¡the secondary the important! ¡the memory the secondary the important!
Mi contabo the singapore, mi otro the frankfurt. The knot the catalog the sync automatic. ¡the 4MB the nothing when the server the dead!
hot air, steady hand, magic smoke
Authoritative DNS on 256MB—NSD vs Knot vs 'just use Cloudflare'
pablowild
Member
sofialund said:
Mi otro the frankfurt
Same city, same problem. I run NSD on both because I only need static zones for seedbox domains. No mail, no DNSSEC, no complexity. 3.8MB each, monitored with UptimeRobot, done.
Knot's features are for people with problems I don't have.
3-2-1 applies to DNS zones too. Hidden primary at home, two secondaries, one of which is the "oh god everything else is down" backup.
I use Knot for the catalog feature. My home connection is VDSL in Auckland. Uploading a zone file via scp and rndc reload on three machines was error-prone. Now I edit one catalog, Knot does the rest.
The RAM cost is real but so is my time.
3-2-1 or you're already dead
I compile kernels on 128GB Threadrippers. 256MB is not a server, it's an embedded device with delusions of grandeur.
That said: NSD. Obviously. If you're this constrained you have no business with dynamic reconfiguration. Bake the zone, rsync, SIGHUP, done.
Barcelona is close to neither Nuremberg nor Frankfurt. Latency to Contabo DE is 35ms, to OVH Gravelines 20ms. I moved my secondary to OVH because of this.
NSD on both. 3.8MB vs 7.4MB is the difference between fitting a Unbound resolver on the same box or not. On 256MB I want recursive + authoritative without swap death.
Following this thread closely. Currently on Cloudflare free for three domains. The "learning" argument resonates—I don't understand DNSSEC chain of trust, I just clicked the orange cloud.
Is there a middle path? Cloudflare for the apex, self-hosted secondary for the learning?
jason1981 said:
Cloudflare for the apex, self-hosted secondary for the learning?
You can't do that. Cloudflare is always the hidden primary in their model. You can AXFR out to a secondary for backup, but you edit at Cloudflare.
If you want to learn, run your own hidden primary and secondary to Cloudflare. They support AXFR in as secondary—https://www.cloudflare.com. Then you control the zone, they provide the anycast.
SPF, DKIM, DMARC — holy trinity ✉️
This. I do exactly this: Knot hidden primary at home, Cloudflare secondary. Best of both worlds except when my home IP changes and I forget to update the ACL.
Dynamic DNS on the ACL. Problem solved, new problem created.
alice19 said:
Dynamic DNS on the ACL
I just use a VPN tunnel to Cloudflare. WireGuard from my home Knot to their anycast. Stable IPs, encrypted AXFR, no ACL headaches.
Downside: another moving part. Upside: I sleep through IP changes.
Has anyone compared NOTIFY propagation speed? I have NSD primary, Hetzner secondary, Cloudflare tertiary. NOTIFY to Hetzner is instant, to Cloudflare I see 30-60 second lag before the updated record appears.
Not a problem for my use case. Curious if Knot's notify timing is configurable.