Hacker News Reader

Comment by dholowiski | Hacker News Reader

I thought that even if you self host - isn't it your registrar that points the dns records to your dns servers? Would someone with self-hosted DNS still be working in this situation? (doesn't the DNS query first go to network solutions, who refers it to your name servers?).

I'm not trying to argue, I genuinely need to know the answer as I'll have to explain it to many other people, later today...

View on HN

No, they just go into the zone.

You run a server for example.net. Your server will respond to any requests sent to it for records in that zone.

Someone attempting to reach your site will query the parent zone (.com) for NS records for your zone. So they will query for NS records for example.com against a server which is authoratitive for .com.

(How do they find .com server? They ask the root servers. How do they find the root servers? That's the bootstrap info.)

I self-host for most things. I live on the edge and don't have backup DNS. For most situations, you'd want backup DNS as well.

ns1.kimsal.com ns2.kimsal.com nsA.offsite1.net nsB.offsite1.net

etc. the kimsal ones are my primary/secondary, but having the others offsite, slaving from the primary, would mean that even if my primaries went down, the info would be at the 'offsite' ones. Those 'offsite' DNS servers would need to be registered with the registrar as well, and become part of your record (you can check that with a whois).

One aspect of Network Solutions business is managing some of the root zones. Those are the servers that ultimately tell the internet what other servers to go look at to resolve queries. These are the "root" nameservers. So while Network Solutions is in charge of the root zones themselves, and does run a bunch of root nameservers, there are other root nameservers run by Various organizations and collectively they can handle a massive amount of work. That is not what is being attacked. If somone DID successfully DDOS a large enough portion of the root nameserver infrastructure, the internet would largely grind to a halt. It is designed suitably sized, and run by large enough players that this is not likely.

The DNS service that is being attacked is the one they offer end users, usually along with domain registration. There is no particular reason you need to use their services when registering a domain with them, although, like most rigistrars, their website will make this deliberately confusing, and may require you to use their DNS service if you also want to use some of their other value-added services along with your registration (like email forwarding, websites, stuff like that).

Unless you are using other services from NetSol that require you to use their DNS, you are free to use whatever DNS infrastructure you like, including your own.

(If DDOS is a business concern, I'd go with someone big who deliberately does just DNS.. Neustar or one of those)

No, this is for domains where .worldnic.com is the authorative server. If you registered your name through NetSol but hosted the DNS servers elsewhere then you would just be relying on the respective TLD servers (e.g. .gtld-servers.net for .com domains) to refer resolvers to the correct authorative servers.

Reply on news.ycombinator.com