OX PowerDNS
A Faster, Safer and More Secure Internet

Jan Hilberath
DNS Summer Day 2019, Tokyo, 2019-06-28

The PowerDNS Organisation
An OX Company••

2PowerDNS is a wholly owned subsidiary ofOpen-Xchange•

Focusing on DNS, Network and Infrastructure Security for
Service Providers

1999

2002 - 2006

2007 - 2013

Database driven DNS
and geographical loadbalancing

PowerDNS Nameserver Authoritative, Recursor
goes open source
open source products
launched

Mainly based in The Hague, Netherlands•

Engineering, QA, EU Support, ProductManagement•

Worldwide Sales & Professional Services(Consulting, Migration, Customization)2015 - 20162018 - 2019

PowerDNS merges with
Open-Xchange,
Malware-Protection &Parental Control

DNS Privacy & Security, OXProtect

DNS Portfolio Overview
OX PowerDNS and DNS-based Solutions

3OX PowerDNSRecursor

OX PowerDNS
Authoritative
ServerReliable, fast andsecure DNS
resolving andcaching server.

Versatile
authoritative
domain namehosting.

OX PowerDNS
DNSdistOX Protect

Load Balancing andDDoS protection foryour DNS traffic.

Network-based
security for mobileand fixed networks.

OX PowerDNS Recursor
Next Generation DNS Resolving• High-performance, low latency DNS Resolver• Reliable DNS service providing the power and flexibility modern DNS
deployments require• Includes a Lua Scripting Engine for maximum flexibility• Deployment and automation tools to manage large-scale deployments• Automated reports, graphs and a real-time dashboard give details of
the most important KPIs
• Prometheus Reporting for easy monitoring integration

4

OX PowerDNS Authoritative Server
Scale-up Your DNS Hosting• Versatile Authoritative server for hosting domain names• Flexible and highly scalable to serve very large-scale hosting
deployments and individual needs• Leading DNSSEC implementation used by many of the worlds larger
domain hosters• Domain Management with ZoneControl• Geographical load balancing sends visitors to the closest servers• Multiple Database Backends including• MySQL, LDAP, Lua, GeoIP

5

OX PowerDNS DNSdist
Superior Performance with DNS Proxy• Load Balancer for DNS-traffic in front of recursive or authoritativeservers• Optimized to protect against malicious and abusive traffic such as
DDoS attacks, DNS tunneling and exfiltration• Flexible Lua policy engine allows customization to meet individual andlocal needs• Supports DNS over TLS (DoT) and DNS over HTTPS (DoH)• Works seamlessly with OX PowerDNS Recursor, but also with legacy
DNS recursive servers• Monitoring capabilities, including Prometheus support

6

OX Protect
Network-Based Security for Mobile and Fixed Networks• Provides a secure connectivity experience for all connected devices(traditional and IoT devices) using the broadband/mobile network• Offers safe browsing with protection for families (profiles, content
restrictions, time windows) or for business• Comes with a white-labeled web control panel and a brandable
mobile app for iOS and Android• Protects against malware and phishing, detects infected devices,
notifies via text or push notifications• Based on DNS filtering; supports encrypted traffic• No on-premise equipment required7

DNS Privacy & Encryption
DNS Encryption with DoH and DoT• Recently approved IETF Encryption standard for DNS• DNS over TLS (DoT)• DNS over HTTPS (DoH)• Almost no ISPs or Mobile Operators support encrypted DNS
today(Many/most are using software that doesn’t even supportencrypted DNS)

• Browser Manufacturers are pushing to use this by default• Mozilla are moving to using a set of Trusted Recursive
Resolvers: Completely bypassing operator DNS• Google Chrome will attempt to use DoH by default:
Will fallback to unencrypted for the time being; Will offer
OTT alternatives

Browser Vendors are making Privacy and Encryption central to DNS deployments.
Network operators MUST deploy DoH/DoT in their network to keep control over
DNS traffic and prevent it going to OTT vendors.
8

