Embed Notice

@sahil If you want to see details about who and what is issuing queries for your names, it's a good idea.

If your name(s) are prone to attack, it might be a bad idea unless you partner with a provider who can host and help mitigate large floods.

If your zone(s) don't change very often and have few records, it is relatively easy to setup and run a couple of authoritative name servers, ideally on at least a couple of diverse networks using bind, unbound, or whatever you're comfortable with.

Don't provide answers (recursion) you're not authoritative for.

Don't forget to update your SOA serial every time you make a zone change.

Do run your zone through various zone checking online tools (e.g., zonemaster.fr).

Do use a provider who won't arbitrarily block networks/addresses or source ports.

Don't run anything else on your name server, but maybe just SSH and NTP - and protect those from unsolicted access.

You may not have a need for all their guidance, but see IETF RFCs 2870 ad 9199 for other ideas.