Skip to content

Comment on DNSimple DDOS Attack

Comments

We're kinda tied into DNSimple since we use an ALIAS record for our bare/naked/root domain. Amazon's Route53 supports aliases, but via a 301 redirect, which doesn't work in an SSL context (without browser warnings).

Nonetheless, we just spun up a Route53 zone, exported our zone from DNSimple, imported to Route53, and hand-migrated our ALIAS records to static A records in the new zone.

Not perfect or permanent, but we've gotten around the outage. Also, I just learned that pointhq has (seemingly-undocumented) support for ALIAS records in the same style as DNSimple, so this could be another avenue to explore.

A few people do ALIAS style records, DNSMadeEasy and EasyDNS do "ANAME" records which are pretty much the same.

Will these services not have the same thin pipe issue that's currently affecting DNSimple?

Not that I have any reliable info, but what I've heard, DNS Made Easy is a pretty stable and established DNS provider.

They brag about "99.9999% uptime history" at http://www.dnsmadeeasy.com/technology/.

Though they doesn't seem as innovative and nice as DNSimple. Really hope things work out for DNSimple (really like the idea of their beta feature GitHub sync).

How does their beta-feature with github work? I can't find any obvious link and it seems frustratingly close to something I offer over at https://dns-api.com/ ..

(I wrap Amazon's route53 with DNS entries read from github/gitbucket/similar.)

And link to their Git support is here: http://support.dnsimple.com/articles/github-sync/ (if only DNS wasn't down..)

Interesting thanks.

An interesting/custom choice to use JSON, and real github integration rather than using hooks as I did.

Can you use custom nameservers with your service?

AWS Route 53 has added vanity DNS in the last few weeks, so you can make your DNS servers appear to be ns0.yourdomain.com rather than ns153.awsdomain.com (or whatever)

However, making your DNS servers to be responsible for serving their own DNS is a bit of an extra complexity and risk that no customer will ever care about..

Nice. Got a link for this one?

It was oddly snuck into the private DNS announcement

http://aws.amazon.com/blogs/aws/route-53-update-private-dns-...

"You can create generic "white label" name servers such as ns1.example.com and ns2.example.com, use them in your delegation set, and point them to your actual Route 53 name servers."

When you upload a new zone it will be assigned a set of nameservers - four. You can't choose what they are in advance, and you can't specify the TLDs. So you might end up with "ns-1933.awsdns-49.co.uk.", "ns-1109.awsdns-10.org.", or similar.

Does that answer the question? I'm a little hazy on what you're actually asking.

Old DnsMadeEasy customer here (used them for several years before moving to AWS). They were rock solid. We used them for hosting DNS for major cruise lines (fancy, very fancy ones), as well as other large Fortune 500 clients.

Their interface is pretty bad, but the backend is hardy.

It's unlikely, DNSimple appear to have relied on a single network provider and a limited number of name servers.

If I do a traceroute to the 5 DNSMadeEasy name server records (they actually run many more hosts) I go via 3 different networks - GTT, NTT, and Tata.

FYI you can use ALIAS records without a 301 redirect if the ALIAS is to an ELB.

How are you exporting the zone with things as they are?

Oof, really good point – I suppose I got lucky in that I was at dnsimple.com just a few hours ago for other purposes. Their DNS was still cached for me, and it all worked flawlessly. I didn't even suspect their outage extended to their web servers, though that makes perfect sense.

FWIW, the IP I have cached is 50.31.213.210.

How were you able to find out what IP was cached for a particular domain?

same question here - how did you do this while dnsimple.com is inaccessible?

You can force your hosts file locally. Set "dnsimple.com" to "50.31.213.210". On Mac use "sudo pico /etc/hosts" and follow the formatting of the other entries.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.