The Case for DNS Redundancy

The Domain Name System, or DNS, provides the location/IP address of the server that hosts the domain that you are trying to access. The DNS resolution process (as explained in the image below) is the first step in the sequence of events that are triggered when you enter a domain name into your browser. If this process does not complete, the end user is left facing an error page stating, “Server Not Found/Webpage Not Available.” The user experience can be affected if DNS availability is compromised; user frustration is proven to lead to loss of revenue and brand reliability.

DNS is one of the most critical components to monitor for website performance, and is also the most vulnerable to cyber-attacks. The traditional DNS setup (in-house or a single-server deployment) makes it difficult to guarantee availability and poses a constant risk. Hackers can affect hundreds of websites by targeting a single DNS provider. Security threats to DNS providers are growing more complex and frequent – Akamai’s State of the Internet report cites a 71% increase in the frequency of Denial of Service (DDoS) attacks in Q3 2016 compared to Q3 2015, while another study by the Aberdeen Group states that 78% of organizations suffered four or more disruptions every month. There is an absolute need for solutions that can ensure resilient DNS service and mitigate the disruption caused by cyber attacks.

What is DNS redundancy?

DNS redundancy is a failsafe solution or a backup mechanism for DNS outages – outages resulting from configuration errors, infrastructure failure, or a DDoS attack. A single dedicated DNS server may not be sufficient in such scenarios; deploying multiple DNS providers in different networks ensures DNS availability, while cutting down the risk of DNS unavailability. Maintaining redundant DNS servers may not be the most cost-effective option for most enterprises, but it is one of the most effective ways to sustain DNS availability and mitigate the consequences of DDoS attacks.

How does it work?

In a traditional DNS architecture, there is usually a single DNS provider delegating a set of nameservers (a set of four nameservers) for the domain. The nameserver is picked at random by each incoming DNS request; if all the nameservers are overloaded with more requests than it can serve, then this creates latency in the DNS network making the resolution process sluggish and, eventually, the DNS server is rendered unavailable for most users.

When we introduce DNS redundancy to the single-server architecture, we are expanding the choice of nameservers that are available – there are more nameservers responding to the DNS queries. In addition to this, the nameservers are distributed between separate DNS networks reducing the risk of outages and increasing reliability of the DNS provider.

The image below describes a Primary-Secondary deployment; the primary server is the existing DNS solution where all of the DNS records are maintained and the secondary server will act like the Slave or back up. The primary DNS server proactively updates the zone data in the secondary server as needed, and both the primary and the secondary servers will respond to incoming DNS queries. This setup will only work if the primary DNS provider supports zone transfer.

(Source: Technical Brief: Improve Performance and Reliability with Supplemental DNS, Dyn)

The disadvantage of a primary-secondary DNS setup is that it doesn’t support advanced DNS functionality such as load balancing and traffic steering. If the primary server suffers an outage, then you will not be able to manipulate or update DNS records so this may not be the ideal solution for large enterprises that receive a lot of traffic.

Another type of DNS redundancy deployment is a primary-primary setup.

(Source: Technical Brief: Improve Performance and Reliability with Supplemental DNS, Dyn)

In this architecture, each DNS server acts as a primary server responding to DNS queries. The DNS records on each server are updated independently; this can be done using APIs or a separate custom application. Maintaining different DNS providers and keeping both in sync is a complex process, but it ensures higher availability without compromising on the advanced DNS functionalities supported by the DNS providers. So, it is important to choose DNS providers with similar functionalities and with which can work in tandem.

Choosing the right DNS service providers

When evaluating multiple DNS providers for your multi-DNS network, consider the global point of presence (PoP) of the provider along with features such as open APIs and reporting tools. You should also evaluate the performance of the DNS provider from different locations and under varying server load. The key is to deploy multiple DNS providers on separate networks that are seamlessly integrated using APIs or a custom program.

Using a global node network, a synthetic monitoring solution that offers DNS testing allows you to monitor the performance of DNS providers at any given location. The different types of DNS tests (Direct, Experience or Traversal), give a detailed report of points of failure and allows you to benchmark the performance of different service providers. Read this interesting post to gain an in-depth understanding of how you can manage DNS performance using Catchpoint.

Scalability, availability, and security are the biggest advantages of deploying DNS redundancy in your network. Using a global secondary DNS provider reduces downtime and improves end-user experience. It will help you maintain a consistent digital experience, which can translate to lower abandonment rates and better conversion rates.

To learn more about managing your DNS performance, click here.