4 ms·

Depending on what point you draw the line of "single point of failure" you could use multiple providers for your dns. GOV.UK for example uses both aws and gcp

by sakisv 5y ago

Depending on what point you draw the line of "single point of failure" you could use multiple providers for your dns. GOV.UK for example uses both aws and gcp for DNS

davidjgraph 5y ago
So, NS entries pointing to both? But then take the example your domain was in Route53 and AWS goes down. You can't configure the NS entries to avoid AWS DNS servers. Is the idea that child DNS servers detect the outage and cache the values in the name server(s) that remain up? But then, the cached values from AWS take a while to clear, TTL never seems to be applied properly. It always feels like the worst case in such a scenario is you can point everyone at the right thing within 24 hours.
- NotEvil 5y ago
  Ibthink if route53 was down. Your dns provider whouldn't able to go there. So it will go to the root who will give gcp one too. So your dns provider might try that. (I don't know if this is how it works, but I thibk that's how it supposed to work)
  - zxcvbn4038 5y ago
    You typically have four name servers for a domain, but they don’t all have to be hosted with the same company. Very handy when your DNS provider decides to brag they are unhackable and the hackers reply by immediately hacking them followed by DDoSing them to death.
- tpetry 5y ago
  You set both services in your ns records. So every day they share the load for dns resolution. If one day one of them is down the client can/will use a different nameserver from your configuration.
- wongarsu 5y ago
  Configuring two NS entries is pretty standard, so surely most resolvers try one of the two, and if it's down try the other one? What else would be the point of having multiple nameservers? Then you just have to get two nameserver providers and make sure their settings stay synced, and point your domain to one nameserver from each. Of course that requires the server to properly fail, i.e. stop responding to requests. That doesn't seem to be the case here
- corobo 5y ago
  Have them all hot and live rather than any sort of failover system. Keep everything in sync with OctoDNS or similar https://github.com/octodns/octodns https://github.com/octodns/octodns DNS is fastest first* rather than main/failover. If AWS DNS was down your GCP DNS would have replied (if all is well) sooner than {timeout} so your visitor would still have a response * Sort of. I think if the client doesn't get a reply from the server it picked randomly in 1s they move on to the next server, repeat until all fail
paradite 5y ago
Last time I tried setting NS to both cloudflare and digital ocean in my domain registry, cloudflare sent me an email saying the configuration is invalid and asked me to revert. Am I doing something wrong?
- mritzmann 5y ago
  No, you have done everything right. At least from the point of view of DNS. That you can not use multiple nameservers is a limitation of Cloudflare (limit in the sense of: Cloudflare can only offer their services in the Free and Pro plan if they have full control over all nameservers).
  - paradite 5y ago
    Thank you. I will look into alternative services on the thread then.
gregsadetsky 5y ago
gov.uk's traffic seems to be handled by Fastly, a well known CDN. What I'm a bit surprised / unsure of is what happens when I run "dig ns gov.uk". The results are: gov.uk. 21559 IN NS ns1.surfnet.nl. gov.uk. 21559 IN NS auth50.ns.de.uu.net. gov.uk. 21559 IN NS ns3.ja.net. gov.uk. 21559 IN NS ns2.ja.net. gov.uk. 21559 IN NS ns0.ja.net. gov.uk. 21559 IN NS auth00.ns.de.uu.net. gov.uk. 21559 IN NS ns4.ja.net. Who is ja.net , uu.net and surfnet.nl ..? EDIT: I see that ja.net i.e. jisc.ac.uk "manages the second level domain .gov.uk" -- https://www.jisc.ac.uk/domain-registry https://www.jisc.ac.uk/domain-registry . I imagine that uu.net and surfnet.nl are there for redundancy
- PaywallBuster 5y ago
  whois ja.net Domain Name: JA.NET Registry Domain ID: 499794_DOMAIN_NET-VRSN Registrar WHOIS Server: whois.demys.com Registrar URL: http://www.demys.com "Demys is a leading provider of corporate domain name management and an ICANN accredited registrar" whois uu.net Domain Name: UU.NET Registry Domain ID: 5486163_DOMAIN_NET-VRSN Registrar WHOIS Server: whois.markmonitor.com surfnet is just an ISP in Netherlands https://www.surf.nl/ https://www.surf.nl/
  - gregsadetsky 5y ago
    Thanks Is it possible to see if/where is gov.uk using GCP or AWS for its domain zones? From what I can see -- that's not the case? Or am I looking in the wrong place?
    - PaywallBuster 5y ago
      I think you did the right query, maybe they're using it for different domain names?
- sakisv 5y ago
  Ah sorry, you're indeed right. Turns out it was just the .service.gov.uk domain that uses GCP and AWS - I just thought that applied to the parent domain too. $ dig NS service.gov.uk +short ns-cloud-e4.googledomains.com. ns-cloud-e3.googledomains.com. ns-cloud-e2.googledomains.com. ns-cloud-e1.googledomains.com. ns-831.awsdns-39.net. ns-1983.awsdns-55.co.uk. ns-117.awsdns-14.com. ns-1080.awsdns-07.org.

by sakisv 5y ago

Depending on what point you draw the line of "single point of failure" you could use multiple providers for your dns. GOV.UK for example uses both aws and gcp for DNS

davidjgraph 5y ago

So, NS entries pointing to both? But then take the example your domain was in Route53 and AWS goes down. You can't configure the NS entries to avoid AWS DNS servers. Is the idea that child DNS servers detect the outage and cache the values in the name server(s) that remain up? But then, the cached values from AWS take a while to clear, TTL never seems to be applied properly. It always feels like the worst case in such a scenario is you can point everyone at the right thing within 24 hours.

