Skip to content
Register

Hetzner's included DNS failed for 48 hours, lost my product launch

Domain Names by techmei 3 replies 180 views
techmei

Member OP

5 #1 
Dig +trace productlaunch.example.com

48 HOUR the DNS down. Two server of Hetzner "included" DNS both fail. The product launch LOST. Revenue GONE. Trust BROKEN.

Step by step migrate to dedicated DNS:

# 1. export zone file from Hetzner panel (manual, no API)
# 2. import to HostHatch DNS, verify with dig
# 3. lower TTL 300 at old provider (they ignore first request)
# 4. update registrar glue record to HostHatch NS
# 5. wait 24 hour, monitor with dnsviz
# 6. cancel Hetzner DNS service, they charge anyway XD

The lesson: included DNS is not production DNS. Separate concern always. The registrar happy to sell you broken thing, not their problem when fail.

danfra

Member

4 #2

Hetzner DNS runs single POP, no Anycast. 2.3 Tbps attack last month against their upstream, no scrubbing layer. HostHatch uses anycast + scrubbing centers, 4 Tbps capacity. Your 48 hours was likely 15 Gbps reflected UDP, filtered at edge if they had anycast. They didn't.

mitigated 800Gbps before breakfast
Doug

Member

New Jersey

#3

"trusted registrar hosting" there's your first mistake. Here we go again with the free lunch crowd. Hetzner probably runs DNS on the same box as their billing email server. Which also explains why they never answer tickets.

grabs popcorn, checks /r/drama
annexbi

Member

#4

(not to defend Hetzner (which I would never)) (but) (dedicated DNS is also someone else's infrastructure (just different someone)) (the real lesson (in my humble and constantly interrupted opinion)) is run two provider minimum (never one) (redundancy not religion) (though I preach it like one)

push. done. coffee.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft