Re:GitHub Pages with a custom root domain is slow
by aeden on Wednesday May 14, 2014 @01:32AM
(#7742354)
Anthony from DNSimple here. The ALIAS does synthesize the A record set, but it's the same A record set that is used when a username.github.io domain is resolved, which means it should work fine with Github's DDOS prevention.
The TXT record is only there for informational purposes and could be removed without affecting the system.
Since we have an Anycast network you will also get a result that would be similar to a CNAME resolution, meaning you'll typically get a "close" set of IPs that would be similar to what you would get from the resolution of a CNAME, which ultimately resolves down to A records as well.
Re:GitHub Pages with a custom root domain is slow
by X-Istence on Tuesday May 13, 2014 @01:13PM
(#7739289)
No, the result is not the same. When you look up the records for the <yourusername>.github.io you get a different set of records than the singular IP address they tell you to add if you want to use the apex domain!
So from Github's DDoS prevention's point of view, the result is different.
Re:GitHub Pages with a custom root domain is slow
by ninkendo on Tuesday May 13, 2014 @03:38PM
(#7740178)
So the answer to the issue is that the IP github tells you to use is the slow one? That sounds strange.
What's to stop users from doing their own lookup, and setting their A record to what the result is?
Re:GitHub Pages with a custom root domain is slow
by shawnz on Tuesday May 13, 2014 @04:58PM
(#7740665)
I believe the reason is that the *.github.io hosts point to a CDN rather than just having a single A record, and it is only when going through the CDN that you bypass the "neutering". Regarding your second question, it seems that github issues a warning if you do that:
DNSimple doesn't actually implement a new DNS record type, it simply puts a TXT record on your domain that says "ALIAS for some.fqdn", and presumably it causes their DNS servers to do a recursive lookup for you (to whatever's in the TXT record) when you try and look at the A record for the naked domain.
From github's DDoS prevention's point of view the result is the same: an A record lookup points to their IP. They don't know that you got there by way of looking at DNSimple's servers and their ALIAS technique.