Skip to content
Register

Mini-guide: $15/year box as primary nameserver—don't, but here's how

VPS Hosting by tomchan 19 replies 2.2K views
tomchan

Member OP

#1

Fun little project that I absolutely do not recommend for anything you care about.

You will need:

  • A €4/month cloud VPS (I used Hetzner's smallest CX11)
  • Nsd or knot (not BIND, memory too fat)
  • A secondary somewhere else you actually trust

# /etc/nsd/nsd.conf snippet
server:
    ip-address: 0.0.0.0
    port: 53530  # because NAT port forward

zone:
    name: "tomslab.example.com"
    zonefile: "/var/lib/nsd/tomslab.example.com"

It actually works. NSD in 128MB with a small zone. I have been running this for 8 months.

Do not do this for:

  • Anything with customers
  • Anything where "my DNS was down" is a bad answer
  • Your resume

The secondary is not optional. I shouldn't need to say this.

works on my bench ¯\_(ツ)_/¯
wilmaethqn44

Member

2 #2

If the secundary is not optional... why the guide without it? I have a small site for my bakery and I dont want to break things

frames, tables, still valid HTML
Berlin1

Member

#3

Someoneelses responsibility is not your businessmodel[1]

The secondary is obvious to anyone with operational Sense yet here we are with a guide that omits it for brevity and now wilma is considering this for actual Bread sales

Footnotes:
[1] see also: every "it worked in my homelab" thread becoming production advice

tomchan

Member OP

5 #4

To be fair I did say "don't" in the title and three times in the post. The secondary is Cloudflare for me, but any registrar with slave DNS works.

works on my bench ¯\_(ツ)_/¯
wilmaethqn44

Member

#5

So I need two things? The cheap one and another one? My registrar is 123 Reg, I dont know if they do that

frames, tables, still valid HTML
Berlin1

Member

#6

123 Reg does not do secondary DNS. You would need to change registrar or use a third party. This is why the guide is dangerous, wilma. You are three steps deep and still missing pieces.

LU

Member

#7

I run secondary on a 2 EUR Hetzner box in Helsinki. Same config, different DC. Not hard but you do need two.

larryjeong

Member

#8

Same. I got three Hetzner CX11s now, Falkenstein, Helsinki, Hillsboro. 12 EUR/year each on the old pricing. Knot on all of them, hidden primary setup. Overkill for my junk domains but I like the symmetry.

$3/year. 128MB RAM. Pure happiness.
PU

Member

#9

Hetzner Helsinki is solid. I am there. Latency to Europe fine, latency to Asia worse obviously. For DNS it does not matter much.

danfra

Member

#10

For DNS it matters when the packet is 2 Tbps of garbage aimed at your single IP. Hetzner will nullroute you before your NSD process notices. I have seen this. Anycast or at least provider-level DDoS protection is not optional for anything public-facing, which is why I tell people to just use their registrar or Cloudflare or Route53.

mitigated 800Gbps before breakfast

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft