PhilippTheServer

dns

Resolution, wildcards, split horizons, and the failures that return success.

  1. Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy

    Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2.

    networking dns security docker

  2. Probing the Names You Publish, Not the Services You Run

    blackbox_exporter __param_target relabel_configs: probe the published hostname to catch DNS, TLS expiry and proxy errors that /healthz cannot see.

    observability dns

  3. DNS Wildcards and Empty Non-Terminals: The Answer That Is Not an Error

    A stale _acme-challenge TXT record makes a DNS wildcard return NODATA or NXDOMAIN: RFC 4592 closest encloser, empty non-terminals and a zone check.

    dns tls testing

  4. Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough

    NetBird mesh hostnames resolve to the public host via a zone wildcard when the mesh resolver is down. Fix: a *.mesh blackhole record and accept-new.

    networking dns security linux

  5. ndots and the Accidental Search-Domain Leak in Pod DNS

    dnsConfig.searches with ndots:5 lets an internal wildcard answer external names. Why ndots:1 only half fixes it and a trailing dot fully does.

    kubernetes dns networking

  6. A DNS Canary CronJob as a Regression Test for Split-Horizon Resolution

    CoreDNS Corefile rewrite regressions caught by a busybox nslookup CronJob that checks internal, external and NXDOMAIN names and fails the Job.

    kubernetes dns observability testing

  7. Managing a Shared DNS Zone Through a Replace-Everything API

    PUT /zone replaces the whole DNS zone: a read-merge-write client with owner TXT records that keeps unmanaged records and removes stale managed ones.

    dns automation infrastructure-as-code api-design

All topics · All writing