High performance recursive DNS solution Peng Zuo zuopeng@cnnic.cn

Agenda Introduction to recursive resolver Problems of the recursive resolver SDNS-R: High-performance recursive DNS solution

How DNS works User opens browser, enters URL Browser now has IP Recursive resolver Browser sends HTTP request to web server web server sends HTML data stream Browser renders HTML data

DNS Server Types DNS Server: a server that answers DNS queries. Functional Differences Authoritative DNS Server Caching DNS Server/Recursive DNS Server Forwarding DNS Server Relational Differences Primary and Slave Servers Public and Private Servers

Ask example server @ ns.example.cn (+ glue) DNS Server Types root-server www.example.cn A ? Add to cache Ask cn server (+ glue) Recursive Resolver Stub Resolver www.example.cn A ? www.example.cn A ? gtld-server 192.168.5.10 Ask example server @ ns.example.cn (+ glue) www.example.cn A ? 192.168.5.10 example-server + Properties of the recursive DNS Maintains a cache of recently request data Access to the entire range of DNS world Combination of forwarding DNS and recursive DNS Forwarding DNS server Recursive DNS server

Agenda Introduction to recursive resolver Problems of the recursive resolver SDNS-R: High-performance recursive DNS solution

Security Issue Various DDoS attack Cache poisoning (Kaminsky attack) Amplification attack

Nxdomain flood ? ? ? ? Recursive DNS Authoritative DNS Botnet jgalk.dsjgdgasg.cn ? ? 5jt.d5t53g.43t.net ? 53sas.kdjgsjals.com ? 325jkdngoug.cn Recursive DNS Authoritative DNS Botnet The recursive server is running out of available resource!! randomly generated subdomain strings Cache

DNS Server Types CDNs depend on user’s DNS to direct requests Remote DNS services break this assumption

Agenda Introduction to recursive resolver Problems of the recursive resolver SDNS-R: High-performance recursive DNS solution

SDNS-R: High performance Recursive DNS Cache Forward Log RCM New design and architecture Support DNS view High performance Cache  performance is about 100 times higher than  common DNS server Forward  performance is about 10 times higher than  common DNS server High Performance DNS Engine Operation System Common DNS server SDNS-R Cache performance (QPS) 30,000 ~ 150,000 10,000,000 Forward performance (QPS) 5,000 ~ 15,000 50,000 + +

Benefits DNSSEC traffic grows up sharply The average traffic is up to about 4.5 times The size of None-exist domain response message is up to about 12 times larger Larger Bandwidth 10,000,000 = 100 * 100,000 Internet Reduce cost significantly Mitigate Nxdomain flood attack Easy to maintain Anti-attack device 10GE More Servers & More cabinets in IDC room A DNS node with 10 Gb bandwidth 2 SDNS-R 100 common DNS servers …… Higher Cost 100,000 QPS per server 10,000,000 QPS per server

Improvement of view function view: A powerful and useful feature of BIND 9 that lets a name server answer a DNS query differently depending on who is asking. Configuring a large number of DNS views uses more device memory and more processor time. SDNS-R improves view function: Speed up DNS view lookup Reduce time complexity of DNS view lookup Lower memory consumption optimized data structure and algorithm Expand the use of View function: from IP to IP + domain

Architecture of a public DNS Example: A public DNS consists of SDNS-R Recursive DNS server Forwarding DNS server User in Beijing Beijing 10.10.10.10 Public DNS User in Shanghai Shanghai Hongkong User in Hongkong Suboptimal route Guangzhou

Thanks!