Do not host your own DNS nameserver if you don’t know what you’re doing. It can and will be abused into all kinds of DNS attacks.

See if your registrar offers a DDNS service. Alternatively if they offer an API you can update the record yourself with a script, or use a DDNS container app, or use a DDNS plugin for OpenWRT etc.

You can also separate the nameserver service from your registrar, like you’ve been doing with Hetzner, but you don’t have to host it, there are ready-made DNS services.

One very good service which is free and has an API is deSEC.io. It’s also been around for a while and is supported out of the box in most DDNS tools, and it’s run by a German organization with a focus on privacy.

The catch with deSEC ID that they require you to enable DNSSEC, because their mission is similar to Let’s Encrypt — to promote the use of secure DNS. It’s not hard to enable DNSSEC, they generate and maintain all the records for you, naturally, but you’ll have to enable it manually at the registrar, and remember to disable it temporarily during transfers.

Another good DNS service (with API) that comes down to $1/mo and also includes CDN services is bunny.net.

Porkbun

I have a pair of DO droplets doing nothing but primary/secondary chroot-bind. I have DDNS setup so my PFSense router updates the zone with the current IP address of my home setup and I handle all the DNS tasks (spf/dkim/dmarc/blah blah blah) there. I wrote a couple of scripts to handle zone signing and all that jazz so I don’t have to log in often, if ever.

I’ll be replacing those with a modern os shortly, and probably adding recursion to them so I can use them to resolve personal DNS requests for all the machines on my domain (external and internal hosts).

Bind9 is the industry standard [citation needed] nameserver. Takes a bit of time to get used to but it’s very powerful. To make a nameserver authoritative for a domain name you would change the NS records with your domain provider, often they have an easy to change option in the web interface, and create a master zone with your desired records for that domain. NS records can only point to IPs though so if you have a dynamic home IP it will be difficult to stay reachable since TLD NS records usually have a long cache time. Some providers may also require you to provide at least 2 nameservers (for redundancy) as that’s what’s in the spec.

Agree with the two so far, but to clarify how I use them.

Cloudflare for external/public services. (Like if you run Lemmy). Use the tunnels so random people’s traffic aren’t hitting your actual IP at all, and it remains proxied through them.

Dynamic DNS if you have an ISP that will change your IP on you randomly. Personally I use namecheap, and they have an API to update when the IP changes. I use pfsense which has a dynamic dns plugin which will update my IP if it changes.

If this is for DynamicDNS, I host my DNS at cpiudflare for my domain and use a script which performs a lookup every 15 mins. It uses CF’s API to then update the record if it changes.

For DNS resolution, I use pi hole quad9 resolvers

Edit: sorry, just re-read and realised your talking about DNS hosting for a domain. honestly I use my Cloudflare or my domain provider. Given a single IP is a point of failure, it makes sense to have multiple NS on different networks/IPs. You also have to take into account Glue records and while not required, reverse DNS is also good. If you have Dynamic IPs it’s not worth it since glue records will need changing and those are manual each time

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

9 acronyms in this thread; the most compressed thread commented on today has 10 acronyms.

[Thread #280 for this sub, first seen 13th Nov 2023, 21:05] [FAQ] [Full list] [Contact] [Source code]

Either use something like Cloudflare (free DNS service) or https://freedns.afraid.org/

Are you just talking about dynamic DNS services for one or a few home servers?

There’s always DynDNS, but that’s a paid service. I actually discovered that dynamic IP address service was provided free by Google when using Google Domains as the registrar, so I moved a few of my private domains over to Google several years ago to save myself $55 a year.

Unfortunately, Google Domains is shutting down and all registrar services and existing customer domains are getting moved to squarespace and I’ve not yet been able to determine if squarespace is going to be offering the free dynamic DNS service or not.

For my dyn IP at home and selfhosted stuff I use cloudflare ddns because my router was too annoying at some point.
Well enough documented on how to set it up.

For the DNS entries on my domain:
selfhost domain: Cloudflare
E-Mail domain: IONOS.

For at home:
I tried to use OPNsense + unbound but had some issues getting the closer DNS servers from google and got further away ones.
Right now I use piHole with Google, CF and some other DNS provider.

Yes - I like bind9 with views so I can serve external and internal from same instance. As I only have services for my own use 1 ns on my dynamic ip is enough for my home subdomain.

Bind9 has ok scripting possibilities with rndc and nsupdate.

I use this https://github.com/TechnitiumSoftware/DnsServer

Works great so far. Have it running on a PI with DHCP too. Multi vlan/subnet support through single NIC. Solid.

Cloudflare for DNS, use a different domain registrar than where you point the NS. They should be split up for failback, don’t host them together.

Cloudflare is popular, as they also provide something called Tunnels.
Essentially, your domain points to their public IP, and your server connects to their server. This way, you aren’t opening ports on your home network, you aren’t leaking your home IP, and they provide various protections against DDOS and stuff.
Only issue is it’s for HTTP(s) traffic, and it’s cloudflare that terminates SSL so they could inspect your traffic if they wanted to (indeed this is how their various security systems work).

Tailscale offer something similar, I believe.
Some people run their own Reverse Proxy over VPN (RPoVPN), using a VPS as the entry/exit point.

These have the benefit of letting you essentially run a separate network from your home network, more security options with little initial configuration to do, not having to publish your home IP address.

The old school way is to use a Dynamic DNS provider, and open/forward the relevant port(s) on your router.
Most DNS providers have this ability.
You would then run a service on your server(s) that updates the DNS with your IP address incase of a dynamic IP address. Or you can rent a static IP address from your ISP.
There are many DNS providers. I use CloudNS, but it’s a bit clunky. Cloudflare provide DNS. I’m sure there are loads of others.

Ddns thru unifi with a Google API.