Best DNS Service With API Access?

netaustin writes "My company runs quite a few media websites, mostly on Drupal, and about half on ec2. We have a good server setup with ec2 which allows us to route requests through Pound, a cluster of Varnish servers, then a cluster of Apache servers. We manage 50 domains (one per state) like this. Problem is, anytime things change, we have to manually adjust DNS for all 50 states, which is very boring and usually causes negative side effects too as we can't ever adjust all 50 DNS entries at once. We'd like to just change DNS providers and be done with it, but there are a lot of options, and I don't often shop for DNS services. I use EveryDNS for my personal domains, but I don't think they provide an API and it'd feel a little dishonest to reverse engineer the forms on their site since they're an esteemed donations-based service. I wouldn't feel bad about doing that to DNSPark, but they have a CAPTCHA image accompanying their login form, so goodbye DNSPark. I found a couple services that seem to do what I'm looking for, but they both feel a bit Microsoft-y and since I only want to change once, I want to get this right. Advice?"

Comments

DynDNS

[rho]

DynDNS.

That was easy.

Re:DynDNS

[crush]

Yeah. One of the most reliable and ethical operators in the business.

This seems like an appropriate link.

Re:DynDNS

[oskard]

Also be sure to check out Dynect!

DynDNS also offers another service, more business class. It has a MUCH more robust API, offers Failover, Load Balancing, Anycast, etc. Multiple users, node-based permissions. 37Signals, Mozilla, and RackSpace use Dynect. Highly recommended, give them a call!

http://dynect.com/technology/developers.html

http://dynect.com/features/api.html

Re:DynDNS

[rho]

Yeah. One of the most reliable and ethical operators in the business.

This should be emphasized. DynDNS is both reliable and ethical, and have been for a long time. Indeed, since before they went commercial. When they were non-com, you could get unlimited custom DNS services for a $30 donation. Guess what? When they went commercial they honored that pledge. I still have a number of "never expires" services because of this.

Seriously, it's not worth dicking around with DNS. Get it done right the first time.

Re:DynDNS

[Anonymous Coward]

Actually I have had two accounts 'vanished' by DynDNS now and would never use them again, including one that has been with them for about 8 years first using their dyndns service and more lately (over the last few years) using their staticdns service. Both appear to have been clobbered by their 'stuff must get updated at least every 30 days' policy [1]. Which of course makes utterly no sense for a staticdns service. The staticdns account was for a domain with a PR of about 5 (it was on the air and highly linked-to for over seven years...), so I was understandably upset to see it suddenly vanish off the air one day with no warning whatsoever.

Totally unimpressed, I would never, ever touch them for things I cared about again.

[1] Read the first couple of sentences of the second paragraph on this page:
https://www.dyndns.com/account/resetpass/index.html

Re:DynDNS

[ishobo]

You should have gotten your own domain, not the host sitting on their domain, and used the CustomDNS service. I have an account that has been inactive for over a year and it is still there. CustomDNS domains will never expire if you have been with them since the begining when they were free; all those domains were grandfathered and remain free of charge.

Totally unimpressed, I would never, ever touch them for things I cared about again.

With the free DynamicDNS service, you get what you pay for. If the infrastructure is that important to you, pay for the account.

diy??

[sholdowa]

Why not run your own??

Re:diy??

[Anonymous Coward]

>Why not run your own??

Apparently the article submitter isn't competent enough to do this on his/her own: Why else would he/she submit something so obviously mission critical to Slashdot?

I *hate* seeing articles such as these on Slashdot: They fall into the "do my job for me" category, and should be tagged as such... only, now days, there are *so* many people on Slashdot lacking basic networking skills, it's almost moot: Hell, articles such as these generate traffic/revenue for Slashdot (to which I am contributing, of course), simply because of that fact. I imagine that such are the second highest traffic/revenue generator, right behind the "RIAA/MPAA"-type articles.

My advice: If you can't figure out a viable method to accomplish what you need, using the skills and knowledge you possess, perhaps you should *hire* someone that can? And, learn from them, as they are doing it?

