Hacker News new | past | comments | ask | show | jobs | submit login

> However, many developers rely and depend on root DNS resolution to "Just Work" when you add it to a server

As a sysops you're probably aware that neither Google nor CloudFlare are DNS root servers.

Using actual root servers through your own resolver would have avoided this issue. Bind doesn't even need any config for that use case.






Adding to this data-center servers should at very least use a proper set of caching DNS servers at the edge of their network and those should talk to the root servers as to not add to the global abuse of the anycast clusters. I've seen some companies go as far as to run Unbound on each and every server to improve the retry and caching mechanisms to great success. Unbound can also raise the min TTL as some applications get quite abusive if they use really low TTL's and the applications are making requests for every action. i.e. raising every TTL up to at least 30 seconds if they were lower. The excessive retries can compound really fast especially when applications and systems are not properly configured which is often the case. If people are not sure what I mean, run a UDP capture at the edge of your network and one may find that for each request an application makes there could be as many as 12 DNS requests. It adds up very fast.

    App1 Unbound -> Data-center edge Unbound instances [1-4] -> Root DNS  Anycast clusters
Unbound can be configured to either pick the fastest resolvers or to cycle through all of them and retry in the background when one fails to re-select it when it starts resolving again. This avoids a lot of outages otherwise known as "It's always DNS".

But when setting up a full recursive resolver, you should avoid using root servers directly for queries, but rather mirror the root zone locally:

https://datatracker.ietf.org/doc/html/rfc8806


Of course, it depends on the use-case, what I meant was "upstream DNS". I've edited.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: