What about DNS over HTTPS? I have it enabled in Firefox but should I be running it network-wide?
Do you run your own DNS or use provider's?
quinnbizz
Member OP
kai10 said:
What about DNS over HTTPS?
I run it network-wide via AdGuard Home on a small box. Blocks ads at the DNS level for the whole flat, DoH upstream to Quad9. The filtering is the main win, DoH is just how it gets there.
Not sure I'd bother if I didn't want the ad blocking though. Plain DNS to 9.9.9.9 is fine for most people.
...
This thread convinced me to check my TTLs. They were set to 86400 from years ago. Dropped them to 3600. Thanks.
James5010 said:
Don't overthink this.
Hard disagree for anything business-critical. DNS is the ultimate SPOF. I've seen companies lose thousands because their provider had a bad day and they couldn't failover.
That said, "self-hosted" doesn't mean "single server in your closet." Hidden primary + multiple secondaries with different providers is the actual resilient setup.
Nadia59
Member
I use whatever my hosting gives me. I don't know what any of you are talking about with hidden primaries. My server works, my website loads, my customers pay. Good enough.
markyro said:
DNS is the ultimate SPOF
Then use two providers. Cloudflare for primary, Route53 for secondary, both NS records in the delegation. Costs almost nothing, survives almost anything.
Running your own servers to achieve the same redundancy is more work for worse results.
its5 said:
Both NS records in the delegation
You can't delegate to two providers from the same domain at the registrar level. You need to use one provider's NS records and CNAME flattening or ALIAS records for failover, or use a dedicated DNS failover service.
Unless I'm misunderstanding what you're describing?
solid858 said:
You can't delegate to two providers from the same domain
Actually you can. Just list NS records from both providers in the delegation. It's not common but it's perfectly valid. The parent zone just needs to have all the NS records.
Whether either provider's control panel will let you do this without fighting you is another question.
sslman762 said:
List NS records from both providers in the delegation
The Theory the sound, the Practice the Chaos. The Provider-A the AXFR to Provider-B? No, the Sync the manual, the Error the human.
The hidden Primary the Source-of-Truth, the Secondaries the Chorus. Two Providers the Dissonance, one Master the Harmony.
Yet for the simple Soul: one Provider the Peace. I do not judge.
Did anyone mention DNSimple? I use them for client work, the API is great, but for personal stuff the per-zone pricing adds up. Switched to deSEC for personal, free and works.