That’s fair. Though you should consider that it’s really easy to set up secondary nameservers as a mirror (ns-global, for example, offers such a service). So your own reliability matters less in the end.
On the other hand, Cloudflare is kind of becoming the internet with all the centralization.
Yup. That’s the main reason I avoid using them.
deciding whom to choose for nameservers
This is tangential to your actual question, but why not host your own? I’ve had good experiences with self-hosting an authoritative nameserver for my domains. I personally use BIND (named), but I know someone who does the same with nsd and that also works very well.
edit: actually, might as well add the reasoning behind my choice of TLD, since it’s pretty simple. It’s a .de domain because I’m in Germany :)
On residential connections, that’s probably the case, yes. I’m hosting it on a VPS though and have had no problems with blocked ports so far. I imagine it depends on the provider?
I’m not too concerned, for example, if they have to check their spam folders. As long as the email still lands.
In that case, it really isn’t that much of a hassle. A basic mail system isn’t that complicated to set up (just make sure you have proper authentication and such, don’t host an open relay!). I actually did this not too long ago, using maddy, which unlike the traditional postfix+dovecot setup (which I had also been looking into) means you don’t even have to host separate services for SMTP and IMAP, and it also automates most additional things that are necessary nowadays for you, like TLS, DKIM, DMARC, and so on. Not quite everything though, there’s still stuff needed to do manually, mostly to set the SPF and DMARC records in the DNS, but it’s been working really well so far.
And really, the only mail provider you have to worry about for putting your mails into spam is gmail. They’re the worst. (maybe microsoft-hosted outlook too, but I haven’t encountered anyone using that)
Interesting, that’s much more sophisticated than my setup (though to be fair, I host my services on a rented VPS instead of home)!
The issue only occurs with my externally-facing DNS, which is needed to, for example, to reach my Lemmy backend instance (lemmy.pootis.network) and the pictrs deployment. But yeah, internal DNS works perfectly for me and it easily survives a node failure.
Could still set up a recursive resolver for external DNS, but I guess that wouldn’t help other people who use a bad resolver. Tricky situation.
But even if I query
1.1.1.1directly formy-website’s record, it just doesn’t work most of the time because the resolver pins itself tons1which is currently failing, or it selectsns1and does not even care to tryns2.
That sounds bad. They really shouldn’t do that.
moving my DNS infra somewhere else (Cloudflare, for example)
And it would also mean this isn’t a solution either. If the problem is on the resolvers’ side, moving to a different DNS hoster would not change anything. Hm. And the other two potential solutions you’ve listed would be extremely overkill for this use case…
Personally, I only host one authoritative nameserver and do redundancy by using some free secondary DNS services (although a friend has also recently set up an authoritative nameserver, so maybe we’ll host secondary DNS for each other in the future). I haven’t encountered this issue before, but my server also hasn’t been down a lot.
There’s a lot of custom machinery that keeps my workloads running and accessible after a node failure, but all of this becomes completely moot when authoritative DNS is the bottleneck.
If it’s only necessary for your own stuff, maybe you should set up a local DNS resolver that works correctly which your services can use?
They should fix their broken resolvers then, that’s not for me to work around. I don’t think it’s actually a big problem in practice though, because