5 ms·

What's the benefit to cloudflare for offering dns services for free other than data-mining? Facilitating 1.3T DNS requests per day can't be cheap.

devwastaken 3y ago
If we think more complexly we can find a much better answer. Cloudflares profitable services depend on DNS working properly for both the customer and the customers userbase. DNS servers outside of cloudflares control may not be correct, or may not route properly in various edge conditions. Therefore an easy way to solve this is to simply host their own DNS.
- bombcar 3y ago
  This is probably it; the very first thing support can ask is "try it with 1.1.1.1 and see if it works" - if it does, it's a DNS issue. Also, by running their own DNS they can ensure that some percentage of the Internet does NOT cache results beyond what they want (to some extent) - much of what Cloudflare does is DNS trickery to route to the appropriate CDN.
dec0dedab0de 3y ago
They have an accurate internal number of what websites people are going to. They could use this to direct their sales people. They might also use it with their secret score on every user to decide if they need a captcha. They could also just have it in their back pocket as a potential extra revenue stream selling user data.
- Zambyte 3y ago
  The "other than data-mining" part is still unanswered
  - wddkcs 3y ago
    Isn't this typical tech development? Gain monopoly through free offerings and then squeeze the segment for max profit
    - scarlson 3y ago
      Do no evil always comes to a hard stop when investors realize it also means do no capitalism.
      - TylerE 3y ago
        Almost like the modern corporate structure is what's really evil. Sixty or Seventy years ago, in the golden age of US manufacturing, companies were mostly privately owned. No shareholders to please. That let them make long-range strategic plays, instead of making short term anti-plays just to make the next quarter number go up.
    - benced 3y ago
      Google has been offering 8.8.8.8 forever and never charged.
      - ceejayoz 3y ago
        I would presume they're getting plenty of value out of that data.
      - dylan604 3y ago
        Tap tap tap, is this thing on? To quote: The "other than data-mining" part is still unanswered
    - aednichols 3y ago
      Commoditize your complement. Users need working DNS to use Cloudflare’s paid services. That used to be a business in and of itself, where OpenDNS made money showing people ads. But now the market price has been driven to zero.
  - CyanLite2 3y ago
    They have a free offering for anti-malware and anti-porn DNS server (1.1.1.2 and 1.1.1.3). Right now it's targeting for "families", but at some point they could easily monetize this especially to corporate networks. And from a corporate perspective, historically no one ever got fired for using IBM. Who would you want running your Fortune 500 corporate CDN, a company that can handle 1.3T reqs/day or another CDN provider that's one-tenth the price but doesn't have the scale/reach of Cloudflare?
    - mike_d 3y ago
      > but doesn't have the scale/reach of Cloudflare? Akamai is IBM in this example. They are "enterprise" and have been long before Cloudflare existed and have 4,200 POPs compared to Cloudflare's 250.
pornel 3y ago
Latency. Cloudflare is selling speed. When you use their DNS, then lookup of their CDN domains is going to be faster, since you're querying the source directly rather than through intermediate DNS servers.
kokojie 3y ago
One of the more evil things they could do is show you ads, for example every 100 requests, you are shown a full page ad for a few seconds, then directs to where you were going. Pretty much like how youtube does it. I'm not saying they will do this, but they could if they wanted to. I've seen this from DNS providers in other countries.
- bbkane 3y ago
  Would that work over HTTPS? My understanding is that, when the browser connects to the IP returned over DNS, it validates the TLS cert returned by the server at that IP contains the website name.
- Ajedi32 3y ago
  Thankfully that's probably not feasible anymore given how prevalent HTTPS is these days.
- lxgr 3y ago
  Given that almost every site now uses HTTPS, they could only do this for users navigating to non-existing domains (and furthermore have to register the domain names themselves, or they wouldn't be able to get any TLS certificate for them).
- aednichols 3y ago
  OpenDNS used to hijack DNS to show ads, which is one of the reasons Google launched the non-hijacking 8.8.8.8 in 2009. OpenDNS quickly followed suit. No one would attempt it today, seeing as it would instantly make you the worst DNS resolver on the Internet and switching away is trivial.
toast0 3y ago
More control over ip selection for clients to better direct traffic for their customers is the obvious first order benefit. Passive competitor data collection is useful too. DNS traffic has good traffic ratios, at least compared to typical http traffic. That's got to help with peering negotiations. Although DNS traffic isn't that much, so it probably doesn't help much. Same for accepting and dropping inbound volumetric DDoS. Larger ISPs want to see roughly balanced inbound and outbound flows before they'll agree to settlement free peering, and options for attracting inbound flows from residential ISP customers are limited (run a backup service, run a 1:1 multimedia messaging service and/or video chat, DNS helps a bit)
lxgr 3y ago
It (coincidentially or not) limits the performance of competing regional CDNs to that of Cloudflare, since 1.1.1.1 truncates the EDNS client subnet parameter, which means that the only location/region hint a third-party CDN DNS has to go by is Cloudflare's location, not the user's. As an example, consider a user in Paris, and assume for the sake of this example that Cloudflare's closest POP is in Berlin. Assume that user visiting a site hosted by a French CDN, with POPs in both Paris and Berlin. If that user tries to resolve cdn.mysite.fr via 1.1.1.1, they'd get a Berlin-based location, since the French CDN has no way of knowing that the user is actually closer to them, and Paris would have been the better option.
- johncolanduoni 3y ago
  Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic. Honestly I don’t take any CDN that doesn’t operate on anycast seriously these days, the issues with GeoDNS are well established at this point and if your network operations can’t handle the complexity of an anycast deployment you’re probably dropping the ball on a lot of other fronts.
  - mike_d 3y ago
    Have you ever built a CDN or anycast network? I have, many times. Anycast isn't magic, and it can't be used in all situations. For example Akamai has 16 times as many POPs as Cloudflare does, and many of them reside within smaller ISPs where you might not be able to establish BGP sessions. Long running downloads and websockets are better served over unicast addresses. Not to mention you don't have a lot of knobs to fix things when anycast does go wrong and you have a network in the US sending your traffic to an EU POP because they have cheaper transit in Europe. You might find this work from LinkedIn informative: https://engineering.linkedin.com/network-performance/tcp-over-ip-anycast-pipe-dream-or-reality https://engineering.linkedin.com/network-performance/tcp-ove...
  - lxgr 3y ago
    > Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic. Which makes it all the more dubious to block it…
whoopdedo 3y ago
Considering their core products, DNS might be an early-warning sign of DDoS. A sudden surge in requests for a domain will trip a circuit breaker before the HTTP sessions begin. There's probably a way to tell the difference between a bot attack and a hug-of-death by the pattern of DNS.

devwastaken 3y ago

If we think more complexly we can find a much better answer. Cloudflares profitable services depend on DNS working properly for both the customer and the customers userbase. DNS servers outside of cloudflares control may not be correct, or may not route properly in various edge conditions. Therefore an easy way to solve this is to simply host their own DNS.

bombcar 3y ago
This is probably it; the very first thing support can ask is "try it with 1.1.1.1 and see if it works" - if it does, it's a DNS issue. Also, by running their own DNS they can ensure that some percentage of the Internet does NOT cache results beyond what they want (to some extent) - much of what Cloudflare does is DNS trickery to route to the appropriate CDN.

dec0dedab0de 3y ago

They have an accurate internal number of what websites people are going to. They could use this to direct their sales people. They might also use it with their secret score on every user to decide if they need a captcha. They could also just have it in their back pocket as a potential extra revenue stream selling user data.

Zambyte 3y ago
The "other than data-mining" part is still unanswered
- wddkcs 3y ago
  Isn't this typical tech development? Gain monopoly through free offerings and then squeeze the segment for max profit
  - scarlson 3y ago
    Do no evil always comes to a hard stop when investors realize it also means do no capitalism.
    - TylerE 3y ago
      Almost like the modern corporate structure is what's really evil. Sixty or Seventy years ago, in the golden age of US manufacturing, companies were mostly privately owned. No shareholders to please. That let them make long-range strategic plays, instead of making short term anti-plays just to make the next quarter number go up.
  - benced 3y ago
    Google has been offering 8.8.8.8 forever and never charged.
    - ceejayoz 3y ago
      I would presume they're getting plenty of value out of that data.
    - dylan604 3y ago
      Tap tap tap, is this thing on? To quote: The "other than data-mining" part is still unanswered
  - aednichols 3y ago
    Commoditize your complement. Users need working DNS to use Cloudflare’s paid services. That used to be a business in and of itself, where OpenDNS made money showing people ads. But now the market price has been driven to zero.
- CyanLite2 3y ago
  They have a free offering for anti-malware and anti-porn DNS server (1.1.1.2 and 1.1.1.3). Right now it's targeting for "families", but at some point they could easily monetize this especially to corporate networks. And from a corporate perspective, historically no one ever got fired for using IBM. Who would you want running your Fortune 500 corporate CDN, a company that can handle 1.3T reqs/day or another CDN provider that's one-tenth the price but doesn't have the scale/reach of Cloudflare?
  - mike_d 3y ago
    > but doesn't have the scale/reach of Cloudflare? Akamai is IBM in this example. They are "enterprise" and have been long before Cloudflare existed and have 4,200 POPs compared to Cloudflare's 250.

