Hacker News new | ask | show | jobs
by knowledgesale 4439 days ago
Why would you need your own DNS?
4 comments

Most people don't need it, but there are reasons it can be convenient. And some just like to do everything in-house either as a learning exercise or for control freakery reasons.

Control of TTL values is on example. Most registrars use 4 hours these days but it used to be that 24 hours was the value used by most (with not option of anything else). That can be a minor convenience if you expect to move things around much. I have all mine set to 5 minutes (not a great idea for anything high traffic, but nothing of mine is). If you know what you are doing running a small DNS service is no great hardship at all (though it is surprising how many people don't get it right). Custom dDNS is another reason you might want this (though I think some registrars and specialist DNS hosts offer this for little or no cost these days).

In my case it costs nothing as the three bind instances I run live on geographically separate machines that I already have for other reasons (home line, external web service, backup location) - if you have no external resources already then you'd need to pay for somewhere to host a secondary server of course (cheap, reliable enough, and fast enough VPS services are common so that needn't be much cost - though a specialist DNS services needn't any more expensive these days either and will likely be more scalable than anything we setup manually).

In addition to the other replies, which are also good reasons, remember that dns poisoning is a real thing. While running unbound[1] to check DNSSEC signatures HAS discovered invalid results, and you can bypass some (but not all[2]) of those problems if you bypass the bad (ISP/whatever) resolver.

There really isn't much of a performance hit by recursively resolving DNS - it all gets cached anyway.

[1] http://unbound.net/ (other servers may also work for this purpose)

[2] It protects against a resolver that lies, but race conditions (e.g. NSA/QUANTUM) are not affected. Hopefully, DNSSEC itself protects against poisoned results, regardless of the method.

To avoid DNS censorship, my ISP filters pirate bay, plenty of other sites.
You could just use Google's 8.8.8.8 and 8.8.4.4 though.
Plenty of people don't want to send all of their DNS requests to Google.
Google's DNS resolvers are 100% truthful?
I've never heard of them changing or blocking entries. They're on Wikileaks' list of censorship-avoiding DNS servers http://www.wikileaks.org/wiki/Alternative_DNS And Google claims: Google Public DNS does not perform blocking or filtering of any kind. https://developers.google.com/speed/public-dns/docs/intro?cs...
Not what I had in mind. Ignoring the NXDOMAIN results, what makes you trust the VALUE of the NS/A/AAAA/MX/whatever records you get from Google (or any other resolver)?

Because I have frequently seen provably-wrong results from other resolvers, and some highly-suspicious results from 8.8.8.8 on occasion (though I haven't checked particularly often).

The point being, unless you're proving the results with DNSSEC (or similar), you can't trust any source.

Is that the sort of thing that could be fixed by running your own DNS resolver? I mean it all comes down to DNSSEC eventually.
Originally as a learning exercise (but that was about 15 years ago now). Now just because it is not hard, and I don't have to put up with any arbitrary "rules" from a provider.