easyDNS Blog

I can recommend https://easydns.com/

EasyDNS has been fantastic. http://www.easydns.com

It's great to see the free, cryptographically secure, and distributed keyval database that under-grids the entire internet being used to make it more secure. It's too bad lazy sys admins claim that it's not needed and spout a bunch of FUD [1] that is not true [2]. [1]: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ [2]: https://easydns.com/blog/2015/08/06/for-dnssec/

It may be just an ad for easyDNS' Proactive Nameservers [1] product but it provides a roadmap for one possible solution to this type of problem. From a quick reading of the marketing info, the solution can be summarized as "Provision, Monitor, and Fail-Over DNS Name Servers across multiple DNS-as-a-Service providers". The question I have is whether the following constraint is artificially introduced or not: > We must be your domain registrar for this to work... IIRC, Netflix OSS published some tools quite some time ago to support multiple DNS providers but I don't know/remember if they tackled the availability problem. The question comes down to build vs buy and whether the solution is general enough to warrant an Open Source Software solution. [1] https://easydns.com/dns/proactive-nameservers/

EasyDNS (https://easydns.com), based in Canada has been around for years, and has a good reputation for not blindly actioning DMCA requests (which can be important for some). :)

I won't say he's wrong, but he presents a very one-sided view. It's worth reading the responses to criticisms like his: https://www.easydns.com/blog/2015/08/06/for-dnssec/

There's a big difference between the right to free speech and the principle of free speech. Easydns has chosen to follow the Non-aggression principle which is a limited free speech moral stance. https://www.easydns.com/terms-of-service https://en.wikipedia.org/wiki/Non-aggression_principle OP simply wants to support those who truly believe in free speech. Not one who, in OPs opinion, has simply crowned themselves as free speech champions until pressured. https://www.google.com/search?q=site%3Aeasydns.com+free+speech

> You never control a domain Then don't use DNS if you can't trust it? You have to trust at some point. Or create your own infrastructure and convince others to trust you, if you want more than a private network. > Anyone who can feed you spoofed DNS responses The tendency goes towards running your own local DNS resolver. It was not possible in the 90s, but since then both the network and computer got a lot faster and smarter. DNSSEC has also evolved quite a bit and is the best we will get for long time. I really encourage to have a look again before dismissing it outright. http://blog.easydns.org/2015/08/06/for-dnssec/

I switched all mine to EasyDNS... a quick scan of their blog gives a good idea of their philosophy: http://blog.easydns.org/

Obligatory responses to tptacek's article: - http://blog.easydns.org/2015/08/06/for-dnssec/ - http://www.circleid.com/posts/20150318_is_dnssec_worth_the_effort/ Collectively thousands of words have been written on this topic within HN - and there are stark divisions between those who oppose DNSSEC and those who believe DNSSEC is a helpful and useful method of adding a layer of security to the Internet. We don't agree. We won't agree. Meanwhile, those of us who want to see DNSSEC more widely deployed applaud this move by CloudFlare because it both makes deployment simpler for many people and also advances the usage of stronger crypto (ECDSA) within DNSSEC. This is great news!

Mad props to Mark Jeftovic and easyDNS. Found his service by doing a WHOIS on ycombinator.com when looking for a new registrar a while back. easyDNS has the cleanest and most logical interface for managing domain names and DNS records that I've found. And Mark's blog posts (like the one above) are great. Here's another favorite: http://blog.easydns.org/2014/01/29/welcome-to-easydns-press-1-for-supp…

I've used nearly every domain registrar out there and here are the ones I'd recommend: http://www.uniregistrar.com (two-factor, free privacy, cayman islands) http://www.easydns.com (two-factor, canadian) http://www.pairnic.com (super lock, requires id to unlock if you enable it) http://www.dyn.com http://www.namebright.com (two-factor) http://www.name.com (two-factor) http://www.gandi.net (two-factor) Security is really important for your name so make sure you go with someone who offers some sort of two-factor or extra security lock.

Had dnsimple failed to do so? Did it help? Because Easydns http://blog.easydns.org/2013/06/04/post-mortem-of-the-june-3-4th-ddos/ said "While most of these typically use open resolvers, it is also now common to use authoritative nameservers in reflection attacks". Can we end the "War on 'Open' Internet (Resolvers)" now? Because I don't think an organized crackdown on "open" authoritative nameservers is in the best interests of our freedom.

JIRA Studio - http://www.atlassian.com/hosted/studio/ BitBucket - http://bitbucket.org/ Salesforce - http://salesforce.com/ Gapps - http://apps.google.com/ ZenDesk - http://zendesk.com/ EasyDNS - http://easydns.com most of these aren't cheap, but through a process of trial and error I found out that they are the best.