Slashdot: News For Wannabes, Stuff That Matters To Them.

Captcha: bitterly

Now THAT is a nice one.

Re:diy??

[WhatAmIDoingHere]

"My advice: If you can't figure out a viable method to accomplish what you need, using the skills and knowledge you possess, perhaps you should *hire* someone that can? And, learn from them, as they are doing it?"

That's what HE was hired for.

Re:diy??

[NETHED]

I know replying to an AC won't do much, but I just feel like it, and have not much else to do right now.

Begin Rant...
Slashdot was _the_ site for breaking news a few years ago, and sites would be regularly slashdotted, etc. Now, blogs have taken over, and push out news MUCH faster than slashdot. I think slashdot has the ability/potential to become more of a community. I used to read the comments of slashdot for more insight, as there are truely intelligent people on this site that leave comments, but lately, the S/N ratio has gone bad.

Stories like this are (I think) an attempt to bring back the good S/N ratio. No, slashdot no longer breaks stories, nor does it need to, the slashdot community has probably read about the articles somewhere else, and now comes here to discuss them. Yes, people flame, and there are many FPs, but thats slashdot, and it adds a little something.

So when I read this story, I read it because I'm looking to learn something from the comments. I think thats the direction the slashdot community is going towards.

End of Rant...

Run a master?

[The Lesser Powered O]

How about running your own master DNS server, and having your provider slave from that.

Re:Run a master?

[Charles Dodgeson]

Me, too. (That means "mod parent up")

You can use DNSpark (whom I use) or other providers as slaves. Your master doesn't even need to be publicly accessible, just as long as you allow the appropriate zone transfers. This way you can have your own little scripts that generate the zone files on a host you fully control, while having the world query those professionally managed servers.

Re:Run a master?

[WuphonsReach]

How about running your own master DNS server, and having your provider slave from that.

That's the ideal way to do it. Setup your own master server using BIND or whatever, and you get the best of both worlds. You can script access to your DNS server entries, make updates however you want to, and make it as secure as you want to.

Then let the DNS provider simply serve as secondary servers for your DNS domains. Even if your primary DNS server is down for maintenance, the NS records on your domains are pointing at the DNS provider's pool of servers which are geographically separated.

(Alternately, you could try a service like DNSMadeEasy, which allows you to make API-style updates to your DNS entries. Unfortunately, security is a bit thin and you have to hard-code usernames and passwords.)

Re:Run a master?

[Sentry21]

to heck with zone files, set up something like PowerDNS and set it up with a database backup. Do one update query and push out to the slaves. PDNS is also quite snappy, and configuration is far less arcane compared to Bind - in five minutes I had an authoritative, non-recursing DNS server which was not vulnerable to the Kaminsky vulnerability (even if it did recurse). It does things same, logs sanely, and doesn't make me feel like a clueless newbie like Bind does (even after ten years of adminning DNS servers).

Check it out, it's worth it.

Re:Run a master?

[Anonymous Coward]

"who would you go to for DNS glue records?"

If really needed, your DNS registrar will do.

"you need DNS glue from someone above you in order for those DNS servers to be valid."

No, you don't.

"Or has stuff changed since I last did this a few years back?"

No, it hasn't.

You only need glue records... when you need glue records. For a NS that means only if the name server for a domain happens to be within the same domain (so NS for example.com is for instance ns.example.com). On the typical scenario DNSs will be something like ns1.mycompany.com, ns2.mycompany.com and they will serve i.e. onestate.com, othercompany.com and the like. No glue records involved.

Run your own dns servers .... try powerdns

[brainchill]

It sounds like it's time to run your own dns servers. For what you're trying to do I recommend powerdns with either a mysql or postgres backend. You can do massive updates with regular sql update syntax very quickly and anything that can talk mysql can update it ... perl, php, ruby, etc ... you name it.

