FreeDNS

Posted by esher 4 days ago

Counter362Comment93OpenOriginal

Comments

Comment by 8organicbits 4 days ago

I've used FreeDNS on occasion for test domain names, one-off experiments, and similar. I'm very appreciative this exists, but there are some pain points that similar services handle better.

The domains are missing from the public suffix list. This impacts how cookies are handled by the domain names, with concerns the browser will allow software to set the cookie on the shared domain name instead of the subdomain. This can be a security problem. Getting added to the PSL may not happen: https://github.com/publicsuffix/list/pull/79

It can be difficult to get a free HTTPS certificate for your subdomain. Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits, but last I checked FreeDNS didn't use it. You can still, of course, pay for a certificate.

There's tons of abuse on free domains so you may find that your domain is blocked on various lists.

Here are some compelling alternatives I use now, which manage these issues better:

- https://messwithdns.net/ - Exceptionally well-made DNS console for learning DNS

- https://open-domains.com/ - Uses Cloudflare, great Discord group

- Even more: https://free.hrsn.dev/#/?id=domains

Comment by turblety 4 days ago

The entire publicsuffix thing is such a mess. The fact that project even exists is ridiculous. Why can this not be a dns setting?

Comment by cortesoft 4 days ago

They should have never allowed cross subdomain access for cookies. Every subdomain should be treated as completely unrelated to all other subdomains.

Comment by mike_d 4 days ago

sigh

See, before the cloud, you used to deploy your code to actual physical servers. If your site became really popular you needed more than one server to run it.

Before commercial and open source load balancers became a thing we literally used HTTP redirects to distribute load. You might visit www.example.com and get redirected to www13.example.com, which was an actual box in a datacenter.

I don't think the internet would exist today if websites just randomly fell over once the number of simultaneous users exceeded the capacity of a single server.

Comment by toast0 4 days ago

When I was at yahoo, we certainly had load balancers, but we didn't have super fancy load balancers that could separate traffic out by path, so each 'property' would use a different hostname (i worked on travel.yahoo.com, which is dead these many years), but we all shared a login cookie (and some other cookies).

We'd have certainly adapted if we couldn't share cookies, but it would have been a lot messier.

Comment by austin-cheney 4 days ago

Why? That looks like a mess. Proxies existed before http, so why not just proxy traffic between your various physical servers to manage load? It’s literally a poor man’s load balancer. It how Travelocity worked way back in the day.

Comment by cortesoft 3 days ago

Then use an http header like we do with CORS or something, which lets a domain set a cookie for another domain that opts in. Or, you can just include the necessary cookie info in the redirect.

Comment by Melatonic 4 days ago

Couldn't you just ghetto load balance by using internal DNS to round robin to a spread of servers with different internal IP ?

Comment by Gabrys1 4 days ago

DNS caching and thus the load distribution is outside the control of the entity running the servers. You assume you get roughly same traffic on each of the published IP addresses, you even think you can advertise some address twice so that it gets twice the load vs other severs (if you just set up a server capable of serving twice the traffic), but the reality is one of these IP addresses might be used for 90% of the requests (as an example) due to caching and bad luck.

So no, you cannot reliably control load balancing using one domain name pointing to multiple IP addresses. (IP anycast is better suited, but much harder to implement)

Comment by 8organicbits 4 days ago

One of the complications that gets discussed is that there are way too many use cases with different requirements on what it means for domains to be related. The cookie problem is something browsers need to solve, so its perhaps reasonable that Mozilla (and volunteers) manage a list that focuses on that user case. But that's poorly suited for other use cases.

There's a lot of people thinking about this though. One somewhat related example is https://datatracker.ietf.org/doc/draft-manelidis-dnsop-domai..., which has a double-opt-in DNS TXT record mechanism. That draft and forthcoming discussions on the mailing list are a good place to understand the complexities here.

Comment by clivedup 4 days ago

If, for example, you could trick a client into thinking "com" was not a public suffix, then from malicious.com you could set cookies on paypal.com

DNSSEC is not widely deployed, and so we cannot rely on the authenticity of DNS.

Maybe if we had DNSSEC, then we could rely on it for publicsuffix. Maybe lots of others things could be more easily solved if we had that too.

DNSSEC automation is coming, e.g. https://www.rfc-editor.org/info/rfc10026/. It might never become mainstream, but don't let anyone tell you that we couldn't benefit from having DNS authenticity!

Comment by bombcar 4 days ago

because, like everything, bad guys would abuse it, causing a list of "bad publicsuffix" to exist, which is basically the same thing.

Comment by quesera 4 days ago

Could we just publish (and cache!) TXT records at the appropriate-level domains? E.g.:

  host -t TXT github.io.
  etld_depth=2

Comment by Vaushite 4 days ago

badguy.com would set the same flag, allowing a.badguy.com, b.badguy.com, c.badguy.com to count as fully independent sites

Comment by quesera 3 days ago

(Vouched so I could reply.)

Why would that be a bad thing? What happens under badguy.com is badguy.com's business, is it not?

Is it any different than setting cookie scoping rules?

Comment by 8organicbits 3 days ago

The cookie use case is just one use case. Another PSL use case is helping browsers decide what part of the FQDN is most important for the user to notice. On firefox I see "ycombinator.com" in bold, with normal font weight on the news subdomain. On smaller screens the URL bar isn't left aligned, it adjusts the view to prioritize showing the relevant domain name. You don't want an attacker to control how the URL is displayed in that security context.

Comment by bombcar 3 days ago

It’s also strongly used by chrome and similar browsers so malware at randomuserdomain.geocities.com doesn’t block the entire root domain.

Comment by Alex13192 4 days ago

Because it can't be. DNS tells you who's authoritative for a name, not who's allowed to be a security boundary — and those are different questions. Whether foo.co.uk is a registrable domain or a subdomain somebody sold you is a registry business decision, and ccTLDs disagree wildly about it. Some sell second-level, some don't, some changed their mind in 2014 and grandfathered everybody. There's no field in DNS that says "the boundary is here, trust me." So the browsers gave up and maintain a text file instead, which is ugly and correct.

The part that bites harder than cookies: PSL is the closest thing the web has to an entity table. If you live on a shared suffix — anything under mooo.com, dyndns.org, the ten thousand other free subdomain hosts — every crawler and every answer engine collapses you into the parent. Your page inherits the reputation of however many hundred thousand strangers happened to register next door. That's why free-subdomain sites are functionally invisible to search and to AI answers regardless of how good the content is. It's not a quality problem, it's a missing identity boundary, and there's no content fix for it.

The whole thread is basically that tradeoff in different clothes. Free DNS, free TLS, free hosting, free subdomain — every one of those gives you something real and quietly puts you in a bucket where nobody can tell you apart from the worst neighbor in it.

Comment by jonathanlydall 4 days ago

In some situations it is most convenient/practical to have your router do dynamic DNS updates and depending on your router the options may be limited giving you no "great" options.

Regarding your valid concerns about the PSL, as long as you have a domain already, you can just make a CNAME record to a free dynamic DNS provider's sub-domain record, I've done this for years with a No-IP ddns.net record. I don't especially recommend No-IP as the 30 day verification is a bit annoying, but at < 1 minute of work per month, it's tolerable for a free service and $2.50 a month is an order of magnitude more than what I feel a single dynamic DNS record is worth.

Since I moved to having a pfSense box at home, I'm using Cloudflare for dynamic DNS, no extra fee and works perfectly, but like I said above, probably not available on typical home routers without a regular machine behind the router having to poll your IP to detect needed updates of a dynamic DNS record.

As I was on Namecheap, I was initially going to use their dynamic DNS option, but it turns out it's behind a higher fee to enable full API access to administering your domain, totally stupid, but with their having been bought out by the PE entity I wouldn't want to stay with them anyway.

Comment by brian_cunnie 4 days ago

> Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits.

I'm familiar with the process to lift those limits, and Let's Encrypt has been amenable to bumping the certs as high as 250,000 but balked at 500,000, saying, "This is too large for us to support"

(I run a DNS service nip.io / sslip.io, and lots of my users request certs, so I'm always bumping into the limits)

Comment by 8organicbits 3 days ago

I remember seeing a request to add nip.io to the PSL (they don't approve requests where the subdomains are IP addresses). What do you think the future of these sorts of services are now that Let's Encrypt offers free IP certificates?

Comment by brian_cunnie 3 days ago

I hope IP-based certificates will ease the pressure on nip.io/sslip.io.

I also hope I get fewer takedown requests. I currently get ~25 takedown requests every week (phishing, copyrighted material, illegal drug sales, unauthorized mirrors, command & control servers).

