DDOS on Namecheap Free DNS and Default DNS V2
status.namecheap.com
status.namecheap.com
This has been a feature requested for, as far as I can tell from the support forums, four years now. It should be possible to make this allowed/disallowed per-zone, and as far as I'm concerned, I don't care who is able to download my tiny zone file. It would allow me to add more diversified DNS servers in the face of things like a DoS against Namecheap.
Good luck.
tamar (also at Namecheap)
I just suggested something, if money important for me, I didn't move all of my domains from namecheap to another provider :)
While offering some gift or compensation for ANY negative incident -- especially one outside anyone's control -- is nice, that's not something everyone can afford under ANY circumstance.
Their "update DNS server" page was acting a bit wonky, kept saying some of my nameservers were invalid when they weren't, but I eventually got them all switched.
This isn't a dig against Namecheap, it sounds like this attack is pretty bad, but for important domains Route53 just seems like a much better setup (geographically dispersed, different nameservers for each hosted zone, etc).
a) you had a pool of DNS server names, say 20, all with unrelated hostnames
b) you assigned 2 to each customer, randomly, when they configured a domain to use your servers.
Then, a DDOS attack would impact 10% of your customers instead of 100%. (Assuming other practices, like null routing the target until resolved)
.com was < 1 minute, .cm is > 55 minutes.
Many of us already switched to other DNS servers during the panic, and we'd like to know whether you'd suggest we reverse that change in order to jump to v1 instead for a quicker result. Thank you.
Instead, the second that this DDos hits is the second we have websites stopping working.
How is it that in this day and age we can't have distributed caches of DNS entries at our providers of full dns databases. I mean there can't be more than like a few billion dns entries in the world total, which fits easily in a modern desktop computers RAM.
If that is an underestimate, I can't believe a single modern server wouldn't be able to mirror the world's DNS queries for at least a providers worth of users.
I sort of hoped that a DNS client would just use an expired DNS result in case the servers would not respond, but perhaps that is naieve/dumb.
This would break the whole concept of TTLs.
> but perhaps that is naieve/dumb.
Not at all. Hard problems are hard to solve.
I assume you'd make sure the DNS records are the same in both DNS portals; and then add Route53 as 3rd & 4th nameservers with the first and second still being Namecheap?
My domain is on v1 now and its still working.
If you want speed and readability I suggest switching to a paid DNS provider.
1: http://www.solvedns.com/dns-comparison/2014/01
BTW I'm not in any way affiliated, just like the service.
I am monitoring a few servers with DNS records. And the last week I have found all the servers unresponsive (by DNS, not tried directly) from time to time. And after an extensive amount of troubleshooting I am unable to find a problem.
$0.500 per million queries – first 1 Billion queries / month
$0.250 per million queries – over 1 Billion queries / month
I'll probably continue with that setup, but just make sure my TTL is set fairly high.
If Namecheap is down, it does not get redirected.
An over simplified example for looking up "news.ycombinator.com":
1. First query the TLD nameserver for all ".com" domains asking for the authoritative nameserver(s) for "ycombinator.com".
2. Next query that nameserver for "news.ycombinator.com".
That said, I've heard Cloudflare's DNS network is faster than many paid alternatives.