which is why DNS-based isn't as recommended