Comment by 99harry 3 days ago

This is usefull, many thanks! Im building Keenrig, a self-shoting opensource app that gives users subdomains for their app, and your comment made me take another look at this. because some cookie issue . I'm moving user apps off my main domain (keenrig.com) onto a separate one - keenrig.app. the main reason is isolation: an app on a user subdomain shouldn't be able to set cookies for my console, or for other user'apps. many thanks

Comment by Melatonic 4 days ago

Doesn't Hurricane Electric do FreeDNS ? Haven't tested it but I assume with all their peering agreements they have decent latency

Comment by levicanskij 4 days ago

True. To get a free HTTPS certificate is a really difficult challenge, I think :)

Comment by hattmall 4 days ago

This is one of the most solid and longest lasting services online. Have been using it for almost two decades I think and nothing's changed.

Comment by mynameisash 4 days ago

> and nothing's changed

One thing has changed. At some point, they introduced the 'shared management queue', and any random person can attach a subdomain to my domains, and apparently I have to explicitly deny these. Until then, scammers can create a subdomain on my domain, point it to whatever IP they want, and use it for their nefarious purposes.

I get that I'm a freeloader: I haven't paid for FreeDNS, so I can't complain much. But this seems like a terrible 'feature'. If I were a pro subscriber, my domains would be private and therefore not available for scammers to use. I've migrated all but one of my domains away from the service (they were all trivially easy - just haven't finished the last one).

Comment by wowczarek 4 days ago

20+-year long user here, not an issue once. Josh replied to emails then and replies today still. Let's just hope there's someone to continue should something happen to him (chosen diety forbid).

Comment by tech_army 4 days ago

[flagged]

Comment by itsamario 4 days ago

Why dns is a topic eludes me because they all forward to root hint servers.

Why doesn't everyone just use their IANA resolvers?

Comment by kijeda 4 days ago

You're conflating two different concepts: DNS hosting, and DNS resolving.

This service seems to offer hosting services, i.e. publishing your domain's records in the DNS in DNS authoritative servers.

A DNS resolution service looks up and maintains large caches of DNS data on your behalf, optimizing DNS lookups by not requiring your own device to recursively query many different DNS servers. These lookups start by querying the DNS root zone, which is published by the DNS's authoritative servers which are listed in the root hints file.

Comment by dizhn 4 days ago

This service and similar ones live on because a lot of routers support setting your dynamic IP to a dns name by using these services. The services are incredibly simple but finding a service that your server actually supports is a gamble.

Comment by denkmoon 4 days ago

Set your system’s resolver to the iana roots and see what happens

Comment by Vaushite 4 days ago

[dead]

Comment by tylerius 4 days ago

Their backup DNS service is great, so you can run your own DNS with just one server.

https://nic.eu.org/ is also very cool for getting a domain name if paying for one is a challenge.

Comment by upcoming-sesame 4 days ago

https://nic.eu.org is very nice but I haven't been able to register a domain there for a long time now

Comment by IgorPartola 4 days ago

This looks so much like https://dns.he.net/ that it seems to me it can’t be a coincidence. Is this a case of copying a well known design or is there more to it?

Comment by garaetjjte 4 days ago

It's possible they are both descendants from XName: https://web.archive.org/web/20120625081138/http://source.xna...

Comment by cbg0 4 days ago

The "portal" layout style was very popular on Web 1.0, reminds me of PHP-Nuke.

Comment by makmanalp 4 days ago

omg, invoking php-nuke brings me back. fun era (recent php2shell wild ride notwithstanding). Honestly it's more like web 1.5 - not straight up hand written html but no wild client side stuff either.

And yes, there absolutely was a "look" that's a product of the technology of the time - tables for design, limited styling / js support, php "components" that you could load and replace as part of your portal, and "themes".

Comment by baq 4 days ago

and it's so fast. clicks respond instantaneously even though the whole page has to be fetched and re-rendered.

we lost so much with SPAs and js everywhere.

htmx will save us!

Comment by dizhn 4 days ago

That's how gitea/forgejo feel. Most pages don't do ajax but it's still super fast.

Comment by brnt 4 days ago

> PHP-Nuke

There's a name I haven't heard in a while!

Comment by muppetman 4 days ago

My online diary started with PHP-Nuke. Then went to PostNuke for many years. Then to Drupal, where it still is. 26 years of content hehe. (Wish I’d picked Wordpress instead of Drupal but too many links to change now)

Comment by reneberlin 4 days ago

Thank you - flashback achieved!

