Abstract


Secure DNS


  • Basically DNS with encryption, so 3rd-party that is monitoring the DNS traffic is unable to see which site you are visiting. There are two standards on secure DNS - DNS over TLS(DoT) & DNS over HTTPS(DoH)
DoTDoH
Encryption methodTLSHTTPS
Network Port853443
PrivacyLower, since it uses a dedicated port numberHigher, DNS queries are hidden inside normal HTTPS traffic

DDNS


  • Stands for Dynamic DNS
  • Basically a technique used to modify the DNS Record automatically if the value of the DNS Record is changed. DDNS can help ensure that DNS queries work even if the web service being sought has recently switched IP addresses

How does it work?

Users uses software which runs on their computer or Network Router, one common software is jeessy2/ddns-go which is usually used with OpenWRT. This software communicates with the dynamic DNS service provider (like Cloudflare) anytime the IP Address provided by the ISP is updated, and the dynamic DNS provider in turn updates the DNS with those changes, providing almost instant updates.

Home lab use case

The Public IP Address assigned to our house network changes regularly unless we pay extra for a static IP 💸. If we have a A Record that points to service running in our home lab, we have to manually update the A record when the public IP address of our house network is changed, this incurs downtime and it is tedious.

Services like Cloudflare allows us to control the DNS Record using an API key with DNS Edit permission, then we can write a script or jeessy2/ddns-go to achieve DDNS - updating the DNS record once the public IP address of the house network changes.

jeessy2/ddns-go comes with Webhook, with the help of ddns-telegram-bot, I will also get notified via Telegram whenever my house IP address is changed :)

DNS Features


geoDNS

Load Distribution

  1. A set of IP Address is associated with one Domain Name
  2. When Client make dns query to that domain name
  3. Authoritative DNS Server responds the entire set of IP Address with the use of DNS Rotation
  4. Client typically sends its HTTP request message to the IP Address that is listed first in the set. Thus, distributing load among replicated server
  • DNS Rotation is also used on E-mail Server, so multiple of the servers can share the same domain name

DNS Caching

DNS Rotation

Useful CLi Tools

q

  • DNS client with support for UDP, TCP, DoT, DoH, DoQ and ODoH
brew tap natesales/repo https://github.com/natesales/repo
brew install q

References