Following.
I ran my own recursive resolver and learned why I shouldn't
À Lyon je fais tourner un resolver Unbound pour le réseau local. Jamais ouvert sur internet. La frontière entre "résolveur interne" et "résolveur public" est celle qu'il ne faut pas franchir sans réfléchir.
Vive la résistance... électrique
wendy said:
I assume you were going to say the amplification factor was my fault
No, I was going to note that your amplification was likely DNSSEC-heavy. Signed responses are larger. An ANY query for a signed zone can hit 4KB. With your 1232 buffer that caps it, but attackers don't need max size to amplify effectively. The open recursion was the gate. The payload size just set the ceiling.
iBGP, eBGP, don't care, just peer
In Manila I pay for a Vultr VPS in Singapore because it's the closest with decent routing. $5/month. I run WireGuard, not DNS. For DNS I use whatever the DHCP gives me. The idea of running a public resolver from the Philippines on Philippine internet is comedy.
This thread is making me feel better about my $15/year Namecheap shared hosting. Their DNS "just works" and I don't have to know what an RPKI ROA is.
The real cost of self-hosted DNS is not the server. It's the pager. If you're not paying for monitoring that wakes someone up, you're not running infrastructure, you're running a hobby that might hurt people.
kasiaxus
Member
Polish sysadmin in German company here. We run split-horizon BIND internally. External DNS is Route 53. The Germans have a word for this: "Trennung." Separation. The Poles have a word too: "rozsądek." Common sense.
POLISH SERVERS. LOUD FANS. GOOD PRICE.
wendy
Member OP
GeorgeNmp said:
DNSSEC-heavy
Ah. Yes. I had DNSSEC validation enabled because "security best practice." The responses were indeed larger. I have since disabled it on my rebuilt resolver and rely on the upstream for validation. Another thing I did not think through.
Have you tried restarting it?
Same here.
What monitoring do people use for DNS? I have Prometheus + Blackbox exporter checking resolution from outside, but by the time that fires the amplification is already happening. Is there a way to detect open recursion abuse in real time?