Comment by jstanley 4 days ago

Doesn't look that similar to me, they both just look a bit old.

Comment by srik 4 days ago

I wouldn't think much of it. It was a popular design trend for a while there; some just never updated. I don't blame them, it's fairly decent on readability and minimalism.

Comment by Melatonic 4 days ago

Both are probably just old and reliable

Comment by Implicated 4 days ago

I literally launched my development and web career on the back of this service as a broke early-20s person. Just seeing that link on HN gave me goosebumps. <3

Comment by dizhn 4 days ago

Mine was when I noticed some pages on the internet were somehow dynamic. Like they could respond to outside stimuli somehow. I have seen a bunch but dslforums was the one that actually mentioned what they were using. It was PHP of course and right around the same time VA Linux was offering free PHP hosting (with shell?). I didn't become much of a programmer but I did do web programming "professionally" for a time.

Comment by baq 4 days ago

Happy freeloader for something like 15 years, can recommend

Comment by tracker1 4 days ago

I have a couple domains (notably BBS.io) with them for people to use as ddns sub domains. Pretty happy overall.

Comment by amelius 4 days ago

I am interested, but I have some questions that don't seem to be addressed in the about us page:

How well is continuation guaranteed?

What if someone buys them? Or the maintainer stops for whatever reason?

Comment by gertop 4 days ago

afraid.org has been there offering free DNS hosting since the year 2000, 26 years

Whilst it would be nice to know their contingency and continuity plans, I feel like their history is a better indicator of the future than just a bunch of feel-good words that you'd likely find a way to interpret pesssimisticly anyway.

Comment by jrmg 4 days ago

An answer to "what happens if the administrator of this dies?" doesn't require feel-good words to answer clearly.

Comment by amelius 4 days ago

I'm super grateful for free projects, but people gotta understand that depending on the type of project users still need some kind of guarantees before they can invest time in them. And this has nothing to do with "being pessimistic". And if maintainers can give good answers to such questions, then this will only make their project stronger and everybody more happy.

Comment by Wolfbeta 4 days ago

"gotta understand", "free projects", "need some kind of guarantees", "'invest' time", "give good answers".

Do you hear yourself?

Comment by bombcar 4 days ago

It's more amazing that they don't realize that anything given or guaranteed wouldn't be worth anything, anyway.

Comment by amelius 4 days ago

Please explain what you mean in full sentences. Thank you.

Comment by b3lvedere 4 days ago

“I'm super grateful for free projects, but”

No but. Be grateful. Do not ever expect some form of guarantee, continuity or support.

That’s it.

Comment by amelius 4 days ago

What nonsense. Can't I have questions before using something offered to me? Trade-offs are everywhere even with free things.

And this whole attempt at making someone with legitimate questions look bad ... sorry but it's ridiculous.

Comment by simoncion 4 days ago

The operators of this gratis, ~quarter-century-old service are doing just fine without bothering to please users like yourself. You're unhappy with it, but they've clearly made the right choice.

> And this whole attempt at making someone with legitimate questions look bad...

No one here is assisting with that; it's all you.

Comment by jrmg 4 days ago

I agree with you - but this project also offers pay-for services.

https://freedns.afraid.org/pricing/

[Edit: actually, I think I misread your comment! I guess this is extra context for the people arguing that expecting some sort of contingency planning is unfair].

Comment by Vaushite 4 days ago

[dead]

Comment by nullsanity 4 days ago

[dead]

Comment by assimpleaspossi 4 days ago

Can someone explain how and why and when this would be used?

Comment by electrotype 4 days ago

I use one of their "dynamic domain" as a stable address to point to my home computer : example.mooo.com instead of using the IP. They provide an endpoint for a cron to update this IP each X time.

Comment by winrid 4 days ago

This! I was using this in like middle school in 2006 or so to run my sites. Cool to see it still works.

Comment by temp0826 4 days ago

I guess it could be seen as a relic considering most registrars/cdns/hosts are a "full package" now. In the days of old that wasn't exactly the case; where you bought your domain name, where you controlled your dns, and where your systems lived could all be different entities. Nowadays there are still reasons to do so...more control and less centralization are some. Not everyone wants to be under the thumb of the Amazons/Googles/Cloudflares.