IoT Security
Protecting IoT Devices with DNS• Number of IoT Devices is increasing exponentially, but they are hugely insecure:• Malware, Botnets, DDoS, Espionage, …
• Endpoint protection cannot be deployed• Network Operators must protect themselves and their customers• OX Protect offers network-based IoT Protection• Detect and alert on potential infected IoT devices• Prevent Botnet activation• Protect your network from ‘IoT’ DNS based DDoS
• Potential Revenue stream from IoT Device owners• Network Security using DNS is the only cost-effective andscalable solution• Value-added service offering for providers
9• Secure connectivity and protection for subscribers

5G Is On Its Way
DNS software needs to meet 5G requirements•

5G networks are being deployed• Improved bandwidth for subscribers
and their devices• Wholesale architectural changes
towards an SDN/NFV based network• Specific goals for new services such as
VR/AR• Typical legacy DNS deployments do notsupport 5G latency targets or architecturalrequirements• OX PowerDNS supports 5G optimized DNS
requirements such as VNF, Edge Computing,Encryption etc.

10

Deployment at the edge ofthe network

Support for control plane
functionality (monitoring,deployment automation,configuration management etc.)Software must be VNF(VMs, Containers etc)
capableEncrypted DNS Support

High numbers of servers
require orchestration

Localized Content Serversupport

OX PowerDNSMeeting your DNS software and architecture needs
NFV/Control Plane

Ansible automation:
P Deployment Automation
P Elastic Scaling
P Config Management
Monitoring & Reporting
P Prometheus API
endpoints for statistics
per server
P Metronome support
P Long-term query logging& searching
P End-To-End performancemeasurement

11Latency

Security and Privacy

P Edge DNS service near
the end-userPrivacy

P Tiered caching

P DNS over TLS (DoT)P DNS aware LoadBalancing to optimise
cache hits

P DNS over HTTPs (DoH)P DNSSEC signing andvalidation
Security Malware filtering
P System-Wide or Per-User
Malware filtering
P Block/detect Phishingand Malware
P Alerting/Notification
SupportFast local content

IoT

P EDNS client-subnet
support – Passing
information about theoriginal IP address todownstream server

P Detect and alert when IoT
devices are potentially
infected with malware

P Locality Tagging

P Protect your networkfrom ‘IoT’ DNS basedddos.

P Prevent Botnet activation

Monitoring & Notifications• Statistics-engine for rapid metrics
displaying and monitoring• Report-engine to automaticallygenerate periodically reports about
current and past performance• Remotely pollable statistics usingPrometheus• Query-logging facility to store historyof DNS queries and logs
(advanced troubleshooting andinvestigation of malicious requests orDoS)

12

Open Source Based Success
Carrier-grade solutions for large network needs• PowerDNS products are based on open-source software
utilizing OSS benefits for customers:• Full access to source code of the core products• Strong and active community of contributors• Trust that the core products are mature and widelyused• Open-Xchange maintains a commitment to keep thecore of PowerDNS products open-source
13• OX PowerDNS combines the best of the community version
plus specific large network needs:• Providing the features and requirements necessary tooperate DNS at scale• Specific functions for Telcos, Hosters, NetworkOperators and large enterprises• Feature requests and customization for commercialcustomers

Outstanding Support & MaintenanceWe partner with our customers• 24x7 OX Support from Open-Xchange experts and PowerDNS developers• Hands-on installation and configuration assistance for optimal performance of your PowerDNS platform• Local Professional Services team able to assist with advanced customization and migration• Periodic DNS Health-check of DNS configurations on a regular basis• Remote Monitoring service for additional support, quick troubleshooting and platform optimization• Very active community that identifies and solves potential issues in pre-releases• Bug-bounty program for waterproof security

24x7 Support
14Prof. Services

Health-CheckOX Dovecot 株式会社
〒103-0007
東京都中央区日本橋浜町2-60-10
浜町公園ビル4F+81 3 3527 3630

www.open-xchange.com
www.dovecot.co.jp