I was working on providing public DNS resolvers for people who would not like to use Google or Quad9, for whatever reasons - and couldnβt / didnβt want to selfhost their own. So I build two of those, tested them on my computerS for months and opened them to the test for limited audience - like advertised it to a limited audience but service was not source-filtered.
It didnβt take long (like 2-3 days) before they got assaulted by bots and stuff. They survived this quite well so I was not that worried.
Then I received an abuse report from one of the provider saying they received an alert notification from XXX Security Company. The initial content was like "thereβs a dumbass running an open relay service that can be used by others to participate a DDOS". The provider email was more like "We received this alert. You may discard it. Or you may do something to ensure security". After checking my logs, I noticed that my servers cached things pretty well and that they wouldnβt query external DNS more than a few times a day, at worse, for specific DNS entries. I also checked that I had enabled limitations in the conf to prevent rogue access - I also feared I was limiting too much TBH.
Still, got kinda scared of participating in enshitting the Internet so I switched back to source-filtering the access to only my computers. And notify the limited audience that I rolled back and closed the service.
Papers I found online were simply recommending QoS and implementing query rate limitation. Online checkers I found simply went "Danger! Danger! Anyone can make recursive queries there! Turn this off!"
All that to say I wonder⦠Is this just Big Tech & friends trying to keep their users or is the danger real. How do the 4-5 so called alternative-public-resolver manage DDOS protection. Did they register somewhere as "official providers" to not be bothered by shitty observers.
What do you, #DNS people, say on this?
πΉπππ π²πππππ βοΈπ€ͺ
npub1s5β¦3h379
2026-02-24 04:31:27 UTC
Author Public Key
npub1s5hwf7kw62h6ykqzjddzj74ywaf670pe296mr42yk83afyr3c82sa3h379Seen on
wss://relay.ditto.pubPublished at
2026-02-24 04:31:27 UTCEvent JSON
{
"id": "5487927927fccf1d3d814516ad33dd1f22a0317402615c9e7eb936c17faa3d25",
"pubkey": "852ee4faced2afa25802935a297aa47753af3c395175b1d544b1e3d49071c1d5",
"created_at": 1771907487,
"kind": 1,
"tags": [
[
"proxy",
"https://gts.tumfatig.net/users/joel/statuses/01KJCJB1PNPVMKW65M9NPZ1GEF",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "I was working on providing public DNS resolvers for people who would not like to use Google or Quad9, for whatever reasons - and couldnβt / didnβt want to selfhost their own. So I build two of those, tested them on my computerS for months and opened them to the test for limited audience - like advertised it to a limited audience but service was not source-filtered.\n\nIt didnβt take long (like 2-3 days) before they got assaulted by bots and stuff. They survived this quite well so I was not that worried.\n\nThen I received an abuse report from one of the provider saying they received an alert notification from XXX Security Company. The initial content was like \"thereβs a dumbass running an open relay service that can be used by others to participate a DDOS\". The provider email was more like \"We received this alert. You may discard it. Or you may do something to ensure security\". After checking my logs, I noticed that my servers cached things pretty well and that they wouldnβt query external DNS more than a few times a day, at worse, for specific DNS entries. I also checked that I had enabled limitations in the conf to prevent rogue access - I also feared I was limiting too much TBH.\n\nStill, got kinda scared of participating in enshitting the Internet so I switched back to source-filtering the access to only my computers. And notify the limited audience that I rolled back and closed the service.\n\nPapers I found online were simply recommending QoS and implementing query rate limitation. Online checkers I found simply went \"Danger! Danger! Anyone can make recursive queries there! Turn this off!\"\n\nAll that to say I wonderβ¦ Is this just Big Tech \u0026 friends trying to keep their users or is the danger real. How do the 4-5 so called alternative-public-resolver manage DDOS protection. Did they register somewhere as \"official providers\" to not be bothered by shitty observers.\n\nWhat do you, #DNS people, say on this?",
"sig": "41556456bd34ac98f265d0c4d2b742fee9258bce0e493092b6e357465d861b64e8e3a1c725b8f40b7475020a5cd01b65e1f8306d3498034e2bec82d290cb9d6a"
}