Comment by 8organicbits
16 hours ago
I've used FreeDNS on occasion for test domain names, one-off experiments, and similar. I'm very appreciative this exists, but there are some pain points that similar services handle better.
The domains are missing from the public suffix list. This impacts how cookies are handled by the domain names, with concerns the browser will allow software to set the cookie on the shared domain name instead of the subdomain. This can be a security problem. Getting added to the PSL may not happen: https://github.com/publicsuffix/list/pull/79
It can be difficult to get a free HTTPS certificate for your subdomain. Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits, but last I checked FreeDNS didn't use it. You can still, of course, pay for a certificate.
There's tons of abuse on free domains so you may find that your domain is blocked on various lists.
Here are some compelling alternatives I use now, which manage these issues better:
- https://messwithdns.net/ - Exceptionally well-made DNS console for learning DNS
- https://open-domains.com/ - Uses Cloudflare, great Discord group
- Even more: https://free.hrsn.dev/#/?id=domains
In some situations it is most convenient/practical to have your router do dynamic DNS updates and depending on your router the options may be limited giving you no "great" options.
Regarding your valid concerns about the PSL, as long as you have a domain already, you can just make a CNAME record to a free dynamic DNS provider's sub-domain record, I've done this for years with a No-IP ddns.net record. I don't especially recommend No-IP as the 30 day verification is a bit annoying, but at < 1 minute of work per month, it's tolerable for a free service and $2.50 a month is an order of magnitude more than what I feel a single dynamic DNS record is worth.
Since I moved to having a pfSense box at home, I'm using Cloudflare for dynamic DNS, no extra fee and works perfectly, but like I said above, probably not available on typical home routers without a regular machine behind the router having to poll your IP to detect needed updates of a dynamic DNS record.
As I was on Namecheap, I was initially going to use their dynamic DNS option, but it turns out it's behind a higher fee to enable full API access to administering your domain, totally stupid, but with their having been bought out by the PE entity I wouldn't want to stay with them anyway.
True. To get a free HTTPS certificate is a really difficult challenge, I think :)
The entire publicsuffix thing is such a mess. The fact that project even exists is ridiculous. Why can this not be a dns setting?
They should have never allowed cross subdomain access for cookies. Every subdomain should be treated as completely unrelated to all other subdomains.
sigh
See, before the cloud, you used to deploy your code to actual physical servers. If your site became really popular you needed more than one server to run it.
Before commercial and open source load balancers became a thing we literally used HTTP redirects to distribute load. You might visit www.example.com and get redirected to www13.example.com, which was an actual box in a datacenter.
I don't think the internet would exist today if websites just randomly fell over once the number of simultaneous users exceeded the capacity of a single server.
3 replies →
One of the complications that gets discussed is that there are way too many use cases with different requirements on what it means for domains to be related. The cookie problem is something browsers need to solve, so its perhaps reasonable that Mozilla (and volunteers) manage a list that focuses on that user case. But that's poorly suited for other use cases.
There's a lot of people thinking about this though. One somewhat related example is https://datatracker.ietf.org/doc/draft-manelidis-dnsop-domai..., which has a double-opt-in DNS TXT record mechanism. That draft and forthcoming discussions on the mailing list are a good place to understand the complexities here.
If, for example, you could trick a client into thinking "com" was not a public suffix, then from malicious.com you could set cookies on paypal.com
DNSSEC is not widely deployed, and so we cannot rely on the authenticity of DNS.
Maybe if we had DNSSEC, then we could rely on it for publicsuffix. Maybe lots of others things could be more easily solved if we had that too.
DNSSEC automation is coming, e.g. https://www.rfc-editor.org/info/rfc10026/. It might never become mainstream, but don't let anyone tell you that we couldn't benefit from having DNS authenticity!
because, like everything, bad guys would abuse it, causing a list of "bad publicsuffix" to exist, which is basically the same thing.
Could we just publish (and cache!) TXT records at the appropriate-level domains? E.g.:
1 reply →
Because it can't be. DNS tells you who's authoritative for a name, not who's allowed to be a security boundary — and those are different questions. Whether foo.co.uk is a registrable domain or a subdomain somebody sold you is a registry business decision, and ccTLDs disagree wildly about it. Some sell second-level, some don't, some changed their mind in 2014 and grandfathered everybody. There's no field in DNS that says "the boundary is here, trust me." So the browsers gave up and maintain a text file instead, which is ugly and correct.
The part that bites harder than cookies: PSL is the closest thing the web has to an entity table. If you live on a shared suffix — anything under mooo.com, dyndns.org, the ten thousand other free subdomain hosts — every crawler and every answer engine collapses you into the parent. Your page inherits the reputation of however many hundred thousand strangers happened to register next door. That's why free-subdomain sites are functionally invisible to search and to AI answers regardless of how good the content is. It's not a quality problem, it's a missing identity boundary, and there's no content fix for it.
The whole thread is basically that tradeoff in different clothes. Free DNS, free TLS, free hosting, free subdomain — every one of those gives you something real and quietly puts you in a bucket where nobody can tell you apart from the worst neighbor in it.
Doesn't Hurricane Electric do FreeDNS ? Haven't tested it but I assume with all their peering agreements they have decent latency
> Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits.
I'm familiar with the process to lift those limits, and Let's Encrypt has been amenable to bumping the certs as high as 250,000 but balked at 500,000, saying, "This is too large for us to support"
(I run a DNS service nip.io / sslip.io, and lots of my users request certs, so I'm always bumping into the limits)