Hacker News Reader

Comment by metadat | Hacker News Reader

Magic DNS is a fucking nightmare behind the scenes, I just use raw dog IPs to KISS. The TS app makes it easy to copy to clipboard.

See: https://lobste.rs/s/v4obi8/how_does_tailscale_s_magicdns_wor...

I also set custom hosts file entries for non-mobile devices and kablam, no magic needed (for personal use, anyhow).

View on HN

Behind the scenes they’ve obviously got a lot of crazy to deal with, but it seems to work well from the outside (just using it for Tailscale lookups, at least).

Have you had issues with it otherwise?

EDIT actually I do have one gotcha. There’s a switch in the admin panel to override real dns. In theory if you changed that option and your machines were currently using private dns on route53 to find each other you might be in trouble (don’t ask me how I know).

There is no open-source equivalent implementation available for the PITA that is Magic DNS, so I don't use it. This ensures that if Tailscale goes rogue, I can replace it as easily as possible.

I thought headscale added support for MagicDNS? There's at least one other comment in the thread mentioning this. It didn't always have that support, but it has been added and the gap narrowed.

I’ve just had a look and GitHub and that appears to be the case.

Note, I know nothing about Headscale; I’m happy to pay for Tailscale and support the team behind it.

And I'm just as happy to use it for free, I haven't set up Headscale either as attractive as it sounds to own my own infrastructure when I can have someone else do it for me...

Tailscale is a really great service and it's so easy to teach someone else how to use it, compared to like every other VPN ever!

AFAIK, you could register your nodes in Consul and then use its DNS interface to resolve them.

It’s not DNS

There’s no way it’s DNS

It was DNS

The only thing worst than “It was DNS”, is “It was DNS, but in this rare and weird edge case only so it never showed up when you tried to debug it”…

I mean, I’m impressed by that capability. But I’m horrified by the potential future support implications. Who’d want to be debugging a problem with “magic DNS” at 2am on a Sunday morning while Prod is down and the entire C suite is half drunk, tired and angry, and breathing down your neck?

Sadly almost none of that is complex or surprising if you’re used to dealing with DNS deployments on Linux or BSD. What’s new is bundling a custom system name resolver for machines that can’t forward matching domain requests to specific name servers. Users are often left to their own solutions if they don’t use systemd-resolved or NSS.

Reply on news.ycombinator.com