Self-Hosting DNS(ghostdev.xyz)
ghostdev.xyz
Self-Hosting DNS
https://ghostdev.xyz/posts/self-hosting-dns/
71 comments
DNS resolver, which it is deeply silly to not include in the title.
Agree. Title got me hoping for a description of reasonably-solved public zones self-hosting. The actual content is not interesting to me, and reads like an ad for something called AdGuard (I use unbound for most of this).
> reads like an ad for something called AdGuard (I use unbound for most of this).
Definitely not an AD - it's just the best option that I found, and have been super happy with it! There are lots of ways to do this (people have shared even more options in the comments here), and for a lot of people AdGuard/Pi-hole/... are the relatively easier options
Definitely not an AD - it's just the best option that I found, and have been super happy with it! There are lots of ways to do this (people have shared even more options in the comments here), and for a lot of people AdGuard/Pi-hole/... are the relatively easier options
same here, bait title as it is
I haven't gotten this deep into it yet, but I hope to! It's very interesting - will try to be clearer next time :D /gen
Want to throw in blocky (https://github.com/0xERR0R/blocky). Supports modern protocols and easy to configure in one file. Migrated to this from pi-hole and never looked back.
Blocky is great! The maintainers are also really easy to get along with. I had a few features I needed to get off of pihole (cnames, defining DNS via zone files) and they worked with me to plan the feature and were very kind and responsive with reviews of my pull requests :)
This looks super cool! Will try to find some to compare it to the setup I'm on now
Why forward requests to a DNS server like 1.1.1.1 at all? I used to use stuff like pi-hole/dnsmasq, but now I'm using unbound on my opnsense router which supports using blocklists and custom overrides (as well as automatic for DHCP clients). I found the default blocklists in pi-hole broke a few things but not had any problems with the lists I'm using now.
You have to forward requests that aren't in your cache, surely? I don't see how you would resolve public domain names otherwise
That would be a 'recursive resolver'[0], which recursively queries the DNS hierarchy from the top, returns the requested DNS record, and (unless you configure it not to do so) caches the results.
They're easy to set up and unless you're using it to support thousands of DNS requests per second, it's not appreciably (on human scales) slower than forwarding requests to your ISP's servers and/or 8.8.8.8 or 1.1.1.1.
More detail about recursive resolvers and how they work can be found here[1]
[0] https://notes.networklessons.com/dns-recursive-resolver
[1] https://www.akamai.com/glossary/what-is-recursive-dns
They're easy to set up and unless you're using it to support thousands of DNS requests per second, it's not appreciably (on human scales) slower than forwarding requests to your ISP's servers and/or 8.8.8.8 or 1.1.1.1.
More detail about recursive resolvers and how they work can be found here[1]
[0] https://notes.networklessons.com/dns-recursive-resolver
[1] https://www.akamai.com/glossary/what-is-recursive-dns
that's called a dns-resolver (iterator). essentially starting from the top (.) and asking for authorative nameservers that can answer the next level down until it reaches the hostname you are looking for. this usually takes multiple rtt's and is hence slower than asking some big cache.
Use the root servers to find the dns entries yourself, just like the upstream provider does
Yes but to the root servers, not to someone else's cache.
I don't really see how this scales, on a global basis.
Sure, one or two of us running our own resolvers isn't going to hurt, but an extra hundred million or so resolvers would hurt -> at best just causes all the servers targeted by the resolver to add more layers of caching
Sure, one or two of us running our own resolvers isn't going to hurt, but an extra hundred million or so resolvers would hurt -> at best just causes all the servers targeted by the resolver to add more layers of caching
Replying again as I did some research. It turns out there aren't actually only 13 root name servers, there are almost 2000. Also, the vast majority of queries to the root servers are from badly configured systems that aren't caching results properly or aren't even receiving the results. So running your own caching resolver, assuming it's working correctly, would contribute to the small drop in the ocean that is legitimate usage of the root servers. Presumably the same applies to the next levels up too.
