Skip to content

Commit

Permalink
Update DIY DNS blog post to say back in action
Browse files Browse the repository at this point in the history
  • Loading branch information
@jb3
jb3 committed Jul 2, 2024
1 parent 0b8d1af commit 1fc0405
Showing 1 changed file with 32 additions and 39 deletions.
71 changes: 32 additions & 39 deletions src/content/projects/diy-dns.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,57 +4,50 @@ date: 2021 to Present
link: https://github.com/jb3/dns
description: My DIY DNS project replaced the nameservers for jb3.dev with self-hosted BIND nameservers deployed using Ansible. It implements advanced DNS features like DNSSEC, including (fairly secure!) automatic key generation.
---
import Admonition from "../../components/Admonition.astro";

<Admonition level="note" title="A note on deployment">
The project detailed below is not currently deployed, and this site is currently served through Cloudflare Pages.

The files linked below remain as-is though and can be referenced, I hope one day to deploy this project again!
</Admonition>

My DIY DNS project replaced the nameservers for jb3.dev with self-hosted BIND nameservers deployed using Ansible. It implements advanced DNS features like DNSSEC, including (fairly secure!) automatic key generation.

I'll eventually be writing a full blog post on how I set up this project, from having Ansible install BIND to generating DNSSEC keys and signing the zone.

`largo.jb3.dev` and `zorin.jb3.dev` (named after the Bond villains) are the two authorative nameservers for `jb3.dev`, you can try them for yourself using [`dig`](https://linux.die.net/man/1/dig).
`core.host.jb3.dev` and `rt1.host.jb3.dev` are the two authorative nameservers for `jb3.dev`, you can try them for yourself using [`dig`](https://linux.die.net/man/1/dig).

As an example, a DNS query for this domain, jb3.dev, will start at the DNS roots, progress to the `dev.` TLD nameservers and end up at one of the nameservers that serves the `jb3.dev.` zone. A nicer visualisation of the below dig command can be found [here](https://dns-lookup.jvns.ca/trace.html#jb3.dev).

```shell title="jb3.zone" {31-34} collapse={6-17, 21-24}
$ dig +trace +nodnssec jb3.dev

; <<>> DiG 9.16.23 <<>> +trace +nodnssec jb3.dev
; <<>> DiG 9.18.27 <<>> +trace +nodnssec jb3.dev
;; global options: +cmd
. 7184 IN NS b.root-servers.net.
. 7184 IN NS k.root-servers.net.
. 7184 IN NS h.root-servers.net.
. 7184 IN NS f.root-servers.net.
. 7184 IN NS c.root-servers.net.
. 7184 IN NS i.root-servers.net.
. 7184 IN NS d.root-servers.net.
. 7184 IN NS a.root-servers.net.
. 7184 IN NS g.root-servers.net.
. 7184 IN NS j.root-servers.net.
. 7184 IN NS e.root-servers.net.
. 7184 IN NS l.root-servers.net.
. 7184 IN NS m.root-servers.net.
;; Received 239 bytes from 127.0.0.53#53(127.0.0.53) in 0 ms
dev. 172800 IN NS ns-tld1.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld2.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld3.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld4.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld5.charlestonroadregistry.com.
;; Received 392 bytes from 199.7.83.42#53(l.root-servers.net) in 30 ms
jb3.dev. 10800 IN NS largo.jb3.dev.
jb3.dev. 10800 IN NS zorin.jb3.dev.
;; Received 104 bytes from 216.239.38.105#53(ns-tld4.charlestonroadregistry.com) in 20 ms
jb3.dev. 3600 IN A 76.76.21.21
jb3.dev. 3600 IN NS largo.jb3.dev.
jb3.dev. 3600 IN NS zorin.jb3.dev.
;; Received 148 bytes from 89.58.0.80#53(largo.jb3.dev) in 30 ms
. 87203 IN NS m.root-servers.net.
. 87203 IN NS e.root-servers.net.
. 87203 IN NS a.root-servers.net.
. 87203 IN NS j.root-servers.net.
. 87203 IN NS c.root-servers.net.
. 87203 IN NS i.root-servers.net.
. 87203 IN NS k.root-servers.net.
. 87203 IN NS d.root-servers.net.
. 87203 IN NS l.root-servers.net.
. 87203 IN NS f.root-servers.net.
. 87203 IN NS g.root-servers.net.
. 87203 IN NS h.root-servers.net.
. 87203 IN NS b.root-servers.net.
;; Received 239 bytes from 8.8.8.8#53(8.8.8.8) in 26 ms
dev. 172800 IN NS ns-tld1.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld2.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld3.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld4.charlestonroadregistry.com.
dev. 172800 IN NS ns-tld5.charlestonroadregistry.com.
;; Received 392 bytes from 2001:503:c27::2:30#53(j.root-servers.net) in 23 ms
jb3.dev. 10800 IN NS rt1.host.jb3.dev.
jb3.dev. 10800 IN NS core.host.jb3.dev.
;; Received 143 bytes from 216.239.34.105#53(ns-tld2.charlestonroadregistry.com) in 30 ms
jb3.dev. 3600 IN A 202.61.228.148
jb3.dev. 3600 IN NS rt1.host.jb3.dev.
jb3.dev. 3600 IN NS core.host.jb3.dev.
;; Received 161 bytes from 66.245.193.219#53(rt1.host.jb3.dev) in 16 ms
```
Note: DNSSEC has been omitted here for brevity, but you can see a visualisation of the DNSSEC zones [here](https://dnsviz.net/d/jb3.dev/dnssec/).

0 comments on commit 1fc0405

Please sign in to comment.