wendy
Member
OP
- Joined:
- Jun 2024
- Posts:
- 164
- From:
- Manchester, UK
This seemed straightforward. BIND9 on a Debian box, forward to roots, cache locally, save on upstream queries. I had run Windows Server DNS for internal zones before and it was fine. Three months in, my upstream notified me: my box was participating in UDP amplification attacks against gaming targets. I had missed the recursion lockdown in one config stanza. The traffic was 70 Gbps peak, all from my single €40 OVHcloud VPS. Mitigation took 48 hours: null-routed, rebuilt with allow-recursion ACLs, rate limiting, response policy zones. Then I found the real problem: even "fixed," anycast is basically mandatory for resilience, and anycast from one provider is just... single-homed with extra steps. Migrated everything to Vultr managed DNS. Not proud, but my sleep schedule recovered.
Have you tried restarting it?
GeorgeNmp
Member
AS64512
- Joined:
- May 2024
- Posts:
- 218
- From:
- Ashburn, US
Your null-route suggests your provider uses static blackholing rather than RTBH. In my experience, that indicates they lack proper BGP communities for traffic scrubbing.
A few corrections: anycast is not "single-homed with extra steps." True anycast requires:
- Multiple POPs with independent transit
- Consistent zone state across all nodes
- RPKI ROAs for each origin ASN
- IRR route objects maintained
The $2K/month figure you will hear shortly is actually reasonable for small anycast. Transit alone at three sites runs $400-600 each if you want diverse paths. Add colo, hardware or VM costs, monitoring, and suddenly managed DNS at $20/month is the rational choice.
One detail: your amplification factor was likely 50-70x for DNS. TCP-only would have prevented this entirely.
iBGP, eBGP, don't care, just peer
SamAlvi
Member
Self-Host Everything
- Joined:
- Jun 2024
- Posts:
- 188
- From:
- Portland, US
Self-hosting DNS is the gateway drug. You start with Pi-hole for blocking, then you want local zones, then you want your own recursion, then you're explaining to your ISP why you're on a blacklist.
my cloud. my rules. my 3AM alerts.
GeorgeNmp
Member
AS64512
- Joined:
- May 2024
- Posts:
- 218
- From:
- Ashburn, US
The $2K/month figure you will hear shortly is actually reasonable for small anycast.
I should clarify: that was for a three-POP anycast deployment with your own ASN and PI space. If you are using a managed anycast provider like NS1 (now IBM) or AWS Route 53, you are not running anycast. They are. You are just pointing NS records.
The distinction matters because the thread title is about running your own resolver, not about outsourcing the entire authority layer.
iBGP, eBGP, don't care, just peer
pieter_rtm
Member
- Joined:
- Jul 2024
- Posts:
- 195
- From:
- Rotterdam, NL
OVHcloud's network is actually decent for the price but their DDoS mitigation is... reactive. I've seen them null-route first and ask questions later. If you want to play with anycast from one provider, Hetzner is not better, just cheaper.
Containers before it was cool
