Skip to content
Register

Authoritative DNS on 256MB—NSD vs Knot vs 'just use Cloudflare'

VPS Hosting by mediaaustin 33 replies 1.4K views
mediaaustin

Member OP

Deliverability Nerd

9 #1

For what it's worth, I needed authoritative DNS for a small mail setup. SPF/DKIM/DMARC depend on reliable resolution; if your NS is down, your mail is suspect regardless of records.

Benchmarked on 256MB Contabo VPS — https://contabo.com/en/vps/:

  • NSD 4.6.1: resident 3.8MB after 24h, 1.2MB RSS under load
  • Knot 3.3: resident 7.4MB, 2.8MB RSS — but live reconfig without restart
  • BIND 9.18: 41MB resident — excluded immediately
  • Djbdns: would need proxy for DNSSEC, not tested

4MB difference between NSD and Knot. Knot's kcatalogzone and automatic DNSSEC signing cost RAM. For static zones, NSD wins.

Hot take: self-hosting authoritative makes sense for learning, not for availability. But the "just use Cloudflare" crowd often misunderstands — Cloudflare is recursive resolver infrastructure, their authoritative free tier has limits and you become their customer for support.

I run NSD secondary to my own hidden primary. 3 years uptime. Not because it's optimal, because I understand the failure modes.

Discussion welcome. Correct my methodology if wrong.

SPF, DKIM, DMARC — holy trinity ✉️
sofialund

Member

homelab heatstroke

#2

¡the test very much scientific! The methodology the good one. But the server red, not the server cheap — the memory the only metric?

The dnssec the signing live, the knot the winner. ¡the 4MB the nothing in the server big, the everything in the server small!

hot air, steady hand, magic smoke
olespete

Member

Trust No One

#3

4mb is 1.5% of 256mb. Who benchmarks this...

airgapped, encrypted, faraday'd, still worried
TE

Member

4 #4
sofialund said:
¡the 4MB the nothing in the server big, the everything in the server small!

This. On a 256MB box you're already walking a tightrope. 4MB is one more service you can run, or one less swap thrash when Postfix gets a spike.

I run Knot on a 512MB Hetzner ARM instance — https://www.hetzner.com/cloud. The live reconfig matters more than the RAM delta because I can reload TLSA records without dropping the secondary NS notification.

pattieng

Member

6 #5
olespete said:
4mb is 1.5% of 256mb. Who benchmarks this...

People who've watched OOM killer eat their MTA at 3am because ClamAV decided to update its database. 1.5% is the margin between "works" and "pager goes off."

Mediaaustin's point about mail deliverability is the real thread here. Your NS uptime affects your MX reputation. Self-hosting auth DNS for mail is a risk calculation, not a hobby.

DmitriEng

Member

#6

I ran NSD on 128MB OpenVZ in 2019. It worked until the provider oversold the node and my "dedicated" RAM became theoretical. Moved to Knot on KVM, same specs, because I needed DNSSEC and could not afford the proxy complexity.

Cloudflare is free but you are the product. Their anycast is faster than my single Contabo VM in Nuremberg, yes. But "free" means they can rate-limit or demand business verification tomorrow.

mediaaustin

Member OP

Deliverability Nerd

#7
techklx said:
The live reconfig matters more than the RAM delta

Fair. I should have weighted operational features. My test was synthetic: single zone, no IXFR, no catalog.

For mail specifically the failure mode is "NS timeout causes sending MTA to tempfail or greylist." Cloudflare's 100% SLA on free tier is... not a contract you can enforce. But their anycast is 30ms from anywhere versus my 110ms from Nuremberg to São Paulo.

SPF, DKIM, DMARC — holy trinity ✉️
nerdbann

Member

DNS Propagator

#8

It's always DNS. Even when it's not.

mediaaustin said:
Cloudflare's 100% SLA on free tier is... not a contract you can enforce

This. I keep a hidden primary at home on a Pi, secondary to two VPS providers. Cloudflare is tertiary. The Pi has died twice, the VPS once, Cloudflare never. But I have the zone files.

Knot's catalog zones made this manageable. One catalog, three secondaries, add a zone in one place.

steveipw

Member

3 #9

ZFS ARC will eat that 4MB and not apologize. On 256MB you're running without ARC tuning or you're already swapped to death before DNS starts.

Run nsd. Or run FreeBSD with ZFS on 1GB minimum. Pick one.

zfs send | zfs receive. repeat.
IT

Member

7 #10

Belgian perspective: Contabo's EU VAT invoicing is a mess. Their Nuremberg latency to Brussels is fine, but I moved to Hetzner https://www.hetzner.com for proper VAT receipts. The 256MB tier exists but I would not run DNS I care about on anything without redundant secondaries.

NSD vs Knot is academic if your single VM dies.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft