How Stuff Works:
DNS Upstream Server Selection
Benno Overeinder
NLnet LabsIEPG – IETF 103, November 2018

How Stuff Works: The Plumbing of the Internet• 10 minutes presentation on a small and specific topic, maybe
overlooked but important for the functioning of the internet

DNS Upstream ServerSelection

Resolving Names: At First Sight?
mo.c.

.example.com?
resolverwww.exam
ple.co.comm?

.example.com

Resolving Names: After a Closer Look?
mo.c.

.example.com?
resolverwww.exam
ple.co.comm?

.example.com

multiplenameservers
for adomainMultiple Name Servers for a Domain

DNS Upstream Server Selection
performance• Different requirements, not always aligned• performance: obviouscuseyrit• probing: discovering (new) nameservers

probing• benign: no DDoS by unintended

on-path DNS spoofing attacks

DNSSEC?

nigbe• security: variance in server selection for

naggressive querying of name servers

Unbound Server Selection• Basic upstream selection process• sort IP-addresses (IPv4, IPv6) by timeout (RTO)• pick server random within RTT band (400 ms)• If timeout occurs• update timeout values (next slide)• start server selection again

Finding IP addresses• A, AAAA in NS records• fetches promiscuously for futureuse• servers get default value 376 ms

Timeout Parameter Calculation• Complexity of upstream name server selection is a multidimensional
problem mapped to one metric• Timeout values are determined with regular queries to name server• smoothed average RTT times of successful queries∨• increases due to packet loss, doubling timeout• penalty for servers that exhibit problems• e.g., no-DNSSEC (missing RRSIGs), no EDNS0 supportProbing Unresponsive Servers• Probing regime when server becomes unresponsive• timeout (with exponential backoff) exceeds 12 seconds• two (or more) consecutive exponential backoffs have just been done
• In probing regime, server is queried cautiously with regular requests (+ self-exclusion)• with little traffic, single request will probe the different servers• moderate traffic, several requests will pick up different address and probe• high traffic, all servers for domain probed at the same
• if more queries arrive, resolver answers with SERVFAILBlocking Regime• Upstream is in blocking regime when timeout reached 120 seconds• If no other working server exists, all queries are answered with SERVFAIL• Blocking status is cached until infra-ttl (default 15 mins)• After infra-ttl expired, one probe query is send to server in 15 mins
• full probe sequence would take about 240 seconds (sequence ofexponential backoffs until it is 120 seconds)

Config Options to Tweak Selection Process• Default behaviour of Unbound upstream selection process• robust and safe
• behaves “well” in the grand scheme of things (aka The Internet)• But Unbound is also used in/with• CDNs/Clouds/Datacenters: performance preference with fast-serverpermil & fast-server-num• satellite uplinks with 500 msec delays: increase initial timeout for packets

Concluding• Proper upstream server selection is important for• DNS performance (end-user experience, responsiveness, etc.)• stability of the Internet (millions of instances of software!)• Not standardised• Implementations for the various resolvers (e.g. BIND, Knot Resolver,PowerDNS Recursor, and Unbound) take different considerations into
their design decisions

Reading More …
• Background article on Unbound timeout:

https://www.nlnetlabs.nl/documentation/unbound/info-timeout/• Yingdi Yu, Duane Wessels, Matt Larson, and Lixia Zhang, “Authority

Server Selection of DNS Caching Resolvers”, ACM SIGCOMM Computer
Communication Review, Vol. 42, No. 2, April 2012

• Moritz Müller, Giovane Moura, Ricardo de O. Schmidt, and John

Heidemann, “Recursives in the Wild: Engineering Authoritative DNSServers”, in Proceedings of ACM Internet Measurement Conference (IMC’17), London, United Kingdom, November 2017