How Stack Overflow plans to survive the next DNS attack

Re:How Stack Overflow plans to survive the next DNS attack by stevekemp on Tuesday January 10, 2017 @12:59PM (#13367092)

Sadly most of the bigger providers require you to code to their API - which makes migrations a little more complex - and that goes double if you get locked into using special DNS-records (rather than common types such as A/AAAA/MX/etc).

That's one of the reasons why the DNS hosting I support, which uses git-hooks to trigger updates, only currently pushes the DNS data to Amazon's route53 infrastructure.

At the time of the most recent Dyn outage I looked at allowing users to support multiple back-ends, to abstract away the pain of redundancy, but it seemed there was surprisingly little interest.

[ Parent | on HN ]

Re:How Stack Overflow plans to survive the next DNS attack by jlgaddis on Thursday January 12, 2017 @12:25AM (#13380006)

I'm glad more and more providers are offering APIs these days but the important feature for me is the ability to slave off of my own servers.

We (ISP) run our own authoritative name servers. Ideally, I'd have a single hidden ("stealth") master (maybe two, w/ anycast) and all of the public name servers would simply slave from that one. If you run PowerDNS -- which supports MySQL/PostgreSQL backends, among others -- you can keep everything in a local database and use standard tools (or write your own) to manage it.

(If I was pretty much anywhere besides an ISP, I'd definitely be using a provider with a fully-featured API. I use Route 53 now for my personal domains but I manage the zones by hand in the console since the RRs practically never change.)

[ Parent | on HN ]

Re:How Stack Overflow plans to survive the next DNS attack by stevekemp on Sunday January 15, 2017 @05:37AM (#13403403)

Thinking about this some more, if there were a product that did slave records from a hidden master and replicated to route53 - or some other big provider - would you pay for it?

It sounds like your personal domains you're happy enough as-is, and for an ISP I expect you'd not want to outsource something so critical as DNS..

[ Parent | on HN ]

Re:How Stack Overflow plans to survive the next DNS attack by stevekemp on Thursday January 12, 2017 @02:15PM (#13385189)

It would definitely be nice, I agree.

Though with a decent API it wouldn't be hard to write the glue to do it - I've certainly converted from bind to my own representation, then from that to Route53.

It's just a shame we all have to keep reinventing the wheel.

[ Parent | on HN ]