It's a good point, I never really thought about it. In my case I'm reluctant to use my ISP servers because my country tries to practise censorship via DNS, but I also didn't really feel like using something like Google. I will do some research and experimentation with upstream caches like Quad-9 and Cloudflare to see what it's like.
DNS is highly distributed.
I doubt the current infra would have any problem handle the load even if all individual devices had a local resolver.
I doubt the current infra would have any problem handle the load even if all individual devices had a local resolver.
My journey of DNS, including self-hosting with Pi-hole and AdGuard Home, using paid services like NextDNS and AdGuard DNS, and public privacy-respecting resolvers.
I also want to selfhost variosu servers like dns, email(just to send email to myself).....ldap, dhcp etc. Where do I get started with? I know linux command line.
r/selfhosted on reddit has a very helpful community.
DNS is very easy. Email is tough. Usually one would add a media server such as Plex and Nextcloud which is very useful.
DNS is very easy. Email is tough. Usually one would add a media server such as Plex and Nextcloud which is very useful.
Aparently signing up for a subscription service now qualifies as "self-hosting" 8-)
I've been running bind9 on a computer under my desk for about 20 years.
The only subdscription required is an ISP contract that includes static IP.
Maybe I'll get a netflix acct (never had one), and "self-host" some videos...
I've been running bind9 on a computer under my desk for about 20 years.
The only subdscription required is an ISP contract that includes static IP.
Maybe I'll get a netflix acct (never had one), and "self-host" some videos...
The post was about self-hosting, not about the subscription. I do think the subscription is a good way to do it though!
> By using multiple different resolvers, operated by different companies, no single one gets the whole picture.
I’d say exact opposite. Now you’re sharing data with multiple parties and each is potentially getting enough data to extrapolate the whole picture
I’d say exact opposite. Now you’re sharing data with multiple parties and each is potentially getting enough data to extrapolate the whole picture
Does anyone know of a good authoritative DNS server that supports Dynamic DNS updates? Preferably exclusively standardized stuff. I currently run CoreDNS on my network, but dynamic registration isn't supported and might never be.
Depending on your definition of "Dynamic DNS", you could check out PowerDNS.
I mean specifically in the RFC2136 (https://datatracker.ietf.org/doc/html/rfc2136) sense.
It does look like PowerDNS supports it: https://doc.powerdns.com/authoritative/dnsupdate.html
It does look like PowerDNS supports it: https://doc.powerdns.com/authoritative/dnsupdate.html
TIL more about Dynamic DNS Update. Thanks!
>I wanted to be able to access it with a static IP, and I don’t feel like calling my ISP to get one.
Not "feeling like" calling your ISP to get a static IP, but also wanting to self-host?
Not "feeling like" calling your ISP to get a static IP, but also wanting to self-host?
I don't think calling the ISP was actually what they didn't feel like doing. It is more the call itself. Being put on queue with wait music, dealing with first line customer support who have no clue what you are asking, waiting to be connected to the right support, being connected to the wrong support, being put on hold again, suddenly being hung up on, rinse, repeat.
Which is a whole different type of mental challenge compared to figuring out the technical details of self hosting something ;)
Which is a whole different type of mental challenge compared to figuring out the technical details of self hosting something ;)
> I don't think calling the ISP was actually what they didn't feel like doing. It is more the call itself. Being put on queue with wait music, dealing with first line customer support who have no clue what you are asking, waiting to be connected to the right support, being connected to the wrong support, being put on hold again, suddenly being hung up on, rinse, repeat.
Exactly this... we have enough issues with our internet I didn't want to add this into the mix - especially as if they decide to not really give me a static IP, then I have to change it everywhere :/
I trust my VPS provider far more than my ISP
Exactly this... we have enough issues with our internet I didn't want to add this into the mix - especially as if they decide to not really give me a static IP, then I have to change it everywhere :/
I trust my VPS provider far more than my ISP
Although it is a fairly standard ask. It is something which the ISPs I know would have configurable in the web portal.
