This. I have a BIND box at home for learning. It does not recurse to the internet. It recurses to my ISP's resolver. I have read the manual. I have time. I still would not put it in production for money.
I run authoritative only, no recursion, on a pair of Hel's own boxes in Helsinki. For recursion I use my ISP. The split is the important part. Too many people want one box to do everything because "it's just DNS."
In Turkey the regulatory environment makes running your own resolver annoying. You need to register with BTK, your logs are subject to retention laws, and the root hints sometimes don't match what the government wants you to resolve. Managed DNS is not just easier, it's legally safer.
Member OP
You cut off. I assume you were going to say the amplification factor was my fault for having EDNS0 buffer sizes too large? Because I checked, and the default Debian 12 config sets it to 1232. That was not the issue. The issue was recursion from any source.
Member
The BIND documentation is a maze. The Unbound documentation is a pamphlet. Neither prepares you for the reality of running a resolver on the actual internet. I have switched my home setup to dnsmasq forwarding to Quad9. German efficiency demands I stop wasting Saturdays on this.
In Brazil we have a saying: "custo Brasil." Everything is more expensive, harder, slower. Running DNS here means dealing with Anatel, with traffic that wants to route through Miami for no reason, with power outages. I pay Route 53 $0.50 per million queries and sleep fine.
I'm in Glasgow on a Virgin Media residential line. They block outbound 53 by default now, have for two years. You have to call and argue to get it unblocked, and they warn you that open resolvers violate AUP. The ISP is doing the security that the self-hoster forgot.
OVHcloud has a datacenter in Gravelines, not Paris. Their Paris presence is offices only. If you want French anycast you need to look at Online.net (also Scaleway) or build your own in Telehouse Paris. I have done neither because I have a life.
Member
This is why I don't self-host DNS from Brazil. My users are in São Paulo. My resolver would be in São Paulo. The roots are not. The latency to 198.41.0.4 is 140ms on a good day. I use Cloudflare, they have edge here, the latency is 2ms. Math.
Member
El hosting barato es mi droga pero el DNS propio es mi pesadilla. Aprendí con un VPS de $3 en Buenos Aires. Mi proveedor me suspendió en 6 horas. Ahora uso los resolvers de mi hosting compartido y no toco nada.
