Recursive DNS server blockage on 22 Oct

[mross]

From Friday's MOTD:

On the morning of Tuesday the 22nd, we will block all access to our
recursive DNS servers from off of our network. This will help reduce the
use of our DNS servers as part of the ongoing DNS Amplification Attacks as
well as protect their quality of service for all of our customers. This
will, however, cause issues for any roaming device that has our DNS servers
hard coded. These devices should be configured to use server assigned DNS
settings instead. For more information please see our forums.

Here we are in the forums, and I don't see more information, so I'll just start something...

There was much confusion back in February re the closing of the new DNSSEC servers to the outside, with some backtracking on SONIC's part. What is this new blocking about?

I have a very very old account here, which I kept for a variety of [good] reasons when I moved to Canada almost 15 years ago. I use ns1 and ns2 as my primary DNS servers from Canada, where I connect through Bell and Rogers (translate: the Canadian AT&T & Verizon). For my own peace of mind, I do not wish to use their DNS, as they mess with it heavily.

Does this mean I am out of luck on Tuesday the 22nd? What are my options here, other than VPN? Am I assuming correctly that once connected to Sonic via VPN, I am considered "on network"?

[thulsa_doom]

As of the 22nd, only requests from inside our network (including from our VPN concentrator) will be honored. Open recursive servers are a juicy target for network attacks, and are increasingly difficult to justify.

[dane]

@mross, you asked about your options. You could use the DNS servers provided by Rodgers, or public DNS servers like OpenDNS at:

208.67.222.222
208.67.220.220

... or Google's:

4.4.4.4
8.8.4.4

for example.

[dscycler]

Was the announced change to the Sonic dns servers actually made? Usually when maintenance is announced as scheduled there is an update saying that the maintenance was successful or delayed, etc. I have not seen any feedback regards the dns server change.

[mross]

Yes it happened. >:/

[raillard]

... or Google's:

4.4.4.4
8.8.4.4

for example.

First one should be 8.8.8.8 instead of 4.4.4.4, to make your example accurate. Sorry to see Sonic off-network DNS go, but at least this time there was no mysterious malware-like error webpage to puzzle and disturb my clients.

-- Hans

[aw]

I found out about it when my SIP phones, configured to do server lookups via SRV records, started trying to register to Sonic's DNS blocked page

[kgc]

That was only in for a few minutes immediately after the change was made - it wasn't our intent to captive portal anyone.