NotEvil 5y ago
Ibthink if route53 was down. Your dns provider whouldn't able to go there. So it will go to the root who will give gcp one too. So your dns provider might try that. (I don't know if this is how it works, but I thibk that's how it supposed to work)
- zxcvbn4038 5y ago
  You typically have four name servers for a domain, but they don’t all have to be hosted with the same company. Very handy when your DNS provider decides to brag they are unhackable and the hackers reply by immediately hacking them followed by DDoSing them to death.
tpetry 5y ago
You set both services in your ns records. So every day they share the load for dns resolution. If one day one of them is down the client can/will use a different nameserver from your configuration.
wongarsu 5y ago
Configuring two NS entries is pretty standard, so surely most resolvers try one of the two, and if it's down try the other one? What else would be the point of having multiple nameservers? Then you just have to get two nameserver providers and make sure their settings stay synced, and point your domain to one nameserver from each. Of course that requires the server to properly fail, i.e. stop responding to requests. That doesn't seem to be the case here
corobo 5y ago
Have them all hot and live rather than any sort of failover system. Keep everything in sync with OctoDNS or similar https://github.com/octodns/octodns https://github.com/octodns/octodns DNS is fastest first* rather than main/failover. If AWS DNS was down your GCP DNS would have replied (if all is well) sooner than {timeout} so your visitor would still have a response * Sort of. I think if the client doesn't get a reply from the server it picked randomly in 1s they move on to the next server, repeat until all fail

paradite 5y ago

Last time I tried setting NS to both cloudflare and digital ocean in my domain registry, cloudflare sent me an email saying the configuration is invalid and asked me to revert. Am I doing something wrong?

mritzmann 5y ago
No, you have done everything right. At least from the point of view of DNS. That you can not use multiple nameservers is a limitation of Cloudflare (limit in the sense of: Cloudflare can only offer their services in the Free and Pro plan if they have full control over all nameservers).
- paradite 5y ago
  Thank you. I will look into alternative services on the thread then.

gregsadetsky 5y ago

gov.uk's traffic seems to be handled by Fastly, a well known CDN. What I'm a bit surprised / unsure of is what happens when I run "dig ns gov.uk". The results are: gov.uk. 21559 IN NS ns1.surfnet.nl. gov.uk. 21559 IN NS auth50.ns.de.uu.net. gov.uk. 21559 IN NS ns3.ja.net. gov.uk. 21559 IN NS ns2.ja.net. gov.uk. 21559 IN NS ns0.ja.net. gov.uk. 21559 IN NS auth00.ns.de.uu.net. gov.uk. 21559 IN NS ns4.ja.net. Who is ja.net , uu.net and surfnet.nl ..? EDIT: I see that ja.net i.e. jisc.ac.uk "manages the second level domain .gov.uk" -- https://www.jisc.ac.uk/domain-registry https://www.jisc.ac.uk/domain-registry . I imagine that uu.net and surfnet.nl are there for redundancy

PaywallBuster 5y ago
whois ja.net Domain Name: JA.NET Registry Domain ID: 499794_DOMAIN_NET-VRSN Registrar WHOIS Server: whois.demys.com Registrar URL: http://www.demys.com "Demys is a leading provider of corporate domain name management and an ICANN accredited registrar" whois uu.net Domain Name: UU.NET Registry Domain ID: 5486163_DOMAIN_NET-VRSN Registrar WHOIS Server: whois.markmonitor.com surfnet is just an ISP in Netherlands https://www.surf.nl/ https://www.surf.nl/
- gregsadetsky 5y ago
  Thanks Is it possible to see if/where is gov.uk using GCP or AWS for its domain zones? From what I can see -- that's not the case? Or am I looking in the wrong place?
  - PaywallBuster 5y ago
    I think you did the right query, maybe they're using it for different domain names?
sakisv 5y ago
Ah sorry, you're indeed right. Turns out it was just the .service.gov.uk domain that uses GCP and AWS - I just thought that applied to the parent domain too. $ dig NS service.gov.uk +short ns-cloud-e4.googledomains.com. ns-cloud-e3.googledomains.com. ns-cloud-e2.googledomains.com. ns-cloud-e1.googledomains.com. ns-831.awsdns-39.net. ns-1983.awsdns-55.co.uk. ns-117.awsdns-14.com. ns-1080.awsdns-07.org.