Hello –
I have my DNS with a cloud provider that I want to stop using, and was considering where to move it (a few domains with a handful entries each). At some point I was wondering if I should run it myself. I have two VPS’ in different data centers with fixed IP addresses, and I read up a bit - seems like this is doable. I am not set on what software to use. I would like it to run in a container. Does anybody have any recommendations, positive or negative?
Thanks :)
You must log in or register to comment.
It’s doable for sure. You just need a way to sync the data between locations so that every DNS server responds with the same records, but that’s pretty much it. I do that for a (very small) business with ispconfig, but there’s plenty of options around starting from building your own. On the question if you should it’s a bit more difficult. Running a DNS server out in the wild isn’t the most complex thing to do, but it’s also a thing where you can break pretty much everything else you’re running very easily if you mess something up.
It’s a bit difficult to say if you should. From my point of view, if you really know what you’re getting into and doing you’re not asking if you should around the internet and (in general) if you ask if you should do it then (way more often than not) the answer is ‘no’. If you know how to write zone files manually (not that you really need to, it’s just a thing you can do when you have enough understanding on DNS and things related), understand how axfr and loads of other tech works, then sure, go for it. But, and I know I’m repeating myself, if you ask if you should (to me) it’s a sign that you don’t know enough.
It’s super achievable - I’ve run my own DNS for ages, there are a few common pitfalls but overall it’s pretty low maintenance.
- Personally I use PowerDNS, but you could also use something like BIND. I find PDNS to be a little easier to configure
- Make sure you are looking at the docs for PowerDNS Authoritative, not PowerDNS recursor
- You install PDNS Authoritative on bother servers, then designate one as a primary (/master) and the other as a secondary (/slave/replica). You create records on the primary, and configure it to replicate the records to the secondary using AXFR
- I’d recommend using one of the database backends for PDNS - personally I use Postgresql. Sqlite is simpler to set up, but I’ve had issues where making multiple updates over the API causes errors due to locking
- DNSSEC is a bit fiddly to set up initially, but doesn’t add much operational overhead once it’s running
- Take a looks at glue records if your want to host the domain that the nameservers themselves use
- Once you’ve got things running, consider something like https://ns-global.zone as a backup
Feel free to ping me if you have questions or need help getting things set up
Kudos for mentionning powerDNS, it’s an amazing software :)
One thing I love with powerDNS is the various backends available, notably the postgreSQL and mariaDB/mysql ones. Only the primary powerdns instance modifies the database records, the secondary instances just read from database (master or replicas). Thus, no real need for AXFR: as soon as you added/modified a record on the primary, the secondary pdns servers will see it in the database.
The
pdnsutilCLI tool is also really convenient, and the powerDNS API is a godsend when you need to automatise stuff for thousands of domains and hundred of thousands of records. There’s also a nice third-party webUI (powerdns-admin, docker image: pdnsadmin/pda-legacy). Bonus, Terraform does have a powerdns provider.At work we use dnsdist (from powerDNS too) to load-balance between our powerdns instances (with caching!), and to filter out/rate-limit/temporary ban bad actors (dns laundering, records enumeration and such for example).
I use Bind9 on an OCI compute instance for all my DNS needs. I don’t use it in a container but I’m sure there is a container of it or you could sell set one up.
Hey - lots of good points, thanks. I think I’ll give this a try on a less used domain of mine, just to get a practical feel for it. I do appreciate the arguments against, but to an extent, if both my VPS’s are down, so is basically everything served by the domain. I will have to make sure monitoring is taken care of, and I do have a completely remote email address from all of this.
knot seems to have a current docker image maintained by the project, so I’ll give that one a try and see how it goes. Stay tuned for me coming back crying and repenting in a few day’s time, I guess :)
If worst comes to worst, I can always go back to where I came from, it will have been a learning experience.
