Hacker News Reader

Comment by paulfurley | Hacker News Reader

FWIW I recently evaluated a few DNS companies after Namecheap ballsed up our MX records in a similar way.

I actively looked for someone we could pay money to, so we are their customer (as opposed to being a free tier user, effectively a cost)

The winner was DNSimple[1], who do exactly 1 thing, and they do it extremely well. And they are small enough to not take themselves too seriously[2], which I really appreciate.

Oh and their normal support channel is email, and everyone in the company takes a turn. I tested out their support before signing up and quickly heard back from a competent engineer, so they passed that test too.

[1] https://dnsimple.com [2] https://dnsimple.com/dnsound <— bonkers

View on HN

Digitalocean has free dns service with an api; it's good and reliable.

Running my own dns looks more and more reasonable though.

Perhaps, but Digital Ocean also host spammers / scammers and doesn't do anything about them when they're reported.

I don't see how this is relevant.

You listed their good points, the other poster listed some counterpoints. The one post is no less relevant than the other in a discussion about possible DNS hosting options IMO.

Though I think the post would benefit from some citations to improve its relevance/usefulness otherwise it is little better than personal opinion/conjecture.

Unless you are specifically questioning the relevance of hosting spammers, on which case: If that is true (again, some examples would be helpful here) and you intend to host your own mail servers via their services not just the MX records pointing to other mail services, you could find yourself blocked by association at some point. False positives are a big problem in this area and can be much admin to clear up.

Then you probably shouldn't be recommending DNS providers.

I use no-ip as dyndns for my home ip, so I can log in at home from outside. Recently at work my putty failed to connect, so I figured my internet line was down, it happens.

Came home, internet works fine. Everything looked just fine.

Back at work next day still can't connect. So I tried pinging, and I immediately see that the ip my home hostname resolves to is not what my ISP has. So I go to nslookup and try a DNS server I know (another local ISP), and it resolves to what I expected.

A bit of checking later I find that at work they've started using OpenDNS, and OpenDNS has blocked all of no-ip due to malware and spam.

So yeah, could be relevant.

I am sure AWS, OCI, GCP, etc. all host scam websites with varying degrees of removal efficiency. What cases are you referring to specifically? Did they state they were not going to take these sites down or what was the context that you object to?

Are you saying if you use their dns you will get spammed/scammed?

I think they're mad that DigitalOcean's IP range shows up in their ssh logs with failed authentication. A lot of people think that it's the ISP's job to regulate all traffic on their network, judging from the comments here, DigitalOcean at one time or another has failed to do that.

I host all my personal stuff there, including something that updates their DNS via an API. They've been great to me.

In this context, that sounds like an endorsement, honestly. If we're discussing providers that are willing to kill your services too easily, then saying that a provider is unwilling to cut service even to problem customers sounds like an amazing reason to use them.

NS1 could be another one to look at. I have never used their services (directly), but I've noticed Netlify uses them for their DNS services.

I've used ns1 for a few years, they've been great!

We used ns1 at my last job, they were indeed great to us. We moved from self-hosting DNS because the DNS servers would randomly become unresponsive and would start returning fake records. After switching to ns1 and getting our first bill, we realized that a lot of our network equipment apparently did a DNS lookup for every log line. This resulted in an exceedingly large bill, which ns1 happily reversed (we did fix our stuff ;).

I thought self-hosting DNS would be easy, since it is 40 year old tech now.

Even now, like you, I get the occasional (ie. once per year) named segfaults or it randomly stops responding over TCP.

Few SaaS products are less effort than one reboot per year, but still worth it IMO.

Since then I've started using CoreDNS, which does seem easier to monitor. (I don't know if it's faster or more reliable, but it has a lot of ways to figure out what's going wrong. As it turns out, DNS causes people a lot of trouble these days when they use it for service discovery, and their services discover each other hundreds of times a second. So that's why DNS servers grew APIs and observability features.)

Do you know what the reliability of their free plan is like?

I'm on their free plan and have never had an issue. They also send me warnings letting me know I'm at 50% of my free usage, which is a nice touch.

I did the same after getting tired of NC's DNS interface. I host a few client sites with Netlify[1] anyways and moving over to their DNS (NS1) has been a breath of fresh air. It is free but they do have some paid options and the is UI dead simple which should be a requirement. Feel fairly confident I can rely on them to not muck up DNS records as this is critical to mail systems, websites, etc.

Two years ago there was a moment where I was close to working for them too so I always try to use their products where I see fit. :)

[1] https://docs.netlify.com/domains-https/netlify-dns/

Thank you. Looks like I'll just have to pay more. Any recommendations for a registrar?

Dnsimple is a registrar as well. I have my personal domains there.

Hurricane Electric has a pretty solid free DNS offering. I've been using it for like 10 years.

https://dns.he.net/

I haven't needed to talk to them much, but one time I tried to add a .ninja domain, and there backend wouldn't handle it. I emailed them to report the problem at 4:49 p.m. I got an email at 7:09 p.m. the same day (2 hours 20 minutes later later) asking me to try adding it again. [1] When a free service fixes your problem in a few hours, they get +1 gold star from me.

[1] I just checked my email to look up the actual times. This was on Mar 15, 2017.

+1 for Hurricane Electric. Right now I'm giving CloudFlare's DNS a try, but HE gave me solid service (including dynamic DNS) for years.

Also, HE DNS will "secondary" from your own server.

For example, you can run your own DNS server on a VPS or something, and HE will AXFR the zones from your VPS and serve them authoritatively.

This allows you to run a hidden master, for example, which I can imagine some HN folks being interested in.

I don't know what you just said, but it sounds awesome. I bookmarked this comment to review the next time I mess with DNS :)

Doing exactly this with HE. Running Knot DNS [1] on Digital Ocean.

[1]: https://www.knot-dns.cz/

I’ve been using iwantmyname for many, many years and have been super satisfied with them.

Porkbun is the cheapest I've seen

Thanks. In light of what just happened I've decided to spend around 1.5 - 3 times as much on DNS & registration

Have you considered Route53 ?

Wrapped with git; https://dns-api.com/

Love the idea of this. I was about to switch providers then discovered that they are 3-4 times more expensive than my current provider for small-mid sized websites (currently on dnsmadeeasy.com)

Last i checked rackspace has good free dns

Reply on news.ycombinator.com