Skip to content
Register

Do you trust your registrar with DNS, or separate immediately?

Domain Names by marcus_qc 25 replies 2.8K views
YuriDavid

Member

#11
GeorgeNmp said:
Words mean things.

This. "Anycast" gets abused constantly. I saw a provider last month sell "anycast DNS" that was just two VMs with same IP in different regions using... GRE tunnel to central resolver. Not even independent caches.

My actual setup: Vultr for primary, Hetzner secondary, both with independent zone data. No tunneling. If one dies, the other answers from its own memory. Not anycast either, just redundancy with different failure domains.

indentation is not optional
bellaauc

Member

3-2-1 Believer

3 #12

Following this thread because I just realized my registrar has my DNS and I don't even know what secondary means. I back up my client sites obsessively but never thought about DNS as something that needs backup.

Is there a "DNS for people who just want websites to stay up" guide somewhere? I have maybe 40 domains for small business clients in Auckland. Most on shared hosting with the registrar's nameservers.

3-2-1 or you're already dead
marcus_qc

Member OP

#13
bellaauc said:
40 domains for small business clients

Oof. That's exactly the scenario that made me post. One registrar compromise, one panel breach, and you're not just down—you're potentially losing domains that aren't even yours. Your clients don't know what DNS is, they just know their bakery site is redirecting to a gambling site in Cyrillic.

For 40 domains I'd look at Cloudflare free tier. Import all zones, point registrar NS records there, done. Secondary with someone else if you're paranoid. Two hour job, sleep better forever.

42U and still growing
danfra

Member

#14
bellaauc said:
Is there a "DNS for people who just want websites to stay up" guide

Not a guide, but a rule: if you can't change your TTL below 300 seconds, you're not in control. Registrar DNS often hardcodes 3600 or higher. During an attack or compromise, you want to pivot fast. I've seen DDoS mitigation fail because the NS was still caching old A records for an hour.

For 40 domains: Cloudflare or Vultr. API-driven, low TTL, anycast that is actually anycast. I run DNS for a fintech out of Frankfurt, we fail over between Vultr and AWS Route53 based on health checks. Sub-minute propagation.

mitigated 800Gbps before breakfast
wilmaethqn44

Member

#15

I have two domains, one for my bakery and one for flowers. Both with the company I bought them from. I don't know what TTL or API means. Is my website going to disappear? Should I pay someone to move it?

frames, tables, still valid HTML
YuriDavid

Member

#16
wilmaethqn44 said:
Is my website going to disappear?

Probably not. You're not a target. The risk models here are for people with 40 client domains or infrastructure worth attacking. Your registrar's DNS is fine for a bakery.

That said, if you ever want to change web hosts, having separate DNS makes it easier. Not urgent. Bake bread.

indentation is not optional
JA

Member

#17

I moved 200+ domains off registrar DNS last year. Took a weekend. Used Vultr API and a Python script. Biggest pain was finding all the places I'd hardcoded registrar nameservers in client documentation.

Now running Vultr primary, Hetzner secondary. Cost went from "free" to maybe 8 EUR/month total. Worth it for the API alone—I can update records from CI/CD instead of logging into a panel like a caveman.

Tallinn is close to Helsinki DC, latency to Hetzner is 15ms. Nice.

LO

Member

1 #18

Hetzner secondary with Vultr primary? But Hetzner DNS is free tier only, no API for secondary zones last I checked. You doing AXFR from Vultr to Hetzner or maintaining two independent zones?

I'm in Budapest, using Hetzner primary for my stuff because EUR pricing and local Nuremberg DC is 20ms. Vultr would be more expensive for same traffic.

JA

Member

#19
lolrock said:
Hetzner DNS is free tier only, no API for secondary zones

Correct, no API for secondary. I'm doing AXFR from Vultr to Hetzner using their secondary DNS service. Vultr is hidden master, Hetzner pulls zone transfers. Not perfect—no signing with DNSSEC on secondary last I checked—but functional.

Independent zones would be madness at 200+ domains.

ronwit

Member

Budget King

#20

I run DNS for my Minecraft server on the same $3 Vultr instance in Osaka that runs the server. Unbound + NSD. 1GB RAM total for everything. If it dies, my 12 players complain on Discord and I restart it.

This thread is like watching people argue about whether to buy a Ferrari or a Lambo when I take the bus. Respect tho.

instant noodles, instant deploys

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft