5 ms·

Why would you need your own DNS?

dspillett 12y ago
Most people don't need it, but there are reasons it can be convenient. And some just like to do everything in-house either as a learning exercise or for control freakery reasons. Control of TTL values is on example. Most registrars use 4 hours these days but it used to be that 24 hours was the value used by most (with not option of anything else). That can be a minor convenience if you expect to move things around much. I have all mine set to 5 minutes (not a great idea for anything high traffic, but nothing of mine is). If you know what you are doing running a small DNS service is no great hardship at all (though it is surprising how many people don't get it right). Custom dDNS is another reason you might want this (though I think some registrars and specialist DNS hosts offer this for little or no cost these days). In my case it costs nothing as the three bind instances I run live on geographically separate machines that I already have for other reasons (home line, external web service, backup location) - if you have no external resources already then you'd need to pay for somewhere to host a secondary server of course (cheap, reliable enough, and fast enough VPS services are common so that needn't be much cost - though a specialist DNS services needn't any more expensive these days either and will likely be more scalable than anything we setup manually).
dobbsbob 12y ago
To avoid DNS censorship, my ISP filters pirate bay, plenty of other sites.
- sp332 12y ago
  You could just use Google's 8.8.8.8 and 8.8.4.4 though.
  - dublinben 12y ago
    Plenty of people don't want to send all of their DNS requests to Google.
  - pdkl95 12y ago
    Google's DNS resolvers are 100% truthful?
    - sp332 12y ago
      I've never heard of them changing or blocking entries. They're on Wikileaks' list of censorship-avoiding DNS servers http://www.wikileaks.org/wiki/Alternative_DNS http://www.wikileaks.org/wiki/Alternative_DNS And Google claims: Google Public DNS does not perform blocking or filtering of any kind. https://developers.google.com/speed/public-dns/docs/intro?csw=1 https://developers.google.com/speed/public-dns/docs/intro?cs...
      - pdkl95 12y ago
        Not what I had in mind. Ignoring the NXDOMAIN results, what makes you trust the VALUE of the NS/A/AAAA/MX/whatever records you get from Google (or any other resolver)? Because I have frequently seen provably-wrong results from other resolvers, and some highly-suspicious results from 8.8.8.8 on occasion (though I haven't checked particularly often). The point being, unless you're proving the results with DNSSEC (or similar), you can't trust any source.
        sp332 12y ago
        Is that the sort of thing that could be fixed by running your own DNS resolver? I mean it all comes down to DNSSEC eventually.
        pdkl95 12y ago
        You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course. I use and recommend doing both, as there's very little downside to running your own resolver.
pdkl95 12y ago
In addition to the other replies, which are also good reasons, remember that dns poisoning is a real thing. While running unbound[1] to check DNSSEC signatures HAS discovered invalid results, and you can bypass some (but not all[2]) of those problems if you bypass the bad (ISP/whatever) resolver. There really isn't much of a performance hit by recursively resolving DNS - it all gets cached anyway. [1] http://unbound.net/ http://unbound.net/ (other servers may also work for this purpose) [2] It protects against a resolver that lies, but race conditions (e.g. NSA/QUANTUM) are not affected. Hopefully, DNSSEC itself protects against poisoned results, regardless of the method.
pwg 12y ago
Originally as a learning exercise (but that was about 15 years ago now). Now just because it is not hard, and I don't have to put up with any arbitrary "rules" from a provider.

Most people don't need it, but there are reasons it can be convenient. And some just like to do everything in-house either as a learning exercise or for control freakery reasons. Control of TTL values is on example. Most registrars use 4 hours these days but it used to be that 24 hours was the value used by most (with not option of anything else). That can be a minor convenience if you expect to move things around much. I have all mine set to 5 minutes (not a great idea for anything high traffic, but nothing of mine is). If you know what you are doing running a small DNS service is no great hardship at all (though it is surprising how many people don't get it right). Custom dDNS is another reason you might want this (though I think some registrars and specialist DNS hosts offer this for little or no cost these days). In my case it costs nothing as the three bind instances I run live on geographically separate machines that I already have for other reasons (home line, external web service, backup location) - if you have no external resources already then you'd need to pay for somewhere to host a secondary server of course (cheap, reliable enough, and fast enough VPS services are common so that needn't be much cost - though a specialist DNS services needn't any more expensive these days either and will likely be more scalable than anything we setup manually).

dobbsbob 12y ago

To avoid DNS censorship, my ISP filters pirate bay, plenty of other sites.

sp332 12y ago
You could just use Google's 8.8.8.8 and 8.8.4.4 though.
- dublinben 12y ago
  Plenty of people don't want to send all of their DNS requests to Google.
- pdkl95 12y ago
  Google's DNS resolvers are 100% truthful?
  - sp332 12y ago
    I've never heard of them changing or blocking entries. They're on Wikileaks' list of censorship-avoiding DNS servers http://www.wikileaks.org/wiki/Alternative_DNS http://www.wikileaks.org/wiki/Alternative_DNS And Google claims: Google Public DNS does not perform blocking or filtering of any kind. https://developers.google.com/speed/public-dns/docs/intro?csw=1 https://developers.google.com/speed/public-dns/docs/intro?cs...
    - pdkl95 12y ago
      Not what I had in mind. Ignoring the NXDOMAIN results, what makes you trust the VALUE of the NS/A/AAAA/MX/whatever records you get from Google (or any other resolver)? Because I have frequently seen provably-wrong results from other resolvers, and some highly-suspicious results from 8.8.8.8 on occasion (though I haven't checked particularly often). The point being, unless you're proving the results with DNSSEC (or similar), you can't trust any source.
      - sp332 12y ago
        Is that the sort of thing that could be fixed by running your own DNS resolver? I mean it all comes down to DNSSEC eventually.
        pdkl95 12y ago
        You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course. I use and recommend doing both, as there's very little downside to running your own resolver.

pdkl95 12y ago

In addition to the other replies, which are also good reasons, remember that dns poisoning is a real thing. While running unbound[1] to check DNSSEC signatures HAS discovered invalid results, and you can bypass some (but not all[2]) of those problems if you bypass the bad (ISP/whatever) resolver. There really isn't much of a performance hit by recursively resolving DNS - it all gets cached anyway. [1] http://unbound.net/ http://unbound.net/ (other servers may also work for this purpose) [2] It protects against a resolver that lies, but race conditions (e.g. NSA/QUANTUM) are not affected. Hopefully, DNSSEC itself protects against poisoned results, regardless of the method.

pwg 12y ago

Originally as a learning exercise (but that was about 15 years ago now). Now just because it is not hard, and I don't have to put up with any arbitrary "rules" from a provider.