4 ms·
You've conflated the proxy DNS servers, that do grunt work of query resolution (or forward to other proxies that do), with the content DNS servers. It is not t
by JdeBP 6y ago
You've conflated the proxy DNS servers, that do grunt work of query resolution (or forward to other proxies that do), with the content DNS servers. It is not the content DNS servers that are causing the scaling problems, it is the proxy DNS servers, and the DNS clients and applications softwares that drive them.
* http://jdebp.uk./FGA/dns-server-roles.html http://jdebp.uk./FGA/dns-server-roles.html
The change that needs to happen is the thing that most people nowadays tell one first, that this paper in contrast leaves all of the way to the end: run your own content DNS server(s) for the root, on your own LAN or Intranet. It's fairly simple to do, and it's an idea that has been around for over two decades, now.
* https://news.ycombinator.com/item?id=24277855 https://news.ycombinator.com/item?id=24277855
* https://news.ycombinator.com/item?id=19526108 https://news.ycombinator.com/item?id=19526108
* http://cr.yp.to/dnsroot.html http://cr.yp.to/dnsroot.html (dates back to 2001)
* https://news.ycombinator.com/item?id=24280536 https://news.ycombinator.com/item?id=24280536 et al.
It takes a long time in the DNS world for such grassroots ideas to percolate to the level that they get circulated by corporate officers. This article is, for example, still propounding that every resolving proxy DNS server works like ISC's BIND, and has a "priming query". This is untrue in reality, and is one of the differences between BIND and some of the softwares (e.g. dnscache and MaraDNS) that came along to replace it a couple of decades ago.
* https://maradns.samiam.org/faq.html#roothints https://maradns.samiam.org/faq.html#roothints
Similarly the argument that Google should use a subdomain, presented in this article without any counterpoint at all, has long since been countered by pointing out that this makes the malicious actors' lives easier; as conditional forwarding and split-horizon DNS service, which are well-known things, would then make it easier to fool Google Chrome. And there have been other counterarguments made, years ago.
* https://news.ycombinator.com/item?id=3609498 https://news.ycombinator.com/item?id=3609498 (yes, 2012)
- dkdk8283 6y agoI think your terms are incorrect. Proxy queries in your context are referred to as recursive and content is authoritative.
- JdeBP 6y agoThese aren't types of query, they are types of server. viovich123 was talking about content DNS servers that cause the scaling problems, and penalizing the people who run them. But it is the proxy DNS servers, and the DNS clients and applications softwares that drive them, that are the cause here. The terms are correct, and are derived from HTTP. You aren't grasping them correctly.
- dkdk8283 6y agoThese terms are not listed in RFC 7719 “DNS Terminology”. > You aren’t grasping them correctly. I find this to be quite rude.
- bauruine 6y agoI've never heard those terms only recursive / resolver and authoritative. Who uses content and proxy?
- eikenberry 6y ago> The terms are correct, and are derived from HTTP. You aren't grasping them correctly. This, I think, is the source of the problem. DNS servers have their own terminology that pre-dates HTTP. The servers that take/do lookup requests and cache them are known as recursive servers. Yes, they act similarly to HTTP caching proxies, but that's not how they are referred to. These make up the vast majority of DNS servers. The other type is authoritative, which is called that as it is the 'athoritative'source of truth for some domain's DNS data. Where the root servers look it up to feed into the system. These would be akin to your basic HTTP servers, but again the terminology is different.
- JdeBP 6y agoThis is the source of the problem. People don't understand the DNS terminology. Very few people indeed get "resolver" right, for example, and they only then end up confusing the rather larger number of people who get it quite wrong. Similarly, "authoritative" confuses people when they have to try to understand why it isn't actually the same as an "authoritative answer". Whereas they do understand the idea of DNS records being content, that is published by content servers. Hence why many years ago I took to explaining DNS using HTTP terminology. It works quite well.