Hacker News new | ask | show | jobs
by pw6hv 2031 days ago
Would you care to elaborate how one would start implementing a DNS that goes directly to the ROOT?

Honestly interested here.

6 comments

To amplify other replies:

DNS is very easy to run yourself. I use, and highly recommend, Unbound[1] as a caching resolver, and NSD[2] as an authoritative nameserver.

A caching resolver is used for ordinary lookups. If the address for "ycombinator.com" isn't in the cache, the resolver starts at the root and recursively finds the authority for the domain, gets the answer, caches it, and returns it to you. You run this for general usage, and you point your desktop/laptop computers to this address. Google runs their public resolver at "8.8.8.8", etc.

An authoritative nameserver is the ultimate authority on the lookup results for a specific domain. All lookups by other people eventually reach the authoritative nameserver for an answer. You run this for domains that you own, and configure it in your domain record.

(Both can be a bit more complicated than that, but they don't need to be)

These two services need almost zero care and feeding. Set them up once, and you can basically forget about them for years. This article only discusses resolvers, which are literally set-and-forget. Authoritative nameservers only need maintenance if you make changes to your domain. (And if you don't have your own domains, you don't need an authoritative nameserver at all).

[1] Unbound: https://www.nlnetlabs.nl/projects/unbound/about/

[2] NSD: https://www.nlnetlabs.nl/projects/nsd/about/

This is also how pi-hole likes to be run.

https://docs.pi-hole.net/guides/unbound/

For example you may use the open-source program "dnscache" from Daniel Bernstein.

I have been using this program on all my computers, during the last almost twenty years, without problems.

I'd recommend you to use Unbound and specify the named.root or (root.hints) file:

https://www.internic.net/domain/named.root

This Ansible role takes care of configuring it all (CentOS):

https://github.com/liv-io/ansible-roles-centos/tree/master/u...

I have it for FreeBSD and OpenBSD too:

https://github.com/liv-io/ansible-roles-bsd/tree/master/unbo...

I think the post is suggesting running your own local resolver instead of using a public resolver or an ISP resolver.
If you don't specify a forwarder in the bind9 configuration it should query the root DNS servers directly, iirc.
I think just running bind without a resolver is enough. Make sure you keep bind and thus the roots.hints file up-to-date.