Best DNS Service With API Access?

netaustin writes "My company runs quite a few media websites, mostly on Drupal, and about half on ec2. We have a good server setup with ec2 which allows us to route requests through Pound, a cluster of Varnish servers, then a cluster of Apache servers. We manage 50 domains (one per state) like this. Problem is, anytime things change, we have to manually adjust DNS for all 50 states, which is very boring and usually causes negative side effects too as we can't ever adjust all 50 DNS entries at once. We'd like to just change DNS providers and be done with it, but there are a lot of options, and I don't often shop for DNS services. I use EveryDNS for my personal domains, but I don't think they provide an API and it'd feel a little dishonest to reverse engineer the forms on their site since they're an esteemed donations-based service. I wouldn't feel bad about doing that to DNSPark, but they have a CAPTCHA image accompanying their login form, so goodbye DNSPark. I found a couple services that seem to do what I'm looking for, but they both feel a bit Microsoft-y and since I only want to change once, I want to get this right. Advice?"

Comments

diy??

[sholdowa]

Why not run your own??

Re:diy??

[Anonymous Coward]

>Why not run your own??

Apparently the article submitter isn't competent enough to do this on his/her own: Why else would he/she submit something so obviously mission critical to Slashdot?

I *hate* seeing articles such as these on Slashdot: They fall into the "do my job for me" category, and should be tagged as such... only, now days, there are *so* many people on Slashdot lacking basic networking skills, it's almost moot: Hell, articles such as these generate traffic/revenue for Slashdot (to which I am contributing, of course), simply because of that fact. I imagine that such are the second highest traffic/revenue generator, right behind the "RIAA/MPAA"-type articles.

My advice: If you can't figure out a viable method to accomplish what you need, using the skills and knowledge you possess, perhaps you should *hire* someone that can? And, learn from them, as they are doing it?

Slashdot: News For Wannabes, Stuff That Matters To Them.

Captcha: bitterly

Now THAT is a nice one.

Re:diy??

[NETHED]

I know replying to an AC won't do much, but I just feel like it, and have not much else to do right now.

Begin Rant...
Slashdot was _the_ site for breaking news a few years ago, and sites would be regularly slashdotted, etc. Now, blogs have taken over, and push out news MUCH faster than slashdot. I think slashdot has the ability/potential to become more of a community. I used to read the comments of slashdot for more insight, as there are truely intelligent people on this site that leave comments, but lately, the S/N ratio has gone bad.

Stories like this are (I think) an attempt to bring back the good S/N ratio. No, slashdot no longer breaks stories, nor does it need to, the slashdot community has probably read about the articles somewhere else, and now comes here to discuss them. Yes, people flame, and there are many FPs, but thats slashdot, and it adds a little something.

So when I read this story, I read it because I'm looking to learn something from the comments. I think thats the direction the slashdot community is going towards.

End of Rant...

Run a master?

[The Lesser Powered O]

How about running your own master DNS server, and having your provider slave from that.

Re:Run a master?

[WuphonsReach]

How about running your own master DNS server, and having your provider slave from that.

That's the ideal way to do it. Setup your own master server using BIND or whatever, and you get the best of both worlds. You can script access to your DNS server entries, make updates however you want to, and make it as secure as you want to.

Then let the DNS provider simply serve as secondary servers for your DNS domains. Even if your primary DNS server is down for maintenance, the NS records on your domains are pointing at the DNS provider's pool of servers which are geographically separated.

(Alternately, you could try a service like DNSMadeEasy, which allows you to make API-style updates to your DNS entries. Unfortunately, security is a bit thin and you have to hard-code usernames and passwords.)

Re:Run a master?

[Lorens]

What sort of load can the DB backend handle?

Enough.

Does it use caching?

Yes.

There's a DLZ-bind mod out there, but it executes at least one SQL query for every DNS query; which can't handle even moderate load.

That's their problem. PowerDNS rocks. No more pesky start-up times, no more wondering if the syntax is OK so everything can start up again after a reload, let client have a web interface to his zone using simple SQL...

Re:CNAMEs?

[Wowlapalooza]

Are all your domains hosted on the same set of servers? Could you CNAME the 50 domains to a smaller subset of domain names, and then you only have to change the A records of that subset whenever you have a change?

I second this idea.

I'd also point out that you can ease your DNS transitions by carefully planning a "drawdown" of the TTL values of your records prior to the actual change and/or setting up HTTP redirection on the legacy addresses, redirecting to the new location, during the interval of time in which the new DNS information is still replicating and/or resident in DNS caches.

Unclear

[mcrbids]

Are you looking for features in a registrar or dns provider? While most registrars also provide DNS service, there's never a requirement that you have to use them. And use them I don't.

I got good and comfortable with Bind many years ago, and have the DNS administration stuff down pat. I have some really nice administration scripts that manage changes by service. Throw in a few variables, some regex, and some DNS boilerplate definition files, and I get the ability to re-ip a service (EG: websites, email, https, dbserver, etc. ad nauseum) for hundreds of domains in 60 seconds flat if you include updating the actual DNS servers with the changes. (I publish 2, I maintain 5 so that I can quickly switch nameservers in case of hardware/network failure)

Other than that, I have all my domains linked to two DNS servers by name, and occasionally I have to move a DNS server. It takes a few minutes.

Is this what you are looking for?

Re:Most people I have ever met or seen

[ScrewMaster]

You sound like you've had a long drive home. How about posting in the relevant forum next time, m'kay?

I dunno ... it was a pretty damn good rant.

Network Engineer

[Anonymous Coward]

...or do it yourself. Easy, you're the boss, and you only pay for the hardware and net service. I would never buy DNS from anyone.

Run your own hidden master

[Anonymous Coward]

Pay a nominal fee to have an ISP slave their big bad never-down DNS servers against your hidden master. Make sure it is set up to allow DDNS updates from your master so there is no lag making the new data public. All you have to worry about is TTL.

Your server server will not take the load and will not have the uptime requirement as the public servers. You can put just about any DNS software on your server so you can use any API you want there.

Re:Run your own hidden master

[Anonymous Coward]

Make sure it is set up to allow DDNS updates from your master

WTF? Ever heard of notify and zone transfers?

Re:DynDNS

[ishobo]

You should have gotten your own domain, not the host sitting on their domain, and used the CustomDNS service. I have an account that has been inactive for over a year and it is still there. CustomDNS domains will never expire if you have been with them since the begining when they were free; all those domains were grandfathered and remain free of charge.

Totally unimpressed, I would never, ever touch them for things I cared about again.

With the free DynamicDNS service, you get what you pay for. If the infrastructure is that important to you, pay for the account.

Re:DynDNS

[ishobo]

You depended on a free service that had limitations for a critical function of your web and email. I am not sure why you decided to use the DynamicDNS service instead of CustomDNS unless you did not want to pay for your own domain. I can understand not wanting to spend any money but you got exactly what the service offers. DynamicDNS has always had the 30 day rule. That is what the word dynamic means. An update client could have been used; the IP address does not have to change but the record needs to be refreshed. You needed to upgrade to the premium level in order to remove the auto expire, and the upgrade was a onetime fee many years ago. Did you not read the account details before signing up?

The old ml.org asked for donations, which did not work out too well. The premium level is how DynDNS was going to make some cash in the begining because it actually costs money to host servers.

Re:DynDNS

[CyprusBlue113]

I'm sorry but you clearly read and understood the limitations, and then proceeded to completely ignore them in design. This was completely your fault, and blaming the company for it just proves how incompetent/irresponsible you are. I hope I never have the misfortune of any of my systems depending on you.