pornel 3y ago

Latency. Cloudflare is selling speed. When you use their DNS, then lookup of their CDN domains is going to be faster, since you're querying the source directly rather than through intermediate DNS servers.

kokojie 3y ago

One of the more evil things they could do is show you ads, for example every 100 requests, you are shown a full page ad for a few seconds, then directs to where you were going. Pretty much like how youtube does it. I'm not saying they will do this, but they could if they wanted to. I've seen this from DNS providers in other countries.

bbkane 3y ago
Would that work over HTTPS? My understanding is that, when the browser connects to the IP returned over DNS, it validates the TLS cert returned by the server at that IP contains the website name.
Ajedi32 3y ago
Thankfully that's probably not feasible anymore given how prevalent HTTPS is these days.
lxgr 3y ago
Given that almost every site now uses HTTPS, they could only do this for users navigating to non-existing domains (and furthermore have to register the domain names themselves, or they wouldn't be able to get any TLS certificate for them).
aednichols 3y ago
OpenDNS used to hijack DNS to show ads, which is one of the reasons Google launched the non-hijacking 8.8.8.8 in 2009. OpenDNS quickly followed suit. No one would attempt it today, seeing as it would instantly make you the worst DNS resolver on the Internet and switching away is trivial.

toast0 3y ago

More control over ip selection for clients to better direct traffic for their customers is the obvious first order benefit. Passive competitor data collection is useful too. DNS traffic has good traffic ratios, at least compared to typical http traffic. That's got to help with peering negotiations. Although DNS traffic isn't that much, so it probably doesn't help much. Same for accepting and dropping inbound volumetric DDoS. Larger ISPs want to see roughly balanced inbound and outbound flows before they'll agree to settlement free peering, and options for attracting inbound flows from residential ISP customers are limited (run a backup service, run a 1:1 multimedia messaging service and/or video chat, DNS helps a bit)

lxgr 3y ago

It (coincidentially or not) limits the performance of competing regional CDNs to that of Cloudflare, since 1.1.1.1 truncates the EDNS client subnet parameter, which means that the only location/region hint a third-party CDN DNS has to go by is Cloudflare's location, not the user's. As an example, consider a user in Paris, and assume for the sake of this example that Cloudflare's closest POP is in Berlin. Assume that user visiting a site hosted by a French CDN, with POPs in both Paris and Berlin. If that user tries to resolve cdn.mysite.fr via 1.1.1.1, they'd get a Berlin-based location, since the French CDN has no way of knowing that the user is actually closer to them, and Paris would have been the better option.

johncolanduoni 3y ago
Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic. Honestly I don’t take any CDN that doesn’t operate on anycast seriously these days, the issues with GeoDNS are well established at this point and if your network operations can’t handle the complexity of an anycast deployment you’re probably dropping the ball on a lot of other fronts.
- mike_d 3y ago
  Have you ever built a CDN or anycast network? I have, many times. Anycast isn't magic, and it can't be used in all situations. For example Akamai has 16 times as many POPs as Cloudflare does, and many of them reside within smaller ISPs where you might not be able to establish BGP sessions. Long running downloads and websockets are better served over unicast addresses. Not to mention you don't have a lot of knobs to fix things when anycast does go wrong and you have a network in the US sending your traffic to an EU POP because they have cheaper transit in Europe. You might find this work from LinkedIn informative: https://engineering.linkedin.com/network-performance/tcp-over-ip-anycast-pipe-dream-or-reality https://engineering.linkedin.com/network-performance/tcp-ove...
- lxgr 3y ago
  > Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic. Which makes it all the more dubious to block it…

whoopdedo 3y ago

Considering their core products, DNS might be an early-warning sign of DDoS. A sudden surge in requests for a domain will trip a circuit breaker before the HTTP sessions begin. There's probably a way to tell the difference between a bot attack and a hug-of-death by the pattern of DNS.