Re:Run your own dns servers .... try powerdns

[abigor]

If you indeed do need to run your own dns servers, then I second the PowerDNS recommendation. Having a proper sql backend is just paradise compared to the flat files of, uh, a certain other dns server that should be killed off. It's also worth noting that PowerDNS splits the authoritative server and the recursor into two separate daemons, which is quite a nifty idea.

Re:Run your own dns servers .... try powerdns

[Lennie]

It's not nifty to split authoritative and recursive, it's sane (security).

"media-based company"

[perlchild]

Are we talking any sort of budget here, or does it have to be free?

Quite a few places will charge a nominal per-year fee for dns, and provide good uptime...

A lot of those are the places you register the domains from, and they make more money on registrations than dns service, but provide both.

Please provide details

Elastic IPs?

[andrewl6097]

You could also leave your DNS static and use EC2 Elastic IPs to shift things around on the backend (you did mention you were using EC2).

Unclear

[mcrbids]

Are you looking for features in a registrar or dns provider? While most registrars also provide DNS service, there's never a requirement that you have to use them. And use them I don't.

I got good and comfortable with Bind many years ago, and have the DNS administration stuff down pat. I have some really nice administration scripts that manage changes by service. Throw in a few variables, some regex, and some DNS boilerplate definition files, and I get the ability to re-ip a service (EG: websites, email, https, dbserver, etc. ad nauseum) for hundreds of domains in 60 seconds flat if you include updating the actual DNS servers with the changes. (I publish 2, I maintain 5 so that I can quickly switch nameservers in case of hardware/network failure)

Other than that, I have all my domains linked to two DNS servers by name, and occasionally I have to move a DNS server. It takes a few minutes.

Is this what you are looking for?

ZoneEdit

[bziman]

I've been using ZoneEdit for years and they're great. Free for small domains, and really cheap for huge domains. It never, ever breaks. And it's super easy to work with.

Re:FreeDNS

[almightynayr]

afraid.org will do everything he wants and then some, been using them for over 5 years now with no problems. check it out

Run your own hidden master

[Anonymous Coward]

Pay a nominal fee to have an ISP slave their big bad never-down DNS servers against your hidden master. Make sure it is set up to allow DDNS updates from your master so there is no lag making the new data public. All you have to worry about is TTL.

Your server server will not take the load and will not have the uptime requirement as the public servers. You can put just about any DNS software on your server so you can use any API you want there.

Dear Mr. Rho,

[Anonymous Coward]

Hi there, I am representing my client, Staples, Inc. Your use of the phrase "That was easy" treads upon the Intellectual Property right of Staples, Inc. Use of my client's slogan without prior written authorization is not permitted. You will immediately cease claiming that anything other than Staples, Inc. "was easy". This includes everything from DynDNS to your girlfriend and/or wife.

Sincerely yours,

Mr. Vatwozeezee

What the heck?

[davidu]

I commented on this story in the firehose... what happened to that? [ http://slashdot.org/comments.pl?sid=974977&cid=25145093 ]

I wrote:

We're working on providing a FULL API to EveryDNS. Slowly, but surely. I've got new folks on board taking over the site to make it finally be the awesome beast it should be. And it'll still be free. I'm also trying to figure out a way to tie this into Pingdom's API since a lot of people already use that for monitoring. :-)

-davidu

Re:What the heck?

[netaustin]

davidu,

I actually met you in college at one point; you were a senior, I was a [self involved] freshman, and you gave me some very good advice then too. FWIW.

Thanks to everyone for all the great advice. I'm going to probably roll with EveryDNS one way or the other out of loyalty to their service which has never let me down.

And we'll donate our savings from DNSPark.

We use and love OpenDNS too. If you're ever in New York, I owe you a beer.

-netaustin

GoDaddy dba WildWest

[bobbozzo]

GoDaddy dba WildWest has an API, but we seem to have ended up being guinea pigs for it, and it didn't go well. Their documentation had features that didn't exist, promised 24-hour turnaround on support failed, ...
It's working OK now, but I can't really recommend it.