Upcoming DNS changes

[Guest]

Earlier in this thread we were told

>There are also two op-out servers, at:
>75.101.19.196
>75.101.19.197

but today the link to the wiki page gives us

>Opt-out recursive name servers
>These name servers are recursive only, and do NOT have DNSSEC nor RPZ enabled.
>75.101.19.196 ( optns1.sonic.net ).
>75.101.19.228 ( optns2.sonic.net ).

So is it .197 or .228 ?

[augie]

It's .228 all published documentation should reference that IP address, if you find one that does not, please do let me know.

[Guest]

Since this DNS change means I might be canceling my Sonic account, does anyone have a recommendation for a free DNS server that is not Google?

[augie]

Since this DNS change means I might be canceling my Sonic account, does anyone have a recommendation for a free DNS server that is not Google?

Why would this change make you think of cancelling your account?

OpenDNS looks like they have some free public recursors:

208.67.222.222
208.67.220.220

http://www.opendns.com/home-solutions/p ... -controls/

[Guest]

Why would this change make you think of cancelling your account?

Because, me and anyone else with a Sonic account after March 5th, who lives outside the Sonic Network, will no longer have access to the Sonic DNS servers. For me that means after 12 years, even after moving out of the area and trying to hang onto my Sonic account, one of the few remaining reasons to stay will go away.

OpenDNS looks like they have some free public recursors:

I've heard of OpenDNS before, but always thought they were a nanny DNS company. I'll check them out further.

Thanks for the recommendation.

[augie]

You could VPN in:

https://wiki.sonic.net/wiki/VPN_Service

Which would give you a secure connection to our network no matter where you are.

[Guest]

The issue with using VPN to get DNS is that VPN is slower than my service (50 Mbps), tunnels through my router and will disconnect every 13 hours. Not the best way to have reliable DNS. :)

Never the less, I appreciate the suggestion.

[jon]

Starting Tuesday February 26th we will begin the roll out of several security enhancements to our DNS servers. These changes will be rolled out to our Los Angeles customers, all other customers will be using these updated name servers by March 5th.

So have these DNSSEC and RPZ changes happened in the Bay Area yet? (Doesn't look like it ...)

[augie]

No Jon, not yet, I discovered a problem yesterday as I tried to deploy, I will deploy the new system today.

[jon]

[...] I will deploy the new system today.

OK, thanks, Augie. Please let us know after the main DNS servers are running with DNSSEC and RPZ
so we can switch our configuratons from the test servers back to the main ones.