DNSimple DDOS Attack

Re:DNSimple DDOS Attack by whafro on Monday December 01, 2014 @04:01PM (#8683757)

We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings).

Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone.

Not perfect or permanent, but we've gotten around the outage. Also, I just learned that pointhq has (seemingly-undocumented) support for ALIAS records in the same style as DNSimple, so this could be another avenue to explore.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by EwanToo on Monday December 01, 2014 @05:15PM (#8684289)

A few people do ALIAS style records, DNSMadeEasy and EasyDNS do "ANAME" records which are pretty much the same.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by joshdotsmith on Monday December 01, 2014 @05:51PM (#8684535)

Will these services not have the same thin pipe issue that's currently affecting DNSimple?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by dentarg on Monday December 01, 2014 @06:07PM (#8684632)

Not that I have any reliable info, but what I've heard, DNS Made Easy is a pretty stable and established DNS provider.

They brag about "99.9999% uptime history" at http://www.dnsmadeeasy.com/technology/.

Though they doesn't seem as innovative and nice as DNSimple. Really hope things work out for DNSimple (really like the idea of their beta feature GitHub sync).

[ Parent | on HN ]

Re:DNSimple DDOS Attack by stevekemp on Monday December 01, 2014 @06:51PM (#8684878)

How does their beta-feature with github work? I can't find any obvious link and it seems frustratingly close to something I offer over at https://dns-api.com/ ..

(I wrap Amazon's route53 with DNS entries read from github/gitbucket/similar.)

[ Parent | on HN ]

Re:DNSimple DDOS Attack by zuccs on Monday December 01, 2014 @10:54PM (#8685621)

And link to their Git support is here: http://support.dnsimple.com/articles/github-sync/ (if only DNS wasn't down..)

[ Parent | on HN ]

Re:DNSimple DDOS Attack by stevekemp on Tuesday December 02, 2014 @03:16AM (#8686204)

Interesting thanks.

An interesting/custom choice to use JSON, and real github integration rather than using hooks as I did.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by zuccs on Monday December 01, 2014 @10:24PM (#8685528)

Can you use custom nameservers with your service?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by EwanToo on Tuesday December 02, 2014 @04:46AM (#8686385)

AWS Route 53 has added vanity DNS in the last few weeks, so you can make your DNS servers appear to be ns0.yourdomain.com rather than ns153.awsdomain.com (or whatever)

However, making your DNS servers to be responsible for serving their own DNS is a bit of an extra complexity and risk that no customer will ever care about..

[ Parent | on HN ]

Re:DNSimple DDOS Attack by zuccs on Tuesday December 02, 2014 @05:45PM (#8690551)

Nice. Got a link for this one?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by EwanToo on Wednesday December 03, 2014 @03:49AM (#8692565)

It was oddly snuck into the private DNS announcement

http://aws.amazon.com/blogs/aws/route-53-update-private-dns-...

"You can create generic "white label" name servers such as ns1.example.com and ns2.example.com, use them in your delegation set, and point them to your actual Route 53 name servers."

[ Parent | on HN ]

Re:DNSimple DDOS Attack by stevekemp on Tuesday December 02, 2014 @03:15AM (#8686199)

When you upload a new zone it will be assigned a set of nameservers - four. You can't choose what they are in advance, and you can't specify the TLDs. So you might end up with "ns-1933.awsdns-49.co.uk.", "ns-1109.awsdns-10.org.", or similar.

Does that answer the question? I'm a little hazy on what you're actually asking.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by toomuchtodo on Monday December 01, 2014 @11:24PM (#8685703)

Old DnsMadeEasy customer here (used them for several years before moving to AWS). They were rock solid. We used them for hosting DNS for major cruise lines (fancy, very fancy ones), as well as other large Fortune 500 clients.

Their interface is pretty bad, but the backend is hardy.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by EwanToo on Tuesday December 02, 2014 @04:51AM (#8686396)

It's unlikely, DNSimple appear to have relied on a single network provider and a limited number of name servers.

If I do a traceroute to the 5 DNSMadeEasy name server records (they actually run many more hosts) I go via 3 different networks - GTT, NTT, and Tata.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by mef on Monday December 01, 2014 @05:11PM (#8684254)

FYI you can use ALIAS records without a 301 redirect if the ALIAS is to an ELB.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by petercooper on Monday December 01, 2014 @04:10PM (#8683816)

How are you exporting the zone with things as they are?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by whafro on Monday December 01, 2014 @04:56PM (#8684136)

Oof, really good point – I suppose I got lucky in that I was at dnsimple.com just a few hours ago for other purposes. Their DNS was still cached for me, and it all worked flawlessly. I didn't even suspect their outage extended to their web servers, though that makes perfect sense.

FWIW, the IP I have cached is 50.31.213.210.

[ Parent | on HN ]

Re:DNSimple DDOS Attack by Pwnguinz on Monday December 01, 2014 @06:07PM (#8684633)

How were you able to find out what IP was cached for a particular domain?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by algiecas on Monday December 01, 2014 @04:21PM (#8683889)

same question here - how did you do this while dnsimple.com is inaccessible?

[ Parent | on HN ]

Re:DNSimple DDOS Attack by zuccs on Monday December 01, 2014 @10:47PM (#8685602)

You can force your hosts file locally. Set "dnsimple.com" to "50.31.213.210". On Mac use "sudo pico /etc/hosts" and follow the formatting of the other entries.

[ Parent | on HN ]