a VPS.

Cool, do you have any software to recommend for a casual power user who would like something a bit more lean than BIND from a configuration perspective? pdns seems nice, and there's an official terraform provider for it as well.

I use BIND. It is actually fairly lean. I used to run it on 386 systems with 16 megs of RAM.

I've been self hosting for years. Currently using online.net secondary DNS service as my 3rd or 4th backup NS. They've lost my 10€/month box once (shitty cheap intel avoton hardware with everything soldered on I suspect) but the domain still resolved fine. I had backups and restored it in a day. You can also use a VPS image to self host DNS. Some providers offer automatic or manual snapshots. Hetzner comes to mind. They've annoyingly asked for a copy of my id card (welcome to Germany), but their services are fine.

You don't even need multiple servers (especially if both your website and mail run on the same server), it's a misconception debunked by the author of djbdns:

http://cr.yp.to/djbdns/third-party.html

That talks about whether you have servers on multiple networks. If it debunks the idea that you should have at least two servers I can't find where.

Well, maybe because DJB takes it for granted that you don't actually need two servers in the first place, so, there's not much to debunk?

    % dig ns yp.to +short
    uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.
    %

If your provider requires more than one server, just make something up, within reason, of course:

  % dig @tonic.to yp.to ns 
  …
  ;; AUTHORITY SECTION:
  yp.to.   86400 IN NS uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.ns.yp.to.
  yp.to.   86400 IN NS uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to.

  ;; ADDITIONAL SECTION:
  uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.yp.to. 86400 IN A 131.193.32.108
  uz5jmyqz3gz2bhnuzg0rr0cml9u8pntyhn2jhtqn04yt3sm5h235c1.ns.yp.to. 86400 IN A 131.193.32.109

The question is whether you're violating the standard or doing something unreasonable. Clearly DNS can't prevent you from using one server, just like it can't prevent you from using one network you own.

These are some valid arguments against third-party providers. Assuming nobody's perfect, I still see benefit in having redundancy for cases of downtime. Could just be a duplicated setup on a separate physical network (if all your DNS records point to the same network your DNS is on, I guess it's pointless with network separation, but I don't think that is very common).

Odd comment to make a throwaway for, not very controversial (unless you work for Cloudflare?)

I don't work for Cloudflare but I work for another large company that also manages domain names and DNS records. I don't want to risk the possibility that my comment could be interpreted by my employer as conflict the interest.

Probably should have made a mention to that in the first comment.

Reply on news.ycombinator.com