Generally speaking if you are a small to medium business, you will have a DNS server in your environment. You could just leave it as default pointed to the root servers to do external resolutions for your clients, but in geographically disperet countries like Australia that can lead to resolutions failures due to the latency to the root servers that is sometimes experienced. If you have a big enough pipe this latency is manageable and won't cause an issue, though a bit of contention can begin to cause problems. My suggestion was usually to specify DNS relay servers. This allows you to relay your requests to your ISP, especially good if your ISP blocks lookups to the root servers which I have also seen. But should you just specify your ISP's DNS... well when I first started doing this that is what I did. Till the ISP the client was using had their DNS cache poisoned and a few popular sites started coming badly, and other times where the ISPs DNS failed or changed without notice.
So I started setting a second or third that was with a different ISP, but was known publically accessable, either Optus or Telstra as they are/were our biggest ISP's in Australia at the time. I eventually started also adding OpenDNS and googles DNS to my reportaire, especially OpenDNS's premium services with clients that wanted the blocking that a proxy gives without the infrastructure or upfront cost, yes I know you can get round it by simply knowing the ip of a malicious site, but it was better than unencumbered internet feeds. I am not a shill I don't even have an OpenDNS account anymore.
This worked very well. But just today while troubleshooting an issue I fired up WinMTR, a windows port of the Linux tool Multi-Trace-Route (MTR), very useful at finding a hop in your route that could be having issues. As usual I used these memorised Optus and Telstra DNS servers to check my routes and I found packet loss (there was an issue with my ISP's bridging router into PIPE it seemed). Then I tested to my ISP's DNS, all good no packets dropped and only 4 hops, then I thought hmm I should test to googles open DNS servers, just to see;
|-----------------------------------------------------------------------------------------------------|
| WinMTR statistics |
| Host - % | Sent | Recv | Best | Avrg | Wrst | Last |
|-------------------------------------------------------|-------|-------|-------|-------|--------|-------|
| x-x-x-x.tpgi.com.au - 0 | 5 | 55 | 1 | 3 | 81 | 4 |
| x.x.x-x.tpgi.com.au - 2 | 55 | 54 | 23 | 28 | 114 | 24 |
| syd-nxg-men-crt2-ge-3-1-0.tpgi.com.au - 0 | 55 | 55 | 48 | 69 | 159 | 67 |
| 202.7.171.46 - 0 | 55 | 55 | 25 | 33 | 124 | 28 |
| 72.14.237.21 - 4 | 55 | 53 | 26 | 28 | 43 | 32 |
| google-public-dns-a.google.com - 2 | 54 | 53 | 44 | 70 | 151 | 76 |
|_____________________________________|______|______|______|______|______|
WinMTR - 0.8. Copyleft @2000-2002 Vasile Laurentiu Stanimir ( stanimir@cr.nivis.com )
Yeah there is a little packet loss there, issues with my connection, but only 6 hops is impressive. It wasn't this way when it first started, I remember using google dns early on and seeing latency of 100+ms and about 10-15hops, I quickly realised of course they are google, they are now using Anycast, a quick traceroute from elsewhere in the world (thanks to centralops tools)confirmed this due to the different route (more hops lower response time, but the first 5 are internal);
| 1 | 1 | 1 | 1 | 70.84.211.97 | 61.d3.5446.static.theplanet.com |
| 2 | 0 | 0 | 0 | 70.87.254.1 | po101.dsr01.dllstx5.networklayer.com |
| 3 | 0 | 0 | 0 | 70.85.127.105 | po51.dsr01.dllstx3.networklayer.com |
| 4 | 2 | 0 | 0 | 173.192.18.228 | ae16.bbr02.eq01.dal03.networklayer.com |
| 5 | 0 | 0 | 0 | 173.192.18.208 | ae7.bbr01.eq01.dal03.networklayer.com |
| 6 | 0 | 0 | 0 | 50.97.16.37 |
| 7 | 1 | 0 | 0 | 72.14.233.77 |
| 8 | 1 | 1 | 0 | 72.14.237.219 |
| 9 | 7 | 7 | 7 | 216.239.47.121 |
| 10 | 7 | 7 | 7 | 216.239.46.59 |
| 11 | * | * | * |
| 12 | 7 | 7 | 7 | 8.8.8.8 | google-public-dns-a.google.com |
So, moral of the story. If like me you are using one of the aformentioned or external DNS in replacement or addition to your ISP, now is a good time to move to Googles DNS, as it is probably faster than everyone else bar your ISP, and gives you a bit of redundancy. As one of my colleagues used to joke, if Google is down, the internet is down.
I did read something interesting in my travels researching this, Geographic aware DNS (aka GeoDNS), there is a patch for Bind and a fork of DJBDNS here; http://geoipdns.org/. Interesting, it is a similar idea I discussed with a colleague a few years ago and tested implementing in a kluge style way with Microsofts DNS server, this implementation is a lot smoother however.
Oh and there is an update to my previous post on 1.5 factor auth.
No comments:
Post a Comment