Hacker News Reader

Comment by Mojah | Hacker News Reader

Occasions are rare where I get to say "hey, I built a thing that might help here!" - so forgive me as I take this opportunity with both hands.

Whether this was a bug or a rare protective mechanisme, there will be times when your DNS provider makes a mistake and removes records. You mentioned in your post your DNS isn't hard to reproduce, but how certain are you that _all_ records are restored? How long do you have to fight DNS issues before it's OK?

I built DNS Spy [1] for this exact occasion. It monitors your DNS for any changes made, keeps a version of all DNS records (current & former) and allows you to restore/download a BIND9 zone file for your zone. You can easily import this into any commercial DNS provider or in your own BIND9/PowerDNS setup.

I would love to hear feedback on how DNS Spy could be improved when DNS disasters like these occur!

[1] https://dnsspy.io/

View on HN

(OP here). That looks really useful. If I was running a real service I would definitely look into it. Because this is just the personal website and email of a college student I don't think I could justify the expense when using something like Uptime Robot to monitor if a single record points to a web server would probably give me close to the same reliability.

Oh I absolutely agree!

If you're a business, whether it's a SaaS or "just" a marketing website for your brick & mortar store, I think it's crucial to have back-ups. Most people think of backups as files, database dumps, previous versions, etc of their website. But the configuration data (in the form of DNS) isn't often considered.

You're tech-savvy and can restore your DNS records because you know yoru servers' IP address and your MX records, but who else could do the same?

The issue I see with this is that

1) You can't use it after the fact.

2) It's very specialized.

People are not going to set up dozens and dozens of services to monitor for really rare things. It should be part of general purpose monitoring suite.

How do you get all records for domains that don’t allow zone transfer (most don’t)? I’ve always thought it was impossible to get 100% accurate results with normal DNS queries (ex: ALL).

YOU as a customer import them. This is not a DNS spider service like https://dnsdumpster.com/ which also will not be 100% accurate in most cases, but finds a lot more for most domains.

>but how certain are you that _all_ records are restored?

A solution to this is to keep DNS under version control with eg Terraform and deployed by CI. master is then authoritative

Nice! A few years ago I whipped up something simple using dig, diff, cron and some bash scripts. It's handy to get alerted when something changes, and I've definetly caught a few unintentional changes.

Just wanted to point out that the menu doesn't work properly on mobile in case you want to fix it.

https://imgur.com/a/TcibAKs

Looks really useful and fulfills a very important purpose. What good is all your backups if you can't get your services back up due to missing DNS configuration.

DNS Spy costs money? wow the art of sysadmin really is dead. having this kind of tight control of DNS used to be a given.

Just signed up - it's pretty nice. Any plans to add SSHFP or other record types?

Do you use the cloudflare api to get them all? Otherwise you'll miss some

Reply on news.ycombinator.com