I tested with 2 ISPs I use and both have it as a prominent add on that you can add for extra cost per month in the UI.
I tested with 2 ISPs I use and both have it as a prominent add on that you can add for extra cost per month in the UI.
especially challenging for introverts
I really resent having to pay $120 a year for a static IP :-|
vps with static ip will go for half of that
Make it a tenth. I have two small VPS with two different providers, and I am paying a total of $25/year for them.
I'm a bit old fashioned. its not self hosting if you dont hold the hardware :-P
What about if you use the VPS for a wireguard tunnel, so your beefier server at home has a public IP? Does that count?
It's what I'm doing since we switched ISPs and now we are behind CGNAT (better connection otherwise though).
It's what I'm doing since we switched ISPs and now we are behind CGNAT (better connection otherwise though).
I recently switched from Pi-Hole to AdGuard Home, it was pretty straightforward to migrate my configuration and so far it's working great. I've actually got two servers running AGH + unbound (authoritative) so my internet keeps working if one setup breaks/reboots.
Fun project.
But I would just use https://pi-hole.net/
But I would just use https://pi-hole.net/
Have used both for years - AGH is the better experience imo. eg DoH works out of the box
I’d like to see a comparison
Half of the article is literally a comparison between pihole and adguard...
Really? Because what I got out from the article was a table that did a comparison then the rest of the was focused towards AdGuard. But I found a thread on r/selfhosted that was more about comparing these two.
I apologise that it wasn't as clear as it could've been! What I was trying to get at is that for my requirements Pi-hole simply can't do it all without faff (DoH being the main one).
Nooo, please do not apologize, your article was excellent and entertaining. I think it fulfilled its goal with what you were trying to convey!
this seems like a massively overcomplicated exercise.
dns-blocking is evil, no matter who does it.
stop lying to yourself and install contentblocker on your devices
dns-blocking is evil, no matter who does it.
stop lying to yourself and install contentblocker on your devices
> dns-blocking is evil, no matter who does it.
You really ought to expand on that line of reasoning in order to get anyone to take this comment seriously.
You really ought to expand on that line of reasoning in order to get anyone to take this comment seriously.
see my other comment itt
more or less about trustworthy infrastructure
more or less about trustworthy infrastructure
Assuming I am looking at the right comment, you didn't really expand/explain all that much.
If I am correct, your argument boils down to blocking happening outside the direct control of the user. This technically is true, as you don't have an icon in your browser like you would have with an extension.
At the same time, it being outside the control of the user is not really true if the user is also the person in control of the blocking solution. I don't know how it works with AdGuard, although I assume it is the same. Pi Hole offers extensive insights in what requests are being blocked, from which client and when.
This can even be adjusted on a per client level. Making that argument a more theoretical rather than a practical one.
If I am correct, your argument boils down to blocking happening outside the direct control of the user. This technically is true, as you don't have an icon in your browser like you would have with an extension.
At the same time, it being outside the control of the user is not really true if the user is also the person in control of the blocking solution. I don't know how it works with AdGuard, although I assume it is the same. Pi Hole offers extensive insights in what requests are being blocked, from which client and when.
This can even be adjusted on a per client level. Making that argument a more theoretical rather than a practical one.
it's a practical argument as soon as someone else has to use it
Sure, but that is not the context here. So I am still unsure about the "evil" aspect of it all.
Even if someone else has to use it. Certainly, when it is someone in their household who can access the administration for their client devices/applications as well.
Other people affected might be those who make use of the authors wifi. Where the author can also opt for guest wifi using regular DNS. Or not even do it on router basis and really a per-client basis.
The only context in which it is potentially "evil" or malicious is when people unknowingly get things blocked or redirected to the wrong things. But that is pretty far removed from the context of this article.
Even if someone else has to use it. Certainly, when it is someone in their household who can access the administration for their client devices/applications as well.
Other people affected might be those who make use of the authors wifi. Where the author can also opt for guest wifi using regular DNS. Or not even do it on router basis and really a per-client basis.
