6 ms·
Good post. I would argue some of your locations and how many servers are actually needed, but that's splitting hairs. The real point I want to make is that th
by phil21 12y ago
Good post. I would argue some of your locations and how many servers are actually needed, but that's splitting hairs.
The real point I want to make is that the only companies really putting this amount of money into DNS infrastructure are DNS providers themselves. I know of no hosting provider/ISP/etc. who puts nearly this much thought or effort into DNS.
Even for myself - and I consider myself a DNS junkie - my anycast cluster was a dozen or so servers worldwide co-located w/ a mid-market CDN provider (plus a few locations from my own ASN). That setup was greater than 99% of DNS installs out there - but it would have fallen over under a major attack. It truly takes some skill and financial commitment to build out correctly.
- zzzcpan 12y agoI think OVH does that for DNS, but they already have infrastructure in place.
- skuhn 12y agoI agree with you, there are only two kinds of companies with the kind of DNS infrastructure that could withstand a large scale DDOS: 1. DNS hosting companies (Dyn, Amazon, etc.) 2. Large Internet companies (Yahoo, Google, etc.) And for sure not all of them! A former employer's public zone was hosted by a DNS hosting company that didn't use Anycast, didn't have a footprint outside US/EU, and seemed to have little to no idea when or why traffic spikes happened. So to do DNS really right you need a fair amount of money, some specialized expertise and knowledge of some non-DNSy things (Anycast, among others). I'm really not interested in hosting my own (public) DNS these days at work, it's just not worth the time and effort until you get gigantic. As with e-mail, there are specialists who can do it better than (most) places can. I do kind of worry about depending on one DNS provider, so I've tried to use two when possible. That's a whole other world of hurt though.