Comment by assimpleaspossi 4 days ago

This is what I thought from long ago but wasn't sure. Thanks

Comment by doublerabbit 4 days ago

When you want to host your own nameserver but to lazy to configure it on your colocated server. Yet you have requirements that require a nameserver.

I've been paying customer for years. Branded nameservers are great, the web ui is janky and dated but seriously robust.

Support is lacking as for a while afraid.org has had an SSL cert error, very annoying.

Comment by mistrial9 4 days ago

similarly, someone please explain why a free citizen would voluntarily use a Google DNS service that builds profiles and extensive activity records on its users

Comment by TheSkyHasEyes 4 days ago

Is this meant to be snarky? I don't get it. To them, it is a sincere question.

Comment by rlonstein 4 days ago

One of the 5,000+ premium members. I've been using them as a secondary and for dynamic dns since... I have no idea for how long but much further back than 2015 when I started using a password manager that keeps history, probably circa 2005.

Comment by kemotep 4 days ago

So to get this straight this is just hosted DNS? Like Route53? They aren’t a registrar or anything?

So you could pay for hosted DNS and then use them as the name server and other DNS records for multiple domains that you have?

Comment by xianwen 4 days ago

It is like Route53. However, you cannot buy domain names from FreeDNS.

You can use FreeDNS as a name server and manage domain name records, like A records, cname, and MX records. You can have a dynamic domain name too.

You can also obtain free sub domain names from those who use FreeDNS as the name server and offer free sub domain names.

Comment by kemotep 4 days ago

I will definitely keep them in mind. Thanks!

Comment by dizhn 4 days ago

You set your home modem IP to something and use the embedded form on the router or a little curl call to keep it up to date. Nobody is doing commercial hosting on these services.

Comment by esher 4 days ago

I am a free tier sucker. I use it for testing DNS setups with our hosting platform. But I love it. Maybe some exposure helps to bring some paying customers.

Comment by 4 days ago

Comment by zulux 4 days ago

This is awesome. I'll use them as a backup DNS service; the paid version is significantly cheaper than spinning up a new domain server with the cheapest provider I know.

Not to downplay my own skills, but their OpenBSD infrastructure is a good idea. They'll be up when my DNS servers are down.

Comment by CUViper 4 days ago

Isn't it FreeBSD?

Comment by thatonehack 4 days ago

Yes.

Comment by pavinjoseph 4 days ago

Every once in a while, HN surfaces absolute gems like this. Bookmarked and thanks to esher!

Comment by frrlpp 4 days ago

Johsh is a great sysadmin.

Comment by MetroWind 2 days ago

If I knew self-hosting BIND was that easy I wouldn't have used FreeDNS.

Comment by geoffbp 4 days ago

> Members: 7,161,633 > Premium: 5,594 > Records: 13,834,581 > Zones: 1,276,010

That’s pretty cool.

Comment by Velocifyer 4 days ago

If you're having trouble connecting, turn off your proxy/VPN.

Comment by aleks_me2 4 days ago

I like desec.io for there api and also fast response and friendly Team

Comment by xyst 3 days ago

I have vague memories of picking the most vile sounding free dns suffix, redirecting it to my geocities/angelfire site, and giving it to friends and family :)

Comment by iririririr 4 days ago

Thanks for reminding me of yet another PHP based project I forgot to monitor during the last week

Comment by yukinakazawa 4 days ago

[flagged]

Comment by CreepyHunterX 4 days ago

[dead]

Comment by ReDress 4 days ago

[dead]

Comment by 4 days ago

Comment by rvz 4 days ago

Site has been hugged to death.

Free services are never free. It is only free because someone else is paying.

I don’t use this but “hoping” that someone else will donate is not sustainable for them and unrealistic in the long term.

Maybe they should start charging.

Comment by teddyh 4 days ago

> Free services are never free. It is only free because someone else is paying.

That’s what “free” means. Otherwise, nothing is “free” except maybe sunlight.

Comment by assimpleaspossi 4 days ago

Well, they've been around for 14 years. And they do charge for some services.

Comment by ibejoeb 4 days ago

Looks like they've been around for 25 years.

Comment by rvz 4 days ago

Exactly. Because someone else is paying. It was never "free" and there is always a cost.

They still need to pay for the servers and bandwidth and fight the abuse by malicious users using the service for bad intentions.

Comment by notpushkin 4 days ago

I don’t understand your complaint. There is a free tier, and there is a paid tier which hopefully helps maintain it. What’s the problem?