Bilingual

We’re making Bunny DNS free
a month ago
- Bunny DNS is the routing engine behind bunny.net's fast content delivery, handling 200 billion queries monthly and now offered for free with no query fees and free DNS hosting for up to 500 domains per account.
- The service has been enhanced with features like 1-Click Acceleration for CDN, 1-Click Security with Bunny Shield, automatic zone scanning for easier migration, IPv6 support, DNSSEC with NSEC Black Lies, and modern record types (HTTPS, SVCB, TLSA, CDS, CDNSKEY).
- Bunny DNS integrates performance, security, and routing into one platform, aiming to help developers build faster, safer applications without usage-based charges, supporting over 300,000 domains and a $1/month minimum spend.
TLS certificates for internal services done right
12 days ago
- Using split-horizon DNS allows the same domain to resolve to public or private IPs based on client connection.
- Setting up a WAF (e.g., via nginx) blocks traffic from public internet, adding security beyond DNS.
- Automating certificate renewal with acme.sh and cron jobs ensures ongoing TLS without manual intervention.
- Using SAN certificates enables multiple subdomains under one certificate, avoiding wildcard security risks.
What's the story behind the names of Cloudflare's name servers? (2013)
9 days ago
- CloudFlare provides two custom name server domains (e.g., bob.ns.cloudflare.com and lola.ns.cloudflare.com) to new users for DNS setup.
- The naming system (using 101 common names like Bob and Lola) was created to prevent users from guessing sequential server names, ensuring accurate verification of authoritative DNS records during sign-up.
- Initially, 100 names (50 male, 50 female) were used, allowing 2,500 combinations; later, a 101st name ("Woz") was added after inspiration from a ninja drawing resembling Steve Wozniak.
- The name server domains serve for initial verification; afterward, requests are handled by a global, load-balanced infrastructure across 23 data centers, supporting fast and robust DNS services.
- Artistic ninja drawings were commissioned for each name server, adding personality, and early team members and investors were allowed to choose their namesake ninjas.
Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger
7 days ago
- On July 3, 2026, a broken DNSSEC key rollover by the Albanian operator AKEP caused validation failures for the .al TLD, making sites unreachable for validating resolvers like Cloudflare's 1.1.1.1.
- Cloudflare implemented a Negative Trust Anchor (NTA) to temporarily suspend DNSSEC validation and restore resolution, similar to a previous .de incident, but NTAs previously lacked transparency about bypassed validation.
- During the .al incident, 1.1.1.1 introduced a new Extended DNS Error (EDE) code (EDE 33) to signal when an NTA is applied, providing clients with visibility that DNSSEC validation was bypassed.
- The incident highlights that TLD-level DNSSEC failures can affect all domains under that TLD, and EDE 33 helps close the transparency gap by informing users when responses are not DNSSEC-validated.
- The EDE 33 code is part of an Internet-Draft submitted to the IETF DNSOP Working Group, with support from tools like kdig, aiming to standardize disclosure of NTAs in DNS responses.
Cloudflare Internal DNS is now generally available – The Cloudflare Blog
17 hours ago
- Cloudflare Internal DNS, combining authoritative and recursive resolution for private networks, is now generally available on the same global network used for public DNS and Zero Trust services.
- It consolidates public and private DNS into a single platform with one API, audit trail, and policy engine, eliminating the need for separate systems and reducing drift and outages.
- Key features include simplifying split-horizon DNS via DNS Views, extending Zero Trust enforcement to DNS queries, and replacing legacy hardware with Cloudflare's global infrastructure.
- The system handles queries by routing them through Gateway Resolver, which applies Resolver Policies that direct traffic to specific Internal Authoritative DNS views or block queries, with optional fallback to public resolution.
- Changes propagate quickly through a unified write path (API, dashboard, or Terraform), replicating across Cloudflare's network and invalidating caches in seconds.
- Setup involves creating an internal zone, a DNS view, and a Gateway resolver policy, with support for various connectivity methods like Cloudflare One Client, DoH, DoT, and standard DNS.
- Internal DNS integrates with the Cloudflare Connectivity Cloud, enabling consistent resolution across remote users, branches, and clouds, and paving the way for tighter integration between DNS, networking, and Zero Trust policy.

Hasty Briefsbeta

#dns

We’re making Bunny DNS free

TLS certificates for internal services done right

What's the story behind the names of Cloudflare's name servers? (2013)

Another Entry in the "Stuff Im Glad Im Not Responsible for" Ledger

Cloudflare Internal DNS is now generally available – The Cloudflare Blog