#itsalwaysdns — Public Fediverse posts

It was DNS.

You make one lookup. Your resolver quietly makes three: root, then .ch, then my nameserver. Four round trips wearing a trenchcoat, pretending to be one instant thing.

Then it caches the answer for the TTL. Which is why you fix the record, flush your own cache, confirm it works, and everyone else keeps getting the old address while you insist the problem is solved.

Third diagram in the series. I am running out of protocols I am confident about.

#DNS #Networking #DevOps #SysAdmin #ItsAlwaysDNS #Blog #Thoughts

Drew the whole OSI stack because I got tired of googling which layer TLS sits on.

Many years in. Still counting on my fingers.

In practice I touch three of them.
Physical, when someone unplugged the thing.
Network, when it is DNS.
Application, when it is also DNS.

Presentation I had to look up. Twice. The first result was a mnemonic about pizza so I closed the tab out of spite.

Layer 5 is in there too. Doing something. Allegedly.

#OSIModel #Networking #DevOps #SysAdmin #ItsAlwaysDNS #Blog #Thoughts

Drew the whole OSI stack because I got tired of googling which layer TLS sits on.

Many years in. Still counting on my fingers.

In practice I touch three of them.
Physical, when someone unplugged the thing.
Network, when it is DNS.
Application, when it is also DNS.

Presentation I had to look up. Twice. The first result was a mnemonic about pizza so I closed the tab out of spite.

Layer 5 is in there too. Doing something. Allegedly.

#OSIModel #Networking #DevOps #SysAdmin #ItsAlwaysDNS #Blog #Thoughts

@ds @keithduthie

Whut?

I set Vivaldi's internal DNS thing to OpenDNS and the problem went away.

#ItsAlwaysDNS

On today's episode of "Fucking DNS":
Mac: nslookup works, dscacheutil doesn't
Linux: nslookup returns IP _and_ throws an NXDOMAIN error.
#itsAlwaysDNS #DNS

What makes DNS troubleshooting so much fun is that every client behaves wildly different. TIL that macos uses DSCasheUtil under the hood, which will sometimes give different results from nslookup.

#DNS #itsAlwaysDNS

fucking DNS...
#itsAlwaysDNS

Was macht mehr wach? #itsalwaysdns

Heute war #DENIC an der Reihe, uns daran zu erinnern, was passiert, wenn auch nur ein Baustein unserer modernen, vernetzten Welt ausfällt.

#DigitaleResilienz #Resilienz #KRITIS #ItsAlwaysDNS

Kommste nach'm Plenum nach Hause und musst dich erstmal erklären, warum denn das Internet nicht geht, warum und was man denn da wieder unbedingt selber machen muss, auf dem Handy geht es aber doch!!1
#itsalwaysDNS

Ah, the first details emerge. TL;DR: Denic experts are looking for the root cause.

"Frankfurt am Main, 5 May 2026 - DENIC eG is currently experiencing a disruption in its DNS service for .de domains. As a result, all DNSSEC-signed .de domains are currently affected in their reachability."

#ItsAlwaysDNS

UPDATE: Seems to be fixed, all back to normal.

Oops. Seems that #Denic has b0rked DNSSEC for the .de TLD. They list an ongoing issue but no details are (yet) available. https://status.denic.de

UPDATE: Now upgraded to a service disruption, still no details.

#ItsAlwaysDNS

context the root servers for .de have currently issues with DNSSEC

#ItsAlwaysDNS

Good thing the internet runs on .io and .social.

#denic #dnssec #dns #itsalwaysdns

Was debugging on and off for literally days why collabora wasn’t working on one Nextcloud and of course just now it struck me: it was #DNS

#itsalwaysdns #selfhosting

Oh. Huh. Imagine that….

The .org root DNSSEC is gerbusterficated or in transition or something.

#Sysadminnery #DNSSEC #ItsAlwaysDNS

dnsviz is being cranky for me. Everyone else stop using it for the day, OK?

#Sysadminnery #DNSSEC #ItsAlwaysDNS

So I've just set up a new domain for a client to receive emails and forward them on using various rules, and sent a test email to make sure it's working.

Test email did not arrive.

So I dive into email server logs, double check SPF and DMARC settings, examine the forwarding and other configs.

5 minutes later I realise I've utterly forgotten to add an MX record in DNS for the domain 🤦🏻‍♂️

#itsAlwaysDNS

My gateway is down. Trying to think how that is DNS's fault.

#sysadmin #dns #itsalwaysdns #networking

When setting up a new DNS server at home, don’t forget the `systemctl enable named` to avoid a barrage of error messages and notifications after you reboot the machine running said new DNS server :)

#ItsAlwaysDNS #Selfhost #NeedMoreCoffee @homelab

Hey! We’re back. #itsalwaysdns

After setting up DNS over HTTPS, got curious how DNS leak test tools, which discover your DNS resolver, such as Browser Leaks, work :blobcatthinking:

Turns out, it's quite clever setup: while you are visiting browserleaks.com website, in the background it queries a number of hostnames generated especially for you, such as 9d0pafrc5tnu.dns4.browserleaks.net, 0zfannouveb4.dns4.browserleaks.org and so on.

Because the website generates those hostnames specifically for your session, it is able to associate your external IP to the hostnames you attempt to resolve.

Now because site operators controls authoritative name servers behind those generated hostnames - specifically ns2.browserleaks.net and ns1.browserleaks.net (also with .org), from logs they can check what exact DNS resolver asked for those unique hostnames.

Simply matching a resolver DNS that attempted to resolve those unique hostnames is enough to link it to your visit of a website session - it is often going to be the resolver of your internet service or virtual private network provider, unless you've explicitly changed your resolver to something else. Still, easily visible to authoritative DNS server.

Voila! No magic, just simple, nice setup :blobcatcheer:

Just think of how many fingerprinting schemes can big techs carry out to track you across the internet with vast compute resources available to them... :blobcatheadinitshands:

#itsalwaysdns #dns #resolver #dnsleak #survelliance #tracking #privacy