4 ms·

It's simple except that you need to have capacity greater than what is achievable by people controlling the DDOS. I'm not up to date on what that number is the

by skuhn 12y ago

It's simple except that you need to have capacity greater than what is achievable by people controlling the DDOS. I'm not up to date on what that number is these days, but a few years ago 100Gbit/s was the target. For an Anycast DNS service, you don't need that in every site -- if you're willing to take small sites offline and degrade your service's end-user performance in this scenario. You will still need it in 2-3 sites, probably located in US west / US east / EU west because of the cost of datacenter space and the availability of cheap connectivity. Serving 100Gbit/s requires 20 10G circuits in each site (~$15-30k/mo), 80 servers (2-3 racks, so $5-10k/mo), and a not-so-cheap router. So your monthly opex is $20-40k per site, $60-120k worldwide. Your capex is $450k per site, $1.35mm worldwide. It's not an insane amount of money, but it is kind of a lot to spend on DNS. It's particularly tough to justify at a lot of companies that you need this kind of buildout, when normally you can operate on 1/20th that amount of hardware.

phil21 12y ago
Good post. I would argue some of your locations and how many servers are actually needed, but that's splitting hairs. The real point I want to make is that the only companies really putting this amount of money into DNS infrastructure are DNS providers themselves. I know of no hosting provider/ISP/etc. who puts nearly this much thought or effort into DNS. Even for myself - and I consider myself a DNS junkie - my anycast cluster was a dozen or so servers worldwide co-located w/ a mid-market CDN provider (plus a few locations from my own ASN). That setup was greater than 99% of DNS installs out there - but it would have fallen over under a major attack. It truly takes some skill and financial commitment to build out correctly.
- zzzcpan 12y ago
  I think OVH does that for DNS, but they already have infrastructure in place.
- skuhn 12y ago
  I agree with you, there are only two kinds of companies with the kind of DNS infrastructure that could withstand a large scale DDOS: 1. DNS hosting companies (Dyn, Amazon, etc.) 2. Large Internet companies (Yahoo, Google, etc.) And for sure not all of them! A former employer's public zone was hosted by a DNS hosting company that didn't use Anycast, didn't have a footprint outside US/EU, and seemed to have little to no idea when or why traffic spikes happened. So to do DNS really right you need a fair amount of money, some specialized expertise and knowledge of some non-DNSy things (Anycast, among others). I'm really not interested in hosting my own (public) DNS these days at work, it's just not worth the time and effort until you get gigantic. As with e-mail, there are specialists who can do it better than (most) places can. I do kind of worry about depending on one DNS provider, so I've tried to use two when possible. That's a whole other world of hurt though.

by skuhn 12y ago

phil21 12y ago

Good post. I would argue some of your locations and how many servers are actually needed, but that's splitting hairs. The real point I want to make is that the only companies really putting this amount of money into DNS infrastructure are DNS providers themselves. I know of no hosting provider/ISP/etc. who puts nearly this much thought or effort into DNS. Even for myself - and I consider myself a DNS junkie - my anycast cluster was a dozen or so servers worldwide co-located w/ a mid-market CDN provider (plus a few locations from my own ASN). That setup was greater than 99% of DNS installs out there - but it would have fallen over under a major attack. It truly takes some skill and financial commitment to build out correctly.

zzzcpan 12y ago
I think OVH does that for DNS, but they already have infrastructure in place.
skuhn 12y ago
I agree with you, there are only two kinds of companies with the kind of DNS infrastructure that could withstand a large scale DDOS: 1. DNS hosting companies (Dyn, Amazon, etc.) 2. Large Internet companies (Yahoo, Google, etc.) And for sure not all of them! A former employer's public zone was hosted by a DNS hosting company that didn't use Anycast, didn't have a footprint outside US/EU, and seemed to have little to no idea when or why traffic spikes happened. So to do DNS really right you need a fair amount of money, some specialized expertise and knowledge of some non-DNSy things (Anycast, among others). I'm really not interested in hosting my own (public) DNS these days at work, it's just not worth the time and effort until you get gigantic. As with e-mail, there are specialists who can do it better than (most) places can. I do kind of worry about depending on one DNS provider, so I've tried to use two when possible. That's a whole other world of hurt though.