content/blog/2022-06-01-ditching-cloudflare.org

 1#+date:        <2022-06-01 Wed 00:00:00>
 2#+title:       Transition from Cloudflare to Njalla for DNS Management and Domain Registration
 3#+description: Evaluation and procedural explanation for migrating DNS management services from Cloudflare to Njalla, with emphasis on privacy controls and domain registration mechanics.
 4#+slug:        ditching-cloudflare
 5#+filetags:    :dns:registrar:privacy:
 6
 7* Registrar
 8
 9After spending a year or so using Cloudflare for DNS only - no proxying
10or applications - I spent the last few months using Cloudflare Tunnels
11and Cloudflare Access to protect my self-hosted websites and
12applications via their proxy traffic model.
13
14However, I have never liked using Cloudflare due to their increasingly
15large share of control over web traffic, as well as their business model
16of being a MITM for all of your traffic.
17
18So, as of today, I have switched over to [[https://njal.la][Njalla]] as
19my registrar and DNS manager. I was able to easily transfer my domains
20over rapidly, with only one domain taking more than 15-30 minutes to
21propagate.
22
23+I do still have two domains sitting at Cloudflare for the moment while
24I decide if they're worth the higher rates (one domain is 30€ and the
25other is 45€).+
26
27#+begin_quote
28*Update (2022.06.03)*: I ended up transferring my final two domains over
29to Njalla, clearing my Cloudflare account of personal data, and deleting
30the Cloudflare account entirely. /I actually feel relieved to have moved
31on to a provider I trust./
32#+end_quote
33
34* DNS
35
36As noted above, I'm using Njalla exclusively for DNS configurations on
37my domains.
38
39However, the transfer process was not ideal. As soon as the domains
40transferred over, I switched the nameservers from Cloudflare to Njalla
41and lost most of the associated DNS records. So, the majority of the
42time spent during the migration was simply re-typing all the DNS records
43back in one-by-one.
44
45This would be much simpler if I were able to edit the plain-text format
46of the DNS configuration. I was able to do that at a past registrar
47(perhaps it was [[https://gandi.net/][Gandi.net]]?) and it made life a
48lot easier.
49
50** Dynamic DNS Updates
51
52I have built an easy Python script to run (or set-up in =cron= to run
53automatically) that will check my server's IPv4 and IPv6, compare it to
54Njalla, and update the DNS records if they don't match. You can see the
55full script and process in my other post: [[../njalla-dns-api/][Updating
56Dynamic DNS with Njalla API]].
57
58I haven't used this other method, but I do know that you can create
59=Dynamic= DNS records with Njalla that
60[[https://njal.la/docs/ddns/][work for updating dynamic subdomains]].
61
62** Njalla's DNS Tool
63
64One neat upside to Njalla is that they have a
65[[https://check.njal.la/dns/][DNS lookup tool]] that provides a lot of
66great information for those of you (AKA: me) who hate using the =dig=
67command.
68
69This was very useful for monitoring a couple of my transferred domains
70to see when the changes in nameservers, records, and DNSSEC went into
71effect.
72
73* Tunnel
74
75Cloudflare Tunnel is a service that acts as a reverse-proxy (hosted on
76Cloudflare's servers) and allowed me to mask the private IP address of
77the server hosting my various websites and apps.
78
79However, as I was moving away from Cloudflare, I was not able to find a
80suitable replacement that was both inexpensive and simple. So, I simply
81went back to hosting [[https://cleberg.net/blog/set-up-nginx-reverse-proxy/][my own
82reverse proxy with Nginx]]. With the recent additions of Unifi hardware
83in my server/network rack, I am much more protected against spam and
84malicious attacks at the network edge than I was before I switched to
85Cloudflare.
86
87* Access
88
89Cloudflare Access, another app I used in combination with Cloudflare
90Tunnel, provided an authentication screen that required you to enter
91valid credentials before Cloudflare would forward you to the actual
92website or app (if the website/app has their own authentication, you'd
93then have to authenticate a second time).
94
95I did not replace this service with anything since I only host a handful
96of non-sensitive apps that don't require duplicate authentication.