mschae

Interesting, that’s much more sophisticated than my setup (though to be fair, I host my services on a rented VPS instead of home)!

The issue only occurs with my externally-facing DNS, which is needed to, for example, to reach my Lemmy backend instance (lemmy.pootis.network) and the pictrs deployment. But yeah, internal DNS works perfectly for me and it easily survives a node failure.

Could still set up a recursive resolver for external DNS, but I guess that wouldn’t help other people who use a bad resolver. Tricky situation.

But even if I query 1.1.1.1 directly for my-website’s record, it just doesn’t work most of the time because the resolver pins itself to ns1 which is currently failing, or it selects ns1 and does not even care to try ns2.

That sounds bad. They really shouldn’t do that.

moving my DNS infra somewhere else (Cloudflare, for example)

And it would also mean this isn’t a solution either. If the problem is on the resolvers’ side, moving to a different DNS hoster would not change anything. Hm. And the other two potential solutions you’ve listed would be extremely overkill for this use case…

Personally, I only host one authoritative nameserver and do redundancy by using some free secondary DNS services (although a friend has also recently set up an authoritative nameserver, so maybe we’ll host secondary DNS for each other in the future). I haven’t encountered this issue before, but my server also hasn’t been down a lot.

There’s a lot of custom machinery that keeps my workloads running and accessible after a node failure, but all of this becomes completely moot when authoritative DNS is the bottleneck.

If it’s only necessary for your own stuff, maybe you should set up a local DNS resolver that works correctly which your services can use?

You could use mine, I guess? https://thebutton.social/?ref=9HCTGA

1. Probably wouldn’t hurt to set them up, especially if you don’t have a static prefix. The good thing is that interfaces can have multiple IPv6 addresses, so they can use both the public address and the ULA.
2. SLAAC should always be enough. Make sure you don’t block the ICMP6 messages it needs though (I’ve been bitten by that once, firewalld behaves weirdly around this).

The information returned by whois depends on the registry. For example, most registries for European TLDs basically just show whether the domain is registered (I say “most” because I’m not sure whether it’s actually all or if there are exceptions, but I know .de is like this). In that case, there aren’t even “whois privacy” services available from registrars. For TLDs from other countries or gTLDs, this might vary.

In either case, do note what the other comment says. Whois is not the only way to identify who runs a service.

it returns a lot of information such as registrar name, abuse contact, creation date… even though i paid extra for “whois privacy.”

If you didn’t pay for whois privacy, it would most likely return your actual name, email address, phone number, and home address instead. “Whois privacy” just means your registrar inserts their information into these fields instead, and forwards any mail they might get to you.