RFC 3258
Distributing Authoritative Name Servers via Shared Unicast Addresses
Request for Comments: 3258 ✨ Distributing Authoritative Name Servers via Shared Unicast Addresses 🎀
Okay bestie, let's get into it 💅 This one is RFC 3258, written by T. Hardie of Nominum, Inc. 🌸 It's an Informational doc from April 2002, so it's sharing practices and ideas, not an actual Internet standard 🦋 It doesn't obsolete anything and it doesn't update anything either, so it's just doing its own thing 💖
Status of This Memo 🫶
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. ✨
Copyright Notice 🎀
Copyright (C) The Internet Society (2002). All Rights Reserved. 💜
Abstract 🌈
This memo describes a set of practices intended to enable an authoritative name server operator to provide access to a single named server in multiple locations. The primary motivation for the development and deployment of these practices is to increase the distribution of Domain Name System (DNS) servers to previously under-served areas of the network topology and to reduce the latency for DNS query responses in those areas. 🍓
1. Introduction ✨
Okay so this memo is basically about letting one authoritative name server operator run the same named server from a bunch of different places 🧚 The big goal is spreading DNS servers out to places that have been kind of forgotten by the network, and making DNS answers way faster for people there 🚀 It's giving "bring the server closer to the people" energy, no cap 💖
This doc assumes that each authoritative server maps to exactly one administrative entity (operator) 💅 It also says there's no guidance at all for caching name servers, so that's not the vibe here 🙈 The shared unicast system is specifically about IPv4, and whether it works for IPv6 is something people still need to study 🌸
Also, this system is related to the one described in [ANYCAST], but it's lowkey different 👑 It doesn't need its own dedicated address space, it doesn't need routing changes, and it doesn't need the other pieces of a full anycast setup that the [ANYCAST] doc describes 🦋
2. Architecture ✨
2.1. Server Requirements 💖
Operators of authoritative name servers may want to check out [SECONDARY] and [ROOT] for general guidance on good practice for authoritative name servers 🎀 On top of being configured as a normal authoritative name server, each host in a shared-unicast system SHOULD be set up with two network interfaces 🫶 Those can be two physical interfaces, or one physical interface mapped to two logical interfaces 🌈
One of the interfaces SHOULD use the IPv4 shared unicast address that belongs to the authoritative name server 💅 The other one, called the administrative interface below, SHOULD use its own IPv4 address that's specific to that host 🍓 The host SHOULD respond to DNS queries only on the shared-unicast interface 🙈 To give the most consistent answers across the mesh of anycast hosts, it's good practice to limit responses on that interface to zones the host is authoritative for ✨
2.2. Zone File Delivery 🎀
To cut down on the risk of man-in-the-middle attacks, zone files SHOULD be delivered to the administrative interface of the servers in the mesh 🔥 Secure file transfer methods and strong authentication SHOULD be used for all transfers 🫶 If the hosts in the mesh make their zones available for zone transfer, the administrative interfaces SHOULD be used for those transfers too, so they avoid the potential routing-change problems for TCP traffic that are covered in Section 2.5 below 💜
2.3. Synchronization 🌸
Authoritative name servers may be loosely or tightly synchronized, depending on what the operating organization decides 🦋 As noted below in Section 4.1.2, if servers using the same shared unicast address aren't synchronized, that could cause problems for some users of this service 😭 To keep that risk down, switch-overs from one data set to another SHOULD be coordinated as much as possible 🧚 Synchronized clocks on the participating hosts plus set switch-over times give you a basic level of coordination 🍓 A more complete coordination process would involve:
a) receipt of zones at a distribution host
b) confirmation of the integrity of zones received
c) distribution of the zones to all of the servers in the mesh
d) confirmation of the integrity of the zones at each server
e) coordination of the switchover times for the servers in the
mesh
f) institution of a failure process to ensure that servers that
did not receive correct data or could not switchover to the new
data ceased to respond to incoming queries until the problem
could be resolved.Depending on the size of the mesh, the distribution host may also be a participant 👑 For authoritative servers, it may also be the host where zones get generated ✨
This document assumes that the usual DNS failover methods are the only ones used to keep the data reachable for clients 💅 It does NOT advise withdrawing routes when something fails. Instead, it advises that the DNS process shut down so servers on other addresses get queried 🙈 This is a choice between performance and operational complexity 🌈 Sure, it would be possible to have some process withdraw the route for a specific server instance when it's unavailable, but making sure that happens reliably is a LOT of operational complexity 😭 With the existing DNS failover methods, the small performance gain just won't be worth the extra complexity for most uses 💖
2.4. Server Placement 🦋
Geographic spread helps reduce the impact of service disruptions caused by local problems, but it's diversity of placement in the network topology that's really driving these distribution practices 🧚 Server placement SHOULD emphasize that diversity 💜 Ideally, servers SHOULD be placed topologically near the points where the operator exchanges routes and traffic with other networks 🫶
2.5. Routing 👑
The organization running the mesh of servers that share a unicast address MUST have an autonomous system number and speak BGP to its peers 🔥 To those peers, the organization announces a route to the network containing the name server's shared-unicast address 🎀 The organization's border routers MUST then deliver traffic destined for the name server to the nearest instantiation 💅 Routing to the administrative interfaces for the servers can use the normal routing methods of the administering organization 🌸
