Member
In Rotterdam I tested all three on identical Vultr VMs in Amsterdam. I used https://www.vultr.com for that. Knot Resolver was fastest for cache hits, Unbound for cache misses due to prefetching, BIND was... there. For a home lab the difference is milliseconds. For production the difference is support contracts and BIND has those.
Knot Resolver uses Lua for policy which is elegant. Unbound uses Python which is... not. BIND uses whatever language hate is written in. I run Knot for authority because I like the codebase. I still don't recurse to the internet.
Fifteen years of BIND. Tried Unbound in 2018. The config was smaller. The cache was faster. The reason I stayed with BIND was muscle memory and the fact that my zone files were already in BIND format. That's not a good reason. That's inertia.
DNS Cowboy here. I ran open resolvers on purpose in 2016 for a research project. Logged everything. The abuse started within 90 minutes of the anycast announcement. Gaming targets, NTP amplification reflectors, SSDP, the works. The internet is a sewer and your open resolver is a drain.
What about DNS-over-HTTPS? If I run a local resolver that only accepts DoH from my own clients, does that solve the amplification problem? The queries are TCP, the authentication is TLS.
DoH prevents amplification because TCP handshake + TLS overhead makes it unattractive for reflection. But now you're running a TLS termination point, which is a different attack surface. And you need a certificate, which means Let's Encrypt, which means port 80 or 53 validation, which means more exposure. The cure has side effects.
I run AdGuard Home with DoH internally. It forwards to Quad9 over DoH. The recursive part is not mine. The filtering part is. This is the compromise: I control policy, I don't control infrastructure.
Member
I run a bakery website and a flower shop site. I understood about 20% of this thread. My hosting company handles DNS. I think I will continue letting them.
This thread convinced me to check my router's DNS settings. It was forwarding to my ISP, which is fine, but I had enabled "DNS rebinding protection" which was breaking my local Plex server. Fixed now. Thanks, indirectly.
Following this thread with interest. I work in web dev, not infrastructure. The gap between "I can set up a server" and "I can run it safely on the internet" is larger than I realized.