Do you have other clients who are in Germany? It appears that you do act as a registrar for .DE domains. At least, entering "ascascdasdcascascascasdcasdc.de" on the search on the front page at https://easydns.com/ offers to register it for me. It's purely a guess on my part, but I'd expect that most people who purchase .DE domains are in Germany, so if you've actually sold a few .DE domains you probably have some German customers. That might not be enough to open you up to having to worry about German law...but it is enough that I would not dismiss that possibility out of hand. PS: your site seems partly broken. I first tried to check for .DE on this page: https://easydns.com/domains/register/ Entering "ascascdasdcascascascasdcasdc.de" on the search there does nothing for me in Firefox. I had uBlock Origin on, so turned it off. Still nothing. Then I switched to Chrome, using a profile with no relevant extensions, and still nothing. So instead I just went to the list below that lists all the TLDs you handle, and went through to find DE. That has a "Special Requirements" link, which doesn't do anything for me in either Firefox or Chrome. PPS: in Firefox's console, it shows these messages for that page that isn't working right: 'Loading failed for the <script> with source “https://matomo.int.easydns.net/piwik.js”." at register:1:1 'unreachable code after return statement' at signup.js:15:1

Sorry, IANAL, so maybe this advice is useless. I just spent a little bit doing some research and discovered that EasyDNS has a history of defending their customers from similar sorts of thuggery[0]. It may be worth your while to research an option like this, i.e. switching your DNS service (and domain registration, if they offer it) to EasyDNS or someone that would be willing to help you defend against sociopaths bent on stealing your domain and brand. It seems like now would be the time to research a more defense-oriented domain registrar and DNS provider that won't simply hand your domain over to the person with the most pull, as No-ip.com learned when Microsoft stole their domain. I can't really help you in this regard, but you will definitely want to transfer your domain to a registrar that doesn't have a history of caving to the first lawyer letter they get, which is probably most of them. Perhaps you may find both a name registrar and a DNS provider that will help you. Good luck! [0] http://blog.easydns.org/2014/08/22/we-are-being-sued-for-refusing-to-t…

>It's just that most clients don't perform local validation due to low adoption. From your link elsewhere, https://easydns.com/blog/2015/08/06/for-dnssec/ >We might see a day when HTTPS key pinning and the preload list is implemented across all major browsers, but we will never see these protections applied in a uniform fashion across all major runtime environments (Node.js, Java, .NET, etc.)[...] Is this not the same flaw?

The UK has been doing this sort of stuff for at least a decade. For example they have the PIPCU which under the guise of copyright threatens 10 years in prison for sites not even in their jurisdiction. https://torrentfreak.com/uk-police-launch-campaign-to-shut-down-torren… And with that, they have at the least gotten registrars not located in their jurisdicrion to transfer domains https://easydns.com/blog/2013/10/08/whatever-happened-to-due-process/

The DNS server doesn't have to return the same responses to every query. It can geolocate the address making the request and use that to determine the respone. https://easydns.com/features/geo-dns/ (Having said that, I tried my toy site on cloudflare free tier from the UK and it gave me San Francisco IPs, so presumably they only do this for large enough customers)

But that's beside the main point. You guys are essentially the "single point of failure" for half the internet. [1] Being competent and smart doesn't really help too much, as demonstrated by how you guys had to give in to the pressure to censor recently. [1]: https://easydns.com/blog/2020/07/20/turns-out-half-the-internet-has-a-…

https://easydns.com/blog/2020/07/20/turns-out-half-the-internet-has-a-… The whole idea of the internet was a distributed network impervious to most attacks. The reality is that a single failure can knock out 90% of the services people use.

easyDNS used to take BCH but dropped it. https://easydns.com/blog/2019/01/29/bitcoin-cash-is-out-litecoin-is-in…

> We call it Proactive Nameservers, and we’re the only company in the world doing it for some reason. Wait, why? [0]: > Proactive Nameservers is a patent-pending system that optimizes the nameserver delegation for your mission critical domain names. Oh. [0] https://easydns.com/dns/proactive-nameservers/

Regarding outdated crypto, that’s a common DNSSEC trope that’s been debunked: https://easydns.com/blog/2015/08/06/for-dnssec/#weak

With how tongue-in-cheek the whole document is, this is clearly a joke to emphasize their point (which, I agree, has no place in a legal document, no matter how plain). My point is that everything else in the document is pretty much industry standard, except that others are less...direct about it. https://easydns.com/terms-of-service

In an earlier post (https://www.easydns.com/blog/2017/09/06/why-does-easydns-provide-servi… supporting free expression, EasyDNS says that they will only refuse service to sites that advocate or encourage "physical violence or harm toward an identifiable minority." I have never been to the DailyStormer site, so I don't know if they meet that criteria. If they don't, EasyDNS, while well within their rights, is not living up to their own standards.

> Then don't use DNS if you can't trust it? Same with CAs, but I believe it's easier to distrust a rogue CA than a rogue name registry. I mean, if there's a news that some .example TLD is in bed with NSA, Chinese government and Russian FSB - there isn't much we can do about that, isn't it? And I guess most businesses won't go as far as changing their domain name. At the same time, on most devices I saw, distrusting a CA wasn't terribly complicated. And can be done by a browser or OS vendor, with a version upgrade, as well. > http://blog.easydns.org/2015/08/06/for-dnssec/ Thanks for the link. Looks like an interesting reading.

The DHS seems to have seized non-US domains in the past on disputed legal grounds.[1] I'm not completely sure, but I'd think a transfer to a non-US entity would make this harder in the future. [1] http://blog.easydns.org/2012/02/29/verisign-seizes-com-domain-register…

EasyDNS provides integration with AWS: http://easyroute53.com/ They have an interesting blog post about setting up secondary DNS: http://blog.easydns.org/2013/09/10/what-we-are-doing-about-chronic-ddo… I have no affiliation with them, just a happy customer.

They're .com addresses, supposedly the court can get Verisign to pull them. http://blog.easydns.org/2012/02/29/verisign-seizes-com-domain-register…