The only context in which it is potentially "evil" or malicious is when people unknowingly get things blocked or redirected to the wrong things. But that is pretty far removed from the context of this article.
> The only context in which it is potentially "evil" or malicious is when people unknowingly get things blocked or redirected to the wrong things.
that was kind of my point;
dns-infrastructure should not knowingly give wrong answers because that will make it less useful and more of a hassle down the road
that was kind of my point;
dns-infrastructure should not knowingly give wrong answers because that will make it less useful and more of a hassle down the road
DNS and all the overall infra should do whatever the owner of the infra want it to do.
If i as the network admin don't want you to access some site i will block it, and blocking it at DNS level is one of the ways i have to achieve this and if i catch you trying to circumvent it you will be booted from my network in no time.
That is what local DNS servers are for and what solutions like Pi-Hole and AdGuard Home were desinged to accomplish..
There are many legitimate user cases that require you to mess with DNS. example, you can force google safe search in your network to all devices, google own instructions are to create a cname redirecting www.google.com to safesearch.google.com at your local DNS server.
So no, block or redirecting stuff in my DNS not only is not evil, it is required in many cases.
If you are trying to do something that is being blocked in the local network either talk to the network admin and explain why you need to do that and check if he can fix it for you and if he cant\wont then go do it somewhere else..
Also, most, if not all, the large enterprises do dns level blocking, as they should.. Go try work around this and i bet you they will call you out, insist and you will be job hunting in no time..
If i as the network admin don't want you to access some site i will block it, and blocking it at DNS level is one of the ways i have to achieve this and if i catch you trying to circumvent it you will be booted from my network in no time.
That is what local DNS servers are for and what solutions like Pi-Hole and AdGuard Home were desinged to accomplish..
There are many legitimate user cases that require you to mess with DNS. example, you can force google safe search in your network to all devices, google own instructions are to create a cname redirecting www.google.com to safesearch.google.com at your local DNS server.
So no, block or redirecting stuff in my DNS not only is not evil, it is required in many cases.
If you are trying to do something that is being blocked in the local network either talk to the network admin and explain why you need to do that and check if he can fix it for you and if he cant\wont then go do it somewhere else..
Also, most, if not all, the large enterprises do dns level blocking, as they should.. Go try work around this and i bet you they will call you out, insist and you will be job hunting in no time..
well, there is certainly a lot to be said for efficiently checking boxes.
just wanted to point out that dns-level blocking introduces a discrepancy to a shared truth, which creates problems and is hence more costly than it might appear.
just wanted to point out that dns-level blocking introduces a discrepancy to a shared truth, which creates problems and is hence more costly than it might appear.
Don't know what shared truth you are referring too.. truth is totally relative...
I have stuff that i can only access inside my home network, so here the truth is one.. Out in the internet those same addresses do not exist, so out there the truth is another..
This is also the same for most, if not all, enterprises, there is always stuff that can only be accessed either on the internal network or via VPN..
There are address that point to different endpoints depending on the network you are connected, and this is by design, again the network wide google safe search is an example.
Same thing for streaming services and CDN's, the same address will return a different endpoint depending on your location..
This happen even for direct IP address without using DNS, Quad9 for example have dozens of servers that provide service to the address 9.9.9.9 for their DNS Server, so depending on your location the same IP address will connect you to a different server that is located closer to you to ensure fast access.
DNS like anything in the network and in computing in general can cause problem if not done correctly.. But then the problem is how it was implemented not the dns blocking or redirecting functionalities on themselves..
I have stuff that i can only access inside my home network, so here the truth is one.. Out in the internet those same addresses do not exist, so out there the truth is another..
This is also the same for most, if not all, enterprises, there is always stuff that can only be accessed either on the internal network or via VPN..
There are address that point to different endpoints depending on the network you are connected, and this is by design, again the network wide google safe search is an example.
Same thing for streaming services and CDN's, the same address will return a different endpoint depending on your location..
