Roll Your Own CDN (opens in new tab)

(reinterpretcast.com)

46 pointsjoesavage11y ago24 comments

24 comments

Please do not run your own DNS server if you do not have the knowledge or expertise to properly secure it. It is extremely irresponsible, and the article is also irresponsible for suggesting it and not having any information about rate limiting.

kev00911y ago

Use nsd. If you just run an authoritative only service, it is easy to do correctly.

joesavageOP11y ago

For the record, the setup shown with PowerDNS is authoritative-only too.

kchoudhu11y ago

I run a recursing DNS server behind a firewall for my home servers -- is this risky?

mcpherrinm11y ago

If nobody can query the server from behind the firewall, you're fine. Nearly every home router runs a copy of dnsmasq as a recursive resolver for the users on the local network.

driverdan11y ago

Plus your DNS servers (you are running more than one right?) are never going to be as fast as Route 53 and the ilk. Spend the $5/m and use a real DNS host.

mey11y ago

Do you have any suggestions/articles on where people can learn how to run a DNS safely?

Blackthorn11y ago

Unfortunately, I do not. Even though I personally learned on one of the big boys, I'd still pay somebody else to do this who has it as their dedicated job (like Amazon or Google). It's just not worth the headache and constant monitoring.

At minimum you need conservative rate limiting and monitoring that will page you when you start sending out gobs of traffic.

kuon11y ago

I'd like to point out that google DNS among others uses anycast and are in reality composed of multiple servers geographically distributed, even if there is a single IP.

nly11y ago

The IP you query as a client is anycast, but I'd wager recursive queries out of their caches come from geo-friendly IPs.

joesavageOP11y ago

Right you are. Just updated the article to be more accurate on this matter.

pushrax11y ago

If you want to cut down on DNS-induced latency, Route 53 is a fairly good option. Their latency-routed DNS doesn't perfectly map to all geographical zones, but it works fairly well for DigitalOcean's locations.

I wish it was easier/cheaper to run your own anycast network...

rdl11y ago

I wonder if "run your own anycast network as a service" would ever make sense as a product. I can't see anyone other than CDN or testing being terribly interested, and a lot of this is included in the raw CDN use case.

samcrawford11y ago

There is at least one already out there - http://www.hostvirtual.com/anycast-bgp-cloud/. You have to bring your own IP space (/24 minimum of course). I vaguely remember reading the charges were in the low thousands of dollars per month, but that was a while ago.

opendais11y ago

https://rage4.com/Home/ANY

Is that what you are looking for? They only have 3 locations tho.

1 more reply

opendais11y ago

Route 53 now does GeoDNS so you can map it more accurately, for a few cents more.

http://aws.amazon.com/route53/pricing/

pushrax11y ago

Awesome, didn't realize that! Will definitely be using it.

1 more reply

dgl11y ago

The Powerdns geo backend as mentioned by the article is used by wikipedia among others.

I have some additions (e.g. Google Public DNS), see the files at https://gist.github.com/dgl/8344c3ebe405a1400e2d (which also has the rsync location for the original).

[edit: now I read the article again I notice the author is assuming 'eu' is going to get all of EU, it won't. There need to be entries for each country.]

le11y ago

This is a neat article, but 'CDN' is such a broad term. This is much more a very well done proof of concept article, but fails to take into account the huge scope of a large scale CDN, and all associated quirks it comes with.

ambrop711y ago

It must be so hard to expand the abbreviation once.

rdl11y ago

I think more people know "CDN" than the expansion (Content Distribution/Delivery Network).

Same is probably true for ATM (financial or 53-byte cell), POP, DNS, RFP, RFC, IMAP, SSL, ...

j / k navigate · click thread line to collapse

24 comments

Blackthorn11y ago

kev00911y ago

Use nsd. If you just run an authoritative only service, it is easy to do correctly.

joesavageOP11y ago

For the record, the setup shown with PowerDNS is authoritative-only too.

kchoudhu11y ago

I run a recursing DNS server behind a firewall for my home servers -- is this risky?

mcpherrinm11y ago

If nobody can query the server from behind the firewall, you're fine. Nearly every home router runs a copy of dnsmasq as a recursive resolver for the users on the local network.

driverdan11y ago

Plus your DNS servers (you are running more than one right?) are never going to be as fast as Route 53 and the ilk. Spend the $5/m and use a real DNS host.

mey11y ago

Do you have any suggestions/articles on where people can learn how to run a DNS safely?

Blackthorn11y ago

At minimum you need conservative rate limiting and monitoring that will page you when you start sending out gobs of traffic.

kuon11y ago

I'd like to point out that google DNS among others uses anycast and are in reality composed of multiple servers geographically distributed, even if there is a single IP.

nly11y ago

The IP you query as a client is anycast, but I'd wager recursive queries out of their caches come from geo-friendly IPs.

joesavageOP11y ago

Right you are. Just updated the article to be more accurate on this matter.

pushrax11y ago

I wish it was easier/cheaper to run your own anycast network...

rdl11y ago

samcrawford11y ago

opendais11y ago

https://rage4.com/Home/ANY

Is that what you are looking for? They only have 3 locations tho.

1 more reply

opendais11y ago

Route 53 now does GeoDNS so you can map it more accurately, for a few cents more.

http://aws.amazon.com/route53/pricing/

pushrax11y ago

Awesome, didn't realize that! Will definitely be using it.

1 more reply

dgl11y ago

The Powerdns geo backend as mentioned by the article is used by wikipedia among others.

I have some additions (e.g. Google Public DNS), see the files at https://gist.github.com/dgl/8344c3ebe405a1400e2d (which also has the rsync location for the original).

[edit: now I read the article again I notice the author is assuming 'eu' is going to get all of EU, it won't. There need to be entries for each country.]

le11y ago

ambrop711y ago

It must be so hard to expand the abbreviation once.

rdl11y ago

I think more people know "CDN" than the expansion (Content Distribution/Delivery Network).

Same is probably true for ATM (financial or 53-byte cell), POP, DNS, RFP, RFC, IMAP, SSL, ...

j / k navigate · click thread line to collapse