Comment on Public DNS server with gui

• atzanteol@sh.itjust.works ⁨5⁩ ⁨months⁩ ago

  Personally I’m very fed up with AWS, Cloudflare and Google virtually owning the modern Internet. I selfhost to get away from their spying and oligopoly so routing DNS through them is simply out of the question, for me.

  I get that - but part of the reason for the current situation is that DNS is such a bad protocol that is risky to leave in unskilled hands. You can do damage beyond just your host. DNS is a big target and servers can find themselves participating in DDOS attacks. The big players do traffic analysis and rate limiting to minimize these things.

  And really it’s not that hard these days with pre-packaged Docker containers.

  It’s not that it’s “hard to run a name server” it’s that it’s tricky to configure one correctly so as to be a “good neighbor” on the internet. Most homegamers only need a single “A” record anyway - maybe some CNAMEs. It’s not like you need anything complicated. And if you don’t have a static IP address then you definitely want your DNS server to be updatable easily with a new IP. Updating NS records is more complicated.

  Running an internal name server is fine and a great experience. You can do so much more on your own network than you would likely do with a public name server anyway.

  source

  • ninjan@lemmy.mildgrim.com ⁨5⁩ ⁨months⁩ ago

    Only doing resolution for your own domain and dnssec solve pretty much all those issues and is pretty darn easy.

    And I did say that the web gui is what you need to lock down, DNS has no vulnerabilities exploitable through port 53 that lets an attacker take control of the server.

    source

    • atzanteol@sh.itjust.works ⁨5⁩ ⁨months⁩ ago

      You’re saying “If you configure your DNS server properly and understand how it works then it can be setup securely.”

      I’m saying “Have you seen the questions in this community???”

      source

      • ninjan@lemmy.mildgrim.com ⁨5⁩ ⁨months⁩ ago

        … Touché

        source