Here's a potential problem with shared unicast addresses: routers forwarding traffic to them might have more than one route available, and those routes might actually reach different instances of the shared unicast address 😭 Stuff like DNS, where communication is usually independent request-response messages that each fit in a single UDP packet, has no problem with this 💖 Other applications, where multiple packets have to reach the same endpoint (e.g., TCP), may fail or have unworkable performance in some situations 🙈 Split-destination failures can happen when a router does per-packet (or round-robin) load sharing, or when a topology change shifts the relative metrics of two paths to the same anycast destination, etc. 🌈
Four things soften how bad this problem is 🍓 The first is that UDP is a pretty big chunk of query traffic to name servers ✨ The second is that the whole point of this proposal is diversifying topological placement, so for most users, coordinating placement means new instances of a name server will sit at a significantly different cost metric from existing instances 🧚 Some users may end up in the middle, but that should be relatively rare 🦋 The third is that per-packet load sharing is only one of the possible load sharing mechanisms, and other mechanisms are getting more popular 💅
Lastly, when the traffic is TCP, per-packet load sharing is in use, and equal cost routes to different instances of a name server are available, any DNS implementation that measures server performance to pick a preferred server will quickly prefer a server where this problem doesn't happen 👑 For the DNS failover mechanisms to reliably avoid this problem, though, deployments using shared unicast distribution MUST make sure that not all of the servers for a specific zone are participants in the same shared-unicast mesh 🔥 To guard even against the case where multiple meshes have a set of users affected by per-packet load sharing along equal cost routes, organizations implementing these practices SHOULD always provide at least one authoritative server that isn't a participant in any shared unicast mesh 💖 Anyone deploying shared-unicast meshes should note that any specific host may become unreachable to a client if a server fails, a path fails, or the route to that host is withdrawn 😭 These error conditions aren't specific to shared-unicast distributions, though; they'd happen with standard unicast hosts too 🫶
Since ICMP response packets might go to a different member of the mesh than the one that sent the packet, packets sent with a shared unicast source address SHOULD also avoid using path MTU discovery 🌸
Appendix A. has an ASCII diagram of an example of a simple implementation of this system 🎀 In it, the odd-numbered routers deliver traffic to the shared-unicast interface network and filter traffic from the administrative network 🦋 The even-numbered routers deliver traffic to the administrative network and filter traffic from the shared-unicast network 🧚 They're drawn as separate routers because that makes it easier to explain, but they could easily be separate interfaces on the same router 💅 Similarly, a local NTP source is drawn in for synchronization, but the level of synchronization needed wouldn't require that source to be local or a stratum one NTP server 👑
3. Administration ✨
3.1. Points of Contact 💖
A single point of contact for reporting problems is crucial to running this system properly 🌈 If an external user needs to report a problem with the service, there MUST be no ambiguity about who to contact 🔥 If internal monitoring doesn't show a problem, the contact may, of course, need to work with the external user to figure out which server generated the error 🫶
4. Security Considerations 🔥
As a core piece of Internet infrastructure, authoritative name servers are common targets of attack 😭 The practices outlined here increase the risk of certain kinds of attacks and reduce the risk of others 💀
4.1. Increased Risks 🌈
(Part 1 ends here. Part 2 picks up with the rest of Section 4.1 and beyond, so stay tuned bestie 💜✨)
4.1.1 Increase in physical servers ✨
okay so this design means way more physical servers 🖥️, and more boxes means more chances for someone to misconfigure one and accidentally open a door for an attacker 😭. The admin running a mesh SHOULD make sure that patches and security settings applied to one member are right for every member, and then actually applied to every member 🫶. Also, "genetic diversity" (running code from different code bases) can be a solid move for dodging attacks that target one specific code base 💅. BUT if you want every single named server to keep giving consistent answers, that diversity SHOULD go between different shared-unicast meshes, or between a mesh and a related unicast authoritative server, not inside the mesh itself 🧚.
4.1.2 Data synchronization problems 🌸
The systemic synchronization we talked about above SHOULD be backed up by syncing the actual data on each server too 🔁. DNS is loosely coupled on purpose, but debugging a zone gets way harder when two servers sharing one unicast address can give different answers to the same query 😵💫. Picture this: the data for www.example.com changes, and the admins check the example.com authoritative name servers. They SHOULD NOT have to poke every single instance of a named authoritative server just to confirm the change, which would be exhausting 🙄. Using NTP for a synced clock during switch-over fixes some of this, but you still REQUIRED mechanisms for handling failures during the switchover 🚨. Specifically, a server that can't finish the switchover MUST NOT roll back to an older version. It MUST stop answering queries so that the other servers get the queries instead 💀.
4.1.3 Distribution risks 🔐
If the way zone files get shipped out to the servers isn't well secured, a man-in-the-middle attack could sneak in false info, and that's a whole disaster 😱. Digital signatures help a lot here, but encrypted transport and tight access lists are a must-have partner for them 🔒. Zone files go to the administrative interfaces of the meshed servers, so the access control list for distributing them SHOULD include the administrative interface of the server or servers, not their shared unicast addresses 🎀.
4.2 Decreased Risks 🦋
Good news, though: more physical servers means a DoS attack is much less likely to flatten a big chunk of the DNS infrastructure 💪. The extra servers also soften the blow of machine crashes, fiber cuts, and localized disasters, because each machine has fewer users depending on it 🌈.
5. Acknowledgments 🫶
Huge thanks to Masataka Ohta, Bill Manning, Randy Bush, Chris Yarnell, Ray Plzak, Mark Andrews, Robert Elz, Geoff Huston, Bill Norton, Akira Kato, Suzanne Woolf, Bernard Aboba, Casey Ajalat, and Gunnar Lindberg, who all gave input and commentary on this work 👑. The editor also wants to remember the late Scