sslip.io

The sslip.io DNS server has the following characteristics:

• Protocols: Binds to both UDP and TCP.
• SOA Records: The SOA record is hard-coded except for the _MNAME (primary master name server) record, which is set to the queried hostname (e.g., dig big.apple.com @ns.sslip.io returns an SOA with _MNAME of big.apple.com.).
• MX Records: Hard-coded to the queried hostname with a preference of 0, except for sslip.io itself, which uses custom MX records for ProtonMail compatibility.
• SRV Records: No SRV records are provided.

The DigitalOcean images may not always include the latest Fedora release. To upgrade the system manually, use the following sequence:

1. Refresh and upgrade current packages.
2. Reboot.
3. Download the new release version.
4. Reboot into the new release.

sudo dnf upgrade --refresh
sudo reboot
sudo dnf system-upgrade download --releasever=44
sudo dnf system-upgrade reboot

To use this Terraform configuration, you must obtain OVH API credentials. This involves creating an application and generating a consumer key.

1. Log into the OVH API console.
2. Create an application and record the Application Key and Application Secret.
3. Generate a Consumer Key using curl. Note that consumer keys have a maximum lifetime of 30 days.
4. Authorize the key by visiting the validationUrl provided in the curl response, then save the consumerKey.

curl -s -X POST https://api.us.ovhcloud.com/1.0/auth/credential \
  -H "Content-Type: application/json" \
  -H "X-Ovh-Application: dmUzEgjQwBIfJbUf" \
  -d '{"accessRules":[{"method":"GET","path":"/*"},{"method":"PUT","path":"/*"},{"method":"POST","path":"/*"},{"method":"DELETE","path":"/*"}]}' \
  | jq .

To extract logs from a system running the sslip.io-dns service (e.g., on a server named ns-ovh), use journalctl. You can filter by the service unit and a time window (e.g., starting from yesterday) and redirect the output to a file for analysis.

sudo journalctl -u sslip.io-dns -S yesterday > /tmp/sslip.io.log

If you need to trigger a fresh reinstall of the dedicated server, use the taint command on the reinstall task resource before running apply.

tofu taint ovh_dedicated_server_reinstall_task.server_reinstall
tofu apply

The easiest way to deploy the nameserver is via the official Docker image cunnie/sslip.io-dns-server. The image is multi-platform, supporting x86_64 and ARM64 (including Apple M1/M2 and AWS Graviton).

Basic Run

docker run -it --rm -p 53:53/udp cunnie/sslip.io-dns-server

Troubleshooting Port 53 Conflicts

If you encounter the error Error starting userland proxy: listen udp4 0.0.0.0:53: bind: address already in use, you must stop the systemd resolver:

sudo systemctl stop systemd-resolved

Advanced Configuration Example

To run the server as a specific workstation (e.g., melkor.nono.io) with specific IP addresses:

docker run -it --rm -p 53:53/udp cunnie/sslip.io-dns-server \
    -nameservers melkor.nono.io \
    -addresses melkor.nono.io=10.9.9.30,melkor.nono.io=2601:645:8103:e3a0:1cc4:a4c5:33cb:d068

You can create a custom, non-recursive DNS environment (useful for air-gapped networks) by overriding the default NS and A/AAAA records using the -nameservers, -addresses, and -ptr-domain flags.

Example Scenario: To make xip.pivotal.io resolve using two specific servers (ns-ip-0.pivotal.io at 10.8.8.8 and ns-ip-1.pivotal.io at fc88::), run:

go run main.go \
  -nameservers=ns-ip-0.pivotal.io,ns-ip-1.pivotal.io \
  -addresses ns-ip-0.pivotal.io=10.8.8.8,ns-ip-1.pivotal.io=fc88:: \
  -ptr-domain=xip.pivotal.io

Warning: These nameservers are not recursive. They will not resolve general internet domains like google.com. Do not configure general-purpose machines to use these as their primary DNS.

Note: For this to work, you must first delegate the subdomain (e.g., xip.pivotal.io) to these nameservers in your existing DNS infrastructure.

To provision the Hetzner Hillsboro Nameserver using OpenTofu, you must first provide your Hetzner Cloud token via the TF_VAR_hcloud_token environment variable. Then, initialize the configuration and apply it with auto-approval to create the infrastructure.

export TF_VAR_hcloud_token=YOUR_TOKEN_HERE

tofu init
tofu apply -auto-approve

Set the following environment variables to provide your OVH credentials to the Terraform/OpenTofu configuration:

• TF_VAR_ovh_application_key: Your OVH Application Key.
• TF_VAR_ovh_application_secret: Your OVH Application Secret.
• TF_VAR_ovh_consumer_key: Your OVH Consumer Key.

export TF_VAR_ovh_application_key=dmUzEgjQwBIfJbUf
export TF_VAR_ovh_application_secret=YOUR_APPLICATION_SECRET
export TF_VAR_ovh_consumer_key=YOUR_CONSUMER_KEY

To run a local instance of the sslip.io DNS server using Go, follow these steps. Note that on Linux, sudo is required to bind to the privileged port 53, whereas it is not required on macOS.

1. Clone the repository and enter the directory.
2. Tidy the Go modules.
3. Run the server using go run main.go with sudo (on Linux).
4. Verify the installation by performing a DNS lookup using dig.

git clone https://github.com/cunnie/sslip.io.git
cd sslip.io
go mod tidy
sudo go run main.go

# In another terminal, verify the lookup
dig @localhost 192.168.0.1.sslip.io +short
# Should return "192.168.0.1"