WHITE PAPER. DNS: Key Considerations Before Deploying Your Solution

Transcription

1 WHITE PAPER DNS: Key Considerations Before Deploying Your Solution

2 TABLE OF CONTENTS What is DNS?... 2 Why Does DNS Matter?... 2 Options for building a DNS infrastructure... 3 How to Choose the Right DNS Infrastructure... 5 Future Considerations... 6 DNS and CDN... 6 Conclusion... 7

3 Executive Summary As a business executive, you ve invested a lot in your Website and online presence. Now you need to make sure visitors can quickly reach your site, all the time. The Domain Name System (DNS) is critical to making that happen. This paper explains the main requirements for an effective DNS, explains the options for enabling DNS, and provides key criteria to consider when choosing the best option for your organization. CDNetworks 1

4 What is DNS? The Domain Name System (DNS) is a global Internet directory that maps humanreadable domain names to unique identifiers for computers, commonly referred to as IP addresses. A common analogy is a phonebook that maps a human name to a phone number. Every time a user types in a Website name or address, the DNS system is invoked in the background. The system, which is comprised of globally distributed programs called nameservers, translates the target name into a unique IP address. This allows the user to connect to the correct Website or inbox. [The previous is a simplified description used solely for the purpose of illustration. A detailed discussion about the Domain Name System is outside the scope of this document.] Why Does DNS Matter? Today, individuals are heavily reliant on the Web to satisfy their content, communication, commerce and social needs. Almost every Internet transaction interacts with the DNS system. Whenever users try to reach Web-based services, they rely on DNS to connect them to the service. As a result, a DNS system directly affects the success or failure of a Web-based service. As such, a DNS system must exhibit the following characteristics. AVAILABILITY The DNS must have 100% uptime with no outages. In today s world where competition is no longer defined by boundaries, a business cannot afford to be offline. Since users have plenty of choices for any given online service, the DNS must be always available to ensure that they can always reach the Web service. PERFORMANCE The latency incurred in DNS lookup is the first factor that affects a user s Web experience. And users Web experiences directly affect their decision to continue using the Web service. As such, DNS systems must exhibit high performance. This is CDNetworks 2

5 especially important when users are geographically distributed. A user from China or Australia expects the same level of performance as one from the United States. RELIABILITY When users try to reach a service, they expect to reach the same service every time. Irrespective of the type and location of the service and independent of the time and location of access, a DNS query for a named Web service must always return the correct answers. Even when DNS data needs to be changed for business or technical reasons, the DNS responses must reflect the new data. SECURITY DNS is one of the most complex and, by extension, one of the most vulnerable online systems. For years, it has been subjected to attacks, spam and phishing. A non-secure DNS system can easily be taken offline by such attacks, rendering it unavailable. That s why, the DNS infrastructure needs to be robust and highly resilient to well known (distributed) Denial of Service attacks. SCALABILITY As business grows, the number of users for a Web-based service also grows. It is not uncommon for the most popular Websites to be hit with millions of queries each day. Occasionally, due to concentrated user activity in a short time period (often referred to as a flash crowd ), a Website may experience a sudden spike in traffic. The DNS infrastructure should be capable of handling these large volumes of queries. If not, it will affect site availability and/or performance, which in turn will adversely affect the business of the content owner. Clearly, DNS is extremely important. It is the first level of Internet interaction that an end user has when trying to access a Web-based service. As such, it needs to be available, reliable, scalable, and must securely and reliably respond to DNS queries all the time. Options for building a DNS infrastructure There are primarily three options for building a DNS infrastructure. IN HOUSE A DNS infrastructure can be maintained in house. This involves buying specialized hardware and software and setting up an in-house system. Administration of DNS data in house requires mostly manual editing of DNS records Pros: Managing a DNS in house provides complete control of the entire infrastructure. Cons: As in most in-house projects, the difficulty lies in the cost of both building and maintaining this infrastructure. A DNS infrastructure requires highly specialized hardware, very complex software that must conform to strict Internet standards and a high-bandwidth network that is widely distributed. The servers must be geographically distributed and redundant. The software must support complex protocols related to data transfers and security in addition to the regular operation of query resolution. As hard it is to build this system, it is even harder to find the right personnel to maintain it. DNS management is a highly specialized and hard-to-find expertise. Without a dedicated DNS expert, it is easy to introduce errors in DNS data which could lead to CDNetworks 3

