Comments on DNS Robustness Mark Allman Reformed IETF Native Applied Networking Research Workshop July 2018 ”Been away so long I hardly knew the place, Gee, it's good to be back home”
Observation #1 Allman 2
Observation #2 1.6 SLDs 1.5 1.4 Growth Rate 1.3 1.2 1.1 1 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 3
Observation #2 1.6 A RRs SLDs 1.5 1.4 Growth Rate 1.3 1.2 1.1 1 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 4
How Robust Is DNS? • “Good Enough” • But, … um … ahem … 1.6 A RRs SLDs 1.5 1.4 Growth Rate 1.3 1.2 1.1 1 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 5
How Robust Is DNS? • What do we mean by “robust”? • many dimensions • our focus: • always able to communicate with an auth server holding the DNS record we seek Allman 6
DNS Robustness root .org .com .edu .case.edu .icir.org .eff.org .cnn.com .ebay.com .berkeley.edu .icsi.berkeley.edu git.icir.org imaphost.icsi.berkeley.edu 7
DNS Robustness root .org .com .edu .case.edu .icir.org .eff.org .cnn.com .ebay.com .berkeley.edu •Community infrastructure .icsi.berkeley.edu git.icir.org •Many named replicas e.g., a-root, b-root, etc. imaphost.icsi.berkeley.edu •Many unnamed replicas i.e., via anycast routing 8
DNS Robustness root .org .com .edu .case.edu .icir.org .eff.org .cnn.com .ebay.com .berkeley.edu •Few named replicas .icsi.berkeley.edu git.icir.org ~80% of SLDs have <= 2 named auth servers •Unknown / variable use of anycast replicas imaphost.icsi.berkeley.edu •Myriad operators / policies 9
How Robust Is DNS? • Let’s measure some facets of the system at the SLD level that bear on robustness Allman 10
Datasets .com zone file Alexa .net zone file Top 1M .org zone file Once / Month Winnowed Zone File Apr 09 - Apr 18 Data courtesy of Verisign, Alexa, Emile Aben (RIPE) and Quirin Scheitle (TUM) Allman 11
Robustness Specifications • RFC 1034: must have multiple authoritative nameservers for robustness • RFC 2182: authoritative nameservers must be geographically and topologically diverse Allman 12
What Is Network Diversity? • We start cheap & conservative: • use /24 address blocks to define diversity • two addresses in one /24: no diversity • two addresses in two /24s: diversity (but, really, who knows?!) • Future work includes using historical routing data Allman 13
Spec. vs. Reality = Min 55 50 45 Percentage of SLDs 40 35 30 25 20 15 10 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 14
Spec. vs. Reality = Min > Min 55 50 45 Percentage of SLDs 40 35 30 25 20 15 10 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 15
Spec. vs. Reality = Min < Min > Min 55 50 45 Percentage of SLDs 40 Upper Bound 35 30 25 20 15 Lower Bound 10 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 Allman 16
Shared Infrastructure root .org .com .edu .case.edu .icir.org .eff.org .cnn.com .ebay.com .berkeley.edu .icsi.berkeley.edu git.icir.org imaphost.icsi.berkeley.edu 17
Shared Infrastructure root •Different parts of the tree, but rely on same auth servers .org .com .edu .case.edu .icir.org .eff.org .cnn.com .ebay.com .berkeley.edu .icsi.berkeley.edu git.icir.org imaphost.icsi.berkeley.edu 18
Shared Infrastructure • Hierarchy belies much concentration • Concentration compounds issues • Perhaps concentration invites trouble 19
Nameserver-Level Analysis • For each SLD, determine the number of other SLDs that use the same set of nameservers (by IP address) • Repeat for each month in dataset 20
Nameserver-Level Analysis 100000 Number of Overlapping SLDs 10000 Distributions are fairly Maximum 9-10K SLDs share the 1000 stable across time. Median same set of nameservers. 100 Half the SLDs share the same nameservers 10 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 as > 100 other SLDs. 21
Network-Level Analysis • For each SLD determine the number of other SLDs whose nameservers fall within the same /24 address blocks • Repeat for each month in dataset 22
Network-Level Analysis 100000 2x Number of Overlapping SLDs 10000 Half the SLDs are in groups with > 3K other SLDs 25x Maximum 1000 Median 100 Nameserver concentration is increasing over time. 10 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 23
Top 10 SLD Groups Rank Num. SLDs Num. /24s Same Last Hop ✓ 1 71,472 2 2 2 69,637 ✓ 3 15,421 2 ✓ 4 13,044 2 5 2 8,347 ✓ 6 6,111 2 ✗ 7 5,568 3 8 2 5,076 9 4,788 2 10 4,611 4 Total 23 204,075 > 20% of the popular SLDs > 20% of the popular SLDs fall within 23 /24 blocks! rely on 19 edge networks! 24
Conclusions • DNS sky is not falling • But, we have some unhealthy habits … • too little auth server replication • too much auth server concentration • Note: concentration is not wholly bad 25
Questions? Comments? Draft paper: https://www.icir.org/mallman/pubs/All18 Mark Allman, mallman@icir.org https://www.icir.org/mallman/ @mallman_icsi
Recommend
More recommend
