BastilleBSD May 27

If you run your own local DNS servers at home, do you: (select all that apply)

Comment with your preferred DNS stack and privacy friendly DNS providers.

#FreeBSD #Linux #selfHosting #DNS

Forward to ISP's DNS servers.
10%
Forward to a DNS service (1.1.1.1, 9.9.9.9, etc).
31.5%
Recursively resolve from root servers directly.
33.6%
Encrypt my DNS using DoH, DoT, etc.
24.8%
Poll ended at .
Show threadJdeBPMay 27

@BastilleBSD

So you're not interested in those who go the whole hog and run their own private root content DNS servers. (-:

http://jdebp.info/Softwares/djbwares/guide/dns-private-root.html

#DomainNameSystem #djbwares

A private root content DNS server

Show threadPatrick Mevzek
@JdeBP @BastilleBSD It is all standard and documented: https://datatracker.ietf.org/doc/html/rfc8806
RFC 8806: Running a Root Server Local to a Resolver

Some DNS recursive resolvers have longer-than-desired round-trip times to the closest DNS root server; those resolvers may have difficulty getting responses from the root servers, such as during a network attack. Some DNS recursive resolver operators want to prevent snooping by third parties of requests sent to DNS root servers. In both cases, resolvers can greatly decrease the round-trip time and prevent observation of requests by serving a copy of the full root zone on the same server, such as on a loopback address or in the resolver software. This document shows how to start and maintain such a copy of the root zone that does not cause problems for other users of the DNS, at the cost of adding some operational fragility for the operator. This document obsoletes RFC 7706.

IETF Datatracker
May 28 at 5:24pmWeb
Show threadErikJun 4
@pmevzek @JdeBP @BastilleBSD Thank you! I am running a local Bind on OpenBSD since ~20 years but was not aware of the new-ish mirror zones. Works like a charm
Show threadPatrick MevzekJun 8
@erik @JdeBP @BastilleBSD You might be interested as well by https://www.ietf.org/archive/id/draft-wkumari-dnsop-localroot-bcp-05.html which is current worked on document that ought to obsolete RFC 8806 when approved.
Populating resolvers with the root zone

DNS recursive resolver operators need to provide the best service possible for their users, which includes providing an operationally robust and privacy protecting service. Challenges to these deployment goals include difficulty of getting responses from the root servers (such as during a network attack), longer-than-desired round-trip times to the closest DNS root server, and privacy issues relating to queries sent to the DNS root servers. Resolvers can solve all of these issues by simply serving an already cached a copy of the full root zone. This document shows how resolvers can fetch, cache and maintain a copy of the root zone, how to detect if the contents becomes stale, and procedures for handling error conditions.