1. 1 Distributed DNS best practices to build redundant, reliable & scalable DNS architecture By Ladislav Vobr SE/SOP/I&eS Etisalat, UAE

2. 2 Outline Introduction Different DNS roles Best Practices / Recommendations Increasing the availability L4-7 switching / Anycast Latest DNS Features/Trends Service Monitoring Conclusion

3. 3 Introduction What is DNS –Provides mapping between easy-to-remember names and Internet resources using IP addresses DNS & Internet –Without DNS today’s internet will be in chaos, no-one will remember any resource. Many times overlooked but in fact one of the most important tcp/ip service. The Importance of DNS Service –many organizations mainly e-commerce oriented make sure their web or payment infrastructure is highly available and they invest a lot to achieve that, but they miss out the importance of their name servers, which are in fact the door to their services

4. 4 Different DNS roles Authoritative/Content/Non-recursive Servers - advertise information only about the domain they “own” (root servers, cctld servers….) Caching/Recursive Servers - Provides general lookup and caching services The Root Servers gTLD, ccTLD 3 rd,4 th … level

5. 5 DNS Best Practices Separate your servers geographically Separate the server functionality Restrict Access to your services Keep latest os, dns versions Use well defined timers (TTL,SOA) Use consistent & up-to-date NS records Restrict Zone Transfers Monitoring / Logging

6. 6 Scaling performance / Availability the biggest engineering problem of the Internet today is “scaling” 6 is not 6,000 and is not 6,000,000 and not 6,000,000,000,000,000 Authoritative/ Content only servers (Non-Recursive) -Rfc 1034/1035 - build it mechanism using RTT & NS records Caching Services (Recursive Servers) -Scaling vertically - brings huge cost & doesn’t improve availability -Scaling horizontally – reduce the cost, but needs some configuration a)L4-7 switches (complicated, requires hw, more features) b)ANYCAST (simple / simple balancing) c)Cluster (one active / one standby ) doesn’t increase the performance

7. 7 L4-7 switching Better l4-7 filtering Better load distribution Geographical failover not standardized Complicated management Another point of failure

8. 8 L4-7 Example Virtual IP address A Virtual IP address B

9. 9 Anycast Clusters service is distributed in various locations, but users sees it as a single resource Simple idea Using standard routing protocols Simple load balancing only Traditional troubleshooting No additional hardware required

10. 10 OSPF Area #1 OSPF Area #2 Anycast Example the service can be distributed among several networks, datacenters, countries, continents All servers advertises 213.42.20.20 as a interface directly connected to them. IGP protocol ensure traffic distribution Loopback lo0:1 IP: 213.42.20.20 Running DNS service Loopback lo0:1 IP: 213.42.20.20 Running DNS service Loopback lo0:1 IP: 213.42.20.20 Running DNS service Loopback lo0:1 IP: 213.42.20.20 Running DNS service

11. 11 Important features in ISC Bind 9 TSIG/DNSSEC NOTIFY NSUPDATE IDN IPV6 RNDC FLUSH VIEWS

12. 12 Service Monitoring Monitor CPU Monitor Number of REQUESTS Monitor Recursive QUEUE Monitor Traffic Rates Monitor BOGUS servers Monitor Top Clients/Top Talkers

13. 13 Service Monitoring

14. 14 Popular links http://www.isc.org http://www.bind9.net http://zebra.org Rfc 2182, rfc 1034, rfc 1035 Mailing list: bind-users@isc.orgbind-users@isc.org Thank You