Roll Your Own CDN

46 points by joesavage 11 years ago | 24 comments

Blackthorn 11 years ago |

Please do not run your own DNS server if you do not have the knowledge or expertise to properly secure it. It is extremely irresponsible, and the article is also irresponsible for suggesting it and not having any information about rate limiting.

kev009 11 years ago | |

Use nsd. If you just run an authoritative only service, it is easy to do correctly.

joesavage 11 years ago | | |

For the record, the setup shown with PowerDNS is authoritative-only too.

kchoudhu 11 years ago | |

I run a recursing DNS server behind a firewall for my home servers -- is this risky?

mcpherrinm 11 years ago | | |

If nobody can query the server from behind the firewall, you're fine. Nearly every home router runs a copy of dnsmasq as a recursive resolver for the users on the local network.

driverdan 11 years ago | |

Plus your DNS servers (you are running more than one right?) are never going to be as fast as Route 53 and the ilk. Spend the $5/m and use a real DNS host.

mey 11 years ago | |

Do you have any suggestions/articles on where people can learn how to run a DNS safely?

Blackthorn 11 years ago | | |

Unfortunately, I do not. Even though I personally learned on one of the big boys, I'd still pay somebody else to do this who has it as their dedicated job (like Amazon or Google). It's just not worth the headache and constant monitoring.

At minimum you need conservative rate limiting and monitoring that will page you when you start sending out gobs of traffic.

kuon 11 years ago |

I'd like to point out that google DNS among others uses anycast and are in reality composed of multiple servers geographically distributed, even if there is a single IP.

nly 11 years ago | |

The IP you query as a client is anycast, but I'd wager recursive queries out of their caches come from geo-friendly IPs.

joesavage 11 years ago | |

Right you are. Just updated the article to be more accurate on this matter.

pushrax 11 years ago |

If you want to cut down on DNS-induced latency, Route 53 is a fairly good option. Their latency-routed DNS doesn't perfectly map to all geographical zones, but it works fairly well for DigitalOcean's locations.

I wish it was easier/cheaper to run your own anycast network...

rdl 11 years ago | |

I wonder if "run your own anycast network as a service" would ever make sense as a product. I can't see anyone other than CDN or testing being terribly interested, and a lot of this is included in the raw CDN use case.

samcrawford 11 years ago | | |

There is at least one already out there - http://www.hostvirtual.com/anycast-bgp-cloud/. You have to bring your own IP space (/24 minimum of course). I vaguely remember reading the charges were in the low thousands of dollars per month, but that was a while ago.

opendais 11 years ago | | |

https://rage4.com/Home/ANY

Is that what you are looking for? They only have 3 locations tho.

opendais 11 years ago | |

Route 53 now does GeoDNS so you can map it more accurately, for a few cents more.

http://aws.amazon.com/route53/pricing/

pushrax 11 years ago | | |

Awesome, didn't realize that! Will definitely be using it.

dgl 11 years ago |

The Powerdns geo backend as mentioned by the article is used by wikipedia among others.

I have some additions (e.g. Google Public DNS), see the files at https://gist.github.com/dgl/8344c3ebe405a1400e2d (which also has the rsync location for the original).

[edit: now I read the article again I notice the author is assuming 'eu' is going to get all of EU, it won't. There need to be entries for each country.]

le 11 years ago |

This is a neat article, but 'CDN' is such a broad term. This is much more a very well done proof of concept article, but fails to take into account the huge scope of a large scale CDN, and all associated quirks it comes with.

ambrop7 11 years ago |

It must be so hard to expand the abbreviation once.

rdl 11 years ago | |

I think more people know "CDN" than the expansion (Content Distribution/Delivery Network).

Same is probably true for ATM (financial or 53-byte cell), POP, DNS, RFP, RFC, IMAP, SSL, ...