Hacker News new | ask | show | jobs
by zdw 349 days ago
This is the correct way - dynamic DNS servers frequently have very low TTLs set.

Serving DNS yourself is such an incredibly small bandwidth impact - most of the packets are in the 10's to 100's of bytes - and authoritative DNS servers do not do a lot of processing, just send back RR's from zones which are read at boot time, or updated in an in-memory database.
2 comments
edent 349 days ago
I couldn't be bothered to set up a DNS server for such an ephemeral joke.

But I would love to read your blog post about setting one up and what you learned.

link
slenk 348 days ago
mailinabox.email. Just use the DNS part and not worry about mx if you want something fairly simple
link
iwontberude 349 days ago
Coredns is so simple to configure and is a barebones container deployment.
link
edent 349 days ago
Cool! Please set it up and write a blog post about it.

I'm not being snarky. I've never set up something like that and I'm sure lots of people would be happy to ready about it.

link
hhh 349 days ago
hi, i haven’t made a video but i have some stuff set up for it:

https://youtu.be/AJ2Q12vYojY https://youtu.be/GoPWuJR6Npc

and i host https://dnsroleplay.club which lets you answer real people’s dns requests, there should be links to the github for how it’s done

link
progval 349 days ago
Unless you send any reply that is significantly largest than the request, like this one, and then you can be exploited to DDoS someone else via an amplification attack. https://www.cloudflare.com/learning/ddos/dns-amplification-d...
link
JdeBP 349 days ago
zdw mentioned an "authoritative" server, i.e. a content DNS server. CloudFlare is not talking about content DNS servers there. It cannot decide from paragraph to paragraph what it is calling the DNS servers that it is talking about, but it is talking about proxy DNS servers, that respond with the actual grunt work of query resolution done.

People like me have been recommending not running public proxy DNS servers for the entirety of the 21st century thus far, and the world has taken some notice, although more work is required, world!

* https://jdebp.uk/FGA/proxy-server-ip-addresses.html

In any case, ANY queries do not work nearly as well for amplification attacks as they used to. Many people have read RFC 8482. I, for example, changed all of the DNS servers in djbwares to respond to ANY queries per RFC 8482 back in March 2019.

The task at hand in this discussion only involves running a content DNS server, serving LOC records from some file/database or other.

link
petee 348 days ago
CF does say "dns resolvers" right in the lead
link