6 costly outages. ISP Getting DNS services from one s ISP is a common option. They are offered by ISPs as part of the Internet service and as a result are often very cheap or even free. Often times, the ISP provides a basic Web-based interface for DNS record management. Pros: Outsourcing a DNS to an ISP eliminates the need to make a capital investment to build a DNS infrastructure. ISPs provide a better network infrastructure than most companies could provide on their own, which potentially improves the performance of DNS query resolutions. Cons: Although ISPs have a better infrastructure than in-house systems, they are still not as geographically distributed as the user base. This affects performance and also restricts the scalability of the system which could affect availability in the face of heavy traffic. Although ISPs provide a Web interface for DNS record management, it is usually not sophisticated enough to allow all combinations of changes. It usually lacks a reporting system which makes it hard to analyze DNS traffic. Finally, DNS is not the main business of ISPs. As such, ISPs don t generally staff it with dedicated support for DNS. Combined, these factors make it challenging to use an ISP-provided DNS system. MANAGED DNS SERVICE PROVIDER A third option is to outsource one s DNS needs to a managed service provider specializing in DNS services. Such a provider typically has a global infrastructure and provides sophisticated Web-based management and reporting capabilities. Pros: Just as when using an ISP-provided DNS, organizations can avoid the capital investment required to build and maintain a DNS infrastructure. At the same time, they benefit from access to a global footprint and enhanced routing technologies, such as IP Anycast, that significantly reduces latency. Since the DNS infrastructure is built from the ground up with security and scalability in mind, organizations can be certain of 100% availability. Sophisticated web-based management system allows as close a control over DNS system as an in-house solution. Moreover, advanced reporting allows real-time insight into DNS traffic which can be used to fine-tune DNS records. Dedicated support from specialists ensures that all issues are dealt with promptly and professionally. Cons: When outsourcing to a managed provider, organizations are dependent on the availability of the provider s network. However, the larger the size and design of the provider network, the lower the chances of any catastrophic failure. In addition, DNS is a complex protocol with many different kinds of records. Support for specific record types or protocol features depends on the DNS provider. Each option has its strengths and weaknesses. However, before making a decision on which option to adopt, it is necessary to understand the needs of the organization. CDNetworks 4

7 How to Choose the Right DNS Infrastructure Before making a decision about which option to choose, answer the following questions. CRITICALITY What is the importance of the Internet to your business? Is it used mostly for exchanging s? Or is it a major channel for conducting business? Is it a primary medium for connecting to existing customers for support and service? Is it a portal where prospective customers and business partners to find more information? The more critical your online presence, the more important it is that you choose a highly available, high-performing, and scalable DNS. GEOGRAPHIC DISTRIBUTION What is the geographic distribution of users? Does their access correlate to their local time zone? Or do users from all across the world access the site at all times? You also need to consider your content delivery mechanism. Is your site content delivered from a single server, from multiple geographically dispersed datacenters, or even from a content delivery network? A wider geographic distribution of your users requires your DNS system to have a larger global footprint. VOLUME OF QUERIES What is the expected number of queries per month? Is it hundreds of thousands (as is the case for a small company)? Is it tens of millions (as is the case for most midsize businesses)? Or is it hundreds of millions (as is the case for larger corporations)? When estimating the volume of DNS queries, it s important to also answer the following: does your Website accept multiple real-time feeds from advertisers and other third parties? The DNS infrastructure needs to handle potentially large and unpredictable volumes of queries. COST Estimating potential total cost of ownership requires insight into both capital and operational expenditures as well as the cost of an outage. How many datacenters are needed? What should be the location of these datacenters? What is the level of redundancy to be provided inside each datacenter? What is the cost of the datacenter including rack space, power and cooling costs? What hardware and software should be bought? What is the cost of maintaining these systems? How will the network be provisioned, monitored and maintained? Is there a requirement for load balancing? If so, what kind of load balancers need to be bought, deployed and maintained? What is the cost of hiring and training dedicated staff? What is the cost to business if the Website is unavailable? Is the system capable of handling Distributed Denial of Service (DDoS) attacks? Is there enough expertise to recover from a DDoS attack to minimize the time that the Web service is unavailable? When making a decision, it is equally important to consider the requirements of the business over the next five years. Since DNS is an extremely complex yet a very critical system, it s not cost-effective to rebuild it every time the business or the technology landscape changes. That s why it s critical to assess both near-term and long-term business plans. CDNetworks 5

