Member OP
Hey folks
So I just moved my portfolio off my registrar's DNS and gotta say I'm super stoked. Gonna be honest tho—I thought everyone did this? Like why would you let the same company that holds your domain also run your nameservers? Seems like putting all your eggs in one basket and then handing someone a hammer
Curious what y'all think. Am I the paranoid one here or is this just standard hygiene?
Why you trust registrar with DNS? Is same company, same panel, one breach and you lose domain and resolution. Move to separate DNS provider, setup secondary, done. I do this day one for every VPS I manage. What you waiting for?
My unbound daemon sits at ~12MB resident.
Seriously tho I run my own unbound on a box with 128GB DDR5 and it's like... nothing. Couple MB. Registrar DNS is for people who don't care about query performance or geo distribution. My anycast setup hits sub-10ms globally. Humblebrag over.
Member
---
- separation of concerns:
- registrar: domain ownership only
- DNS: dedicated provider
- NOTE: this limits blast radius
- WARNING: bundled DNS often lacks:
- API access
- proper TTL controls
- DNSSEC management
---
- personal setup:
- registrar: InterServer (domain only)
- DNS: Vultr
- secondary: Hetzner
---
- migration cost: ~2 hours once
- ongoing benefit: infinite
The security argument is valid but incomplete. Registrar DNS as attack vector typically manifests via compromised registrar panel access leading to unauthorized NS record changes, not DNS infrastructure breach per se. RPKI and DNSSEC with proper DS record management at registrar level mitigates this. That said, separation does reduce correlation risk for targeted takeover. I run my own auth servers with BGP communities announcing to multiple transit providers—overkill for most, but the principle stands. IRR-maintained route objects, obviously.
What box is that unbound on? Specs?
Hetzner AX102. 128GB DDR5 ECC, Ryzen 9 7950X3D, 2x1TB NVMe in RAID-1. Running in their Falkenstein DC. Overkill? Obviously. But I got it for a project that died and now it's my "why not" box. Unbound barely tickles it. The anycast bit is three Vultr instances in Singapore, Frankfurt, and New Jersey that tunnel back over WireGuard. Not true anycast but good enough for my vanity domains.
AX102 nice. I have same in Helsinki. But for DNS? Waste. You can run unbound on 512MB ARM and get same resolution performance for personal use. Your anycast is fake anycast, just tunnel. Real anycast need ASN, BGP announcement, multiple upstream. You know this.
I benchmark DNS resolver on Rock 5B (8GB ARM): 45k queries/sec with unbound. More than enough.
That's not anycast, that's three unicast endpoints with a clever hat on. Real anycast requires your own PI space, BGP sessions with multiple transit providers, and route objects in the IRR. I've seen people call "GeoDNS with health checks" anycast too. Words mean things.
That said, for personal use? Fine. Just don't tell people you run "sub-10ms anycast globally" when you mean "three WireGuard tunnels to Germany." The latency to Singapore is not sub-10ms for a Singapore user.
Fair. The Vultr Singapore node is local, so that one actually is sub-10ms for SG users. Frankfurt and NJ are what they are. I said "globally" because I have three points of presence, not because every user hits every PoP fast. Pedantic but correct.
The AX102 is absolutely waste for DNS alone. I run other stuff on it. Mail. A few game servers. Compiling chromium while I wait for DNS queries.
