7 ms·

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to th

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to the next.

jeltz 13y ago
Also you as always have to be careful and make sure that all DNS servers have the same content or else you will get weird bugs.
thejosh 13y ago
Wouldn't a delay be better than full downtime?
colmmacc 13y ago
(I work on Route 53). We've done a lot of experiments on this one and we've found that the most common resolvers make 3 tries to 3 different servers by default. At first those servers are picked at random, but over time the resolvers usually "home in" on what the least-latent nameserver is. Once they do, and have a good round-trip-time estimate for how long it takes to respond, they stay using it. But they have a hair-trigger; if the nameserver doesn't respond, they'll very quickly fall-back to trying the other nameservers. In practice what that means is that up to two of your nameservers may be completely unresponsive and the effects will be pretty negligible. So if you're using multiple DNS providers and want to protect against one going off-air; use no more than two nameservers from each provider. That said, for all of the reasons above, and some more, the Route 53 SLA currently only applies if you use all four Route 53 nameservers.
- mmmooo 13y ago
  Any thoughts on where/how is this 'home in' state is saved? Other the cache and filtering/acl state resolvers should be stateless, so would be interested in any details, especially if this is on a per-zone, or per-set of nameservers or etc basis. I've never seen bind9 act like this.
  - colmmacc 13y ago
    I haven't read the bind source in a long time, but my best guess is that it's in memory. http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.htm http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.h... Has some details, and I believe Bind and PowerDNS call it "Smoothed RTT" or SRTT.
    - mmmooo 13y ago
      interesting, not a ton of details of how. off to the source I go, thanks. sounds like it assigns a 'score' of some sort to each authoritative ns.
      - isb 13y ago
        This might help - section 4.4 has formal details on the Bind server selection algorithms: http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theoretical-computer-science-internet-research-problems-spring-2002/lecture-notes/dns.pdf http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theo...
        mmmooo 13y ago
        yep definitely, an interesting implementation, and certainly almost impossible to guess from passive observation. thanks.
      - dsl 13y ago
        BIND assigns a score based on every IP it talks to and a hit rate. (so if ns1.foo.com resolves to 3 IPs, each is tracked individually, same if ns1.bar.com and ns1.baz.com are the same IP) It is a pretty small cache, maybe like 1024? This is all from fuzzy 5 year old memory.
smountcastle 13y ago
It depends on the implementation of the resolver, but in general when no information is known about a nameserver, the resolver will pick one at random. Overtime, it'll keep track of the latency and pick one (usually randomly within a band specifying a range of latencies). See this paper for more info: https://www.dns-oarc.net/files/workshop-201203/OARC-workshop-London-2012-NS-selection.pdf https://www.dns-oarc.net/files/workshop-201203/OARC-workshop...

Yes, but there may be delay, because the nameservers are tried in random order, and so each server that is down will have to time out before users move on to the next.

jeltz 13y ago

Also you as always have to be careful and make sure that all DNS servers have the same content or else you will get weird bugs.

thejosh 13y ago

Wouldn't a delay be better than full downtime?

colmmacc 13y ago

(I work on Route 53). We've done a lot of experiments on this one and we've found that the most common resolvers make 3 tries to 3 different servers by default. At first those servers are picked at random, but over time the resolvers usually "home in" on what the least-latent nameserver is. Once they do, and have a good round-trip-time estimate for how long it takes to respond, they stay using it. But they have a hair-trigger; if the nameserver doesn't respond, they'll very quickly fall-back to trying the other nameservers. In practice what that means is that up to two of your nameservers may be completely unresponsive and the effects will be pretty negligible. So if you're using multiple DNS providers and want to protect against one going off-air; use no more than two nameservers from each provider. That said, for all of the reasons above, and some more, the Route 53 SLA currently only applies if you use all four Route 53 nameservers.

mmmooo 13y ago
Any thoughts on where/how is this 'home in' state is saved? Other the cache and filtering/acl state resolvers should be stateless, so would be interested in any details, especially if this is on a per-zone, or per-set of nameservers or etc basis. I've never seen bind9 act like this.
- colmmacc 13y ago
  I haven't read the bind source in a long time, but my best guess is that it's in memory. http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.htm http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.h... Has some details, and I believe Bind and PowerDNS call it "Smoothed RTT" or SRTT.
  - mmmooo 13y ago
    interesting, not a ton of details of how. off to the source I go, thanks. sounds like it assigns a 'score' of some sort to each authoritative ns.
    - isb 13y ago
      This might help - section 4.4 has formal details on the Bind server selection algorithms: http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theoretical-computer-science-internet-research-problems-spring-2002/lecture-notes/dns.pdf http://ocw.mit.edu/courses/mathematics/18-996-topics-in-theo...
      - mmmooo 13y ago
        yep definitely, an interesting implementation, and certainly almost impossible to guess from passive observation. thanks.
    - dsl 13y ago
      BIND assigns a score based on every IP it talks to and a hit rate. (so if ns1.foo.com resolves to 3 IPs, each is tracked individually, same if ns1.bar.com and ns1.baz.com are the same IP) It is a pretty small cache, maybe like 1024? This is all from fuzzy 5 year old memory.

smountcastle 13y ago

It depends on the implementation of the resolver, but in general when no information is known about a nameserver, the resolver will pick one at random. Overtime, it'll keep track of the latency and pick one (usually randomly within a band specifying a range of latencies). See this paper for more info: https://www.dns-oarc.net/files/workshop-201203/OARC-workshop-London-2012-NS-selection.pdf https://www.dns-oarc.net/files/workshop-201203/OARC-workshop...