This happen even for direct IP address without using DNS, Quad9 for example have dozens of servers that provide service to the address 9.9.9.9 for their DNS Server, so depending on your location the same IP address will connect you to a different server that is located closer to you to ensure fast access.
DNS like anything in the network and in computing in general can cause problem if not done correctly.. But then the problem is how it was implemented not the dns blocking or redirecting functionalities on themselves..
> But then the problem is how it was implemented not the dns blocking or redirecting functionalities on themselves..
redirection and managing your horizons aside, my objection lies with the use for content blocking, because it is the wrong tool for the job.
cheers
redirection and managing your horizons aside, my objection lies with the use for content blocking, because it is the wrong tool for the job.
cheers
No, it is not the wrong tool for the job..
It is one tool that is available in our toolbox that we might use or not.. and it is one perfectly valid way of doing it.. It might not fit all workflows or all use cases but that does not make it bad or wrong..
Also, not every endpoint can have ad blocking done locally and having it at the DNS level is a great alternative for those cases..
I honestly use both, all my browsers have local ad blockers to prevent the DNS query from being done in the first place, yet i still have DNS level ad blocker to cover other devices, like TVs for example that now are filled with ads and do not have a method for blocking ads locally..
Also solutions like AdGuard do much more then just ad blocking, like i already mentioned about google safe search, you could just disable the ad blocker and it would still be a great tool to have and i personally consider a must have when you have young kids starting to use the web.
You are within your right to not like this type of solution and are free to not use it in your networks, but stop making BS claims that is the wrong tool for the job or that it is the wrong way of doing it..
What i like most about ad guard home is that almost all configurations can be customized per device.. So if you have some workflow or some device where dns blocking is causing problems you can just disable for that device and still have it for the other devices that need it..
It is one tool that is available in our toolbox that we might use or not.. and it is one perfectly valid way of doing it.. It might not fit all workflows or all use cases but that does not make it bad or wrong..
Also, not every endpoint can have ad blocking done locally and having it at the DNS level is a great alternative for those cases..
I honestly use both, all my browsers have local ad blockers to prevent the DNS query from being done in the first place, yet i still have DNS level ad blocker to cover other devices, like TVs for example that now are filled with ads and do not have a method for blocking ads locally..
Also solutions like AdGuard do much more then just ad blocking, like i already mentioned about google safe search, you could just disable the ad blocker and it would still be a great tool to have and i personally consider a must have when you have young kids starting to use the web.
You are within your right to not like this type of solution and are free to not use it in your networks, but stop making BS claims that is the wrong tool for the job or that it is the wrong way of doing it..
What i like most about ad guard home is that almost all configurations can be customized per device.. So if you have some workflow or some device where dns blocking is causing problems you can just disable for that device and still have it for the other devices that need it..
> because that will make it less useful and more of a hassle down the road
You can't just say "it is this because it is this". Clearly the sole user of DNS finds it useful to block through DNS.
What sort of hassles do you even have in mind?
You can't just say "it is this because it is this". Clearly the sole user of DNS finds it useful to block through DNS.
What sort of hassles do you even have in mind?
DNS is a kind of content. You seem to be quibbling over semantic technicalities.
not really.
it's about the blocking occurring in reach of the user (client) or not (infrastructure quirk that has to be worked around)
it's about the blocking occurring in reach of the user (client) or not (infrastructure quirk that has to be worked around)
DNS isn't "infrastructure". It's just a simple key-value store, like Redis or something.
dns more or less was infrastructure for the last 30 years. nobody cared.
the fact that for-profit shops wanted a piece of the intelligence within made it surface and now the webheads are shitting on it like there is no tomorrow
the fact that for-profit shops wanted a piece of the intelligence within made it surface and now the webheads are shitting on it like there is no tomorrow
Nah, BIND is just really shitty software, so everybody thought that DNS must be mystical and special.
Run a better DNS server and see for yourself that there isn't any man behind that curtain.
Run a better DNS server and see for yourself that there isn't any man behind that curtain.