plagiat0r

No way MacOS parse tls clienthello looking for SNI.

Also I doubt a DNS resolver runs in the Mac kernel, ring 0 to pull this off.

The thing with DNS is that it works on layer 3. Hold on, what? Yes, layer 3 because you obtain network address for layer 3 (ip4, ipv6) but latency can be measured only in layer4 (tcp, quic). Of course I know that common wisdom says DNS is a layer 7 but from functional perspective, you are yet to establish your destination network address, therefore functionally it's like layer 3 to me. Or even lower, because without destination, you can't even start creating a packet and inspecting your routing table entries figuring out if you can even reach it ;)

There is zero chance Mac resolver libraries can connect you to the fastest responding server - unless there is no Berkeley sockets but something that allows you to do a connect(char * fqdn) and system library return you two pipes, one for write, other for read, and that you can close them independently. I doubt it there is such a thing, but don't know Mac os API.

It was specifically built for multi DC or multi cloud or hybrid operations that are on separate continents, with geo DNS, heathchecks and faiolver on the DNS level at the same time. When all usa servers in the WRR pool are down, or DC is down, it starts to answers the closest next set of WRR (Canada) automatically.WRR pools are dynamic and auto healing, constantly doing http heathchecks.

It is also dirt cheap, like 100x cheaper as opposed to aquire provider independent IP address space and run and operate AnyCast and having 24/7 NOC teams on this AnyCast, constantly adjusting bgp communities etc. and it is not like anycast and bgp solve anything when one server is down but other works. You can't stop announcing whole prefix if you run 200 machines but only one or two are down.

TTL I'm using is 30 seconds.

I never shared this backed with the world, you can't test it or purchase it. But maybe some day I'll launch a route53 competitor ;)

But operating system resolver only speak with DNS servers. It does not make https connections to calculate latency which would pick "the closest server". Also dns had no way to tell what port you will be using, maybe service is on 8443 or something.

For geo DNS I've built a custom backed for powerdns with geo DNS capabilities and healthckecks to quickly remove a broken vps from the DNS responses.

Negative DNS responses are possible in two forms:

1. nxdomain and a

2. NODATA response.

They both mean that a DNS record is not found but they have different scope. NODATA response rcode is NoError, not nxdomain yet the answer is still negative, like http 404. To understand the difference, read this short rfc https://datatracker.ietf.org/doc/html/rfc2308

Also, I would point to an excellent series around this subject of Linux application obtaining network address from the DNS, covers gnu libc and musl:

https://biriukov.dev/docs/resolver-dual-stack-application/0-...

The end result is very similar to even an older concept defined in RFC2317, but here instead of creating 256 cname records, one dname that causes cname to be synthetized.

As for authoritative DNS, I'm hosting my own solution based on powedns, custom backend, and route53 + Google Cloud DNS, evaluating Bunny DNS as well.

Good ones are also ClouDNS.net and digital ocean, albeit it is very basic with only a handful of RR.

There are a few registrars that can be used. I wish this list be bigger, but it's not only squarespace.

Host DNS yourself, always. But it won't help for a shitty registrars.

This is beyond comprehension how registrars are abusing their clients.

Sure, there is dns-01 and tls-alpn-01 but I presume that majority uses http-01 and migrating it is not a trivial matter.

Huge oversight from ICAAN and ARIN. I know they are behind anycast, but each server must also have an unicast address for management.

This is private backend, not open source.

It cost me four virtual machines, approximately $6/month each vm, but it is well worth it. And a bit of development time for the backend, but it runs for years, stable.

https://www.haproxy.com/blog/announcing-haproxy-2-9#reverse-...

https://datatracker.ietf.org/doc/draft-bt-httpbis-reverse-ht...

Or piko implements custom upstream registering and require a custom application code to handle this channel?

This DELEG proposal is very interesting and deserve a better coverage.

So many times those big companies nuke a customer entirely, including a dns and you're offline for few days.

And host your DNS using multiple cheap vms using multiple companies + power DNS.

If you don't want to manage this yourself, use at least two companies DNS auth services and edit their apex NS list accordingly, ignore SOA being different, and make sure you changes are applied to both DNS providers.

And keep your (A)dress/(AAAA)ddress records TTL low, max 3 hours so you can act quickly.

I've used cloudns.net and digital ocean both for one domain, both allows to edit NS in apex.

I was going to actually implement an echo server for load balancer health checks with minimal memory usage, but never considered doing it in C but I might just use it! Thank you so much.

This looks like a step back to introduce some extra policies and individual private peering...

The title is accurate because Google plans to stop announcing routes and accept them to/from the IX. Forcing members to private peer with them individually instead.

Articles are not interesting to me at large, 99.9% of the time, there is no comments sections to correct them or engage and challenge authors or other readers, seems like owners so not care about what their audience has to say. They only care about views. There is no community at the site, so they are at mercy of a search engine without spending a dime on advertising.

There is only room for a few "best top 10 Pokemon ROM hacks" articles... It was good when it last, but all comes to an end...

We have a .com domain now and double the icon count, congratulations.

It is impossible to get this dot and empty root label back to HTTP protocol, or any other like SMTP. That train departed long long time ago

Pick one that supports glue records, ipv6 glue, and dnssec, but unfortunately the icaan list does not provide this information...

The one I use for 20+ years is gkg.net. they support all of the above, and "hosts" (glue records) supports ipv4 and ipv6, but also multiple addresses per name.

Gkg IANA number is 93 so they are here for a long time.