8 Future Considerations The technological challenges associated with building and maintaining DNS systems are further increasing because of the following two factors. DNSSEC DNS has historically been one of the prime targets of attackers. As such, security has come to the forefront of all key technologies that are necessary to enable a fully functional and reliable DNS. DNS Security Extensions (DNSSEC) is an emerging Internet standard that prevents spoofing attacks by allowing Websites to verify their domain names and corresponding IP addresses using digital signatures and public-key encryption. Although still not mandatory, the adoption of DNSSEC is on the rise. Starting mid-2010, the DNS root servers have started to support DNSSEC. DNSSEC is significantly more complicated than the basic DNS protocol. It requires very specialized skills since chances of misconfiguration, which eventually leads to outages, is very high. In addition, DNSSEC places a lot more strain on the infrastructure for computing and network bandwidth. IPV6 Currently, IPv4 is the de facto addressing scheme on the Internet. However, IPv4 can support only approximately four billion devices. With the rapid proliferation of Internetenabled TV, gaming consoles and e-readers, in addition to computers and mobile phones, it is safe to say that the number of connected devices will soon surpass four billion. The emergence of newer technologies such as sensor networks where millions of tiny sensors are connected to the Internet is going to push this number even further. Some experts have warned that we will run out of IPv4 addresses by the end of Although short-term measures exist to conserve IPv4 addresses, the long-term solution is to move to IPv6 address space. Owing to the complexity of this change, migration to the IPv6 addressing scheme will be slow. As a result, networks will need to support both addressing schemes for some time. This will have a huge impact on DNS systems; while the protocol itself is equipped to handle IPv6, there will be a need to develop extremely sophisticated and automated tools for managing, monitoring and reporting this scheme. DNS and CDN If you are using a Content Delivery Network (CDN) for your Website, it is advantageous to use DNS services from the same provider, if available. Outsourcing your DNS services to a CDN provider that has a global footprint has all the advantages of managed DNS provider. In addition, it improves the performance of your Website. In order to understand why, let us follow the steps when a user accesses your Website. Assume, is being delivered by a CDN. When a user types in the site address in the browser, the following (simplified) events occur in sequence. CDNetworks 6

9 CDNetworks Global Offices US 441 W. Trimble Road San Jose, CA EMEA Juxon House 100 St Paul s Churchyard London, EC4M 8BU Korea Handong Bldg. 2F,828-7 Yeoksam-Dong, Gangnam-Gu Seoul Japan Nittochi Nishi-shinjuku Building 8th Floor, , Nishishinjuku, Shinjuku-ku, Tokyo China Room No.A-1502, Keijidalou, 900 Yi shan Road, Shanghai info@cdnetworks.com 1. The browser sends a query to your DNS server to resolve 2. Your DNS server responds with a CNAME like yoursite.cdn.com. 3. The browser resends a new query to the CDN s DNS server to resolve yoursite.cdn.com. 4. The CDN s DNS server responds with an IP address, such as The browser connects to the IP address and retrieves the content of your site. If your CDN provider is also your DNS provider, steps 2 and 3 from above are eliminated. By eliminating an extra lookup which requires a round trip time between the DNS server and your user, performance is significantly improved. Further, the DNS server for the CDN could be in a separate location than that for your domain which could further negatively impact the overall latency. Conclusion DNS is critical for any organization that relies on the Web to connect to customers, partners, suppliers and employees. It s a unifying technology that is the difference between a Website being available or not. As a result, it must be available all the time, exhibit high performance and also be reliable, secure and scalable. The challenge for most organizations is that DNS is a complex system requiring an array of hardware, software and networks, along with specialized knowledge. Building and maintaining a DNS system is both technically intimidating and financially challenging; it is further complicated by the emergence of new technology standards such as DNSSEC. Fortunately, organizations can choose from many options for setting up a DNS infrastructure. Once organizations understand both their short and long-term requirements, they can adopt the most fitting DNS strategy. To find out more about CDNetworks cloud-based DNS service, visit CDNetworks. All rights reserved. Features and specifications subject to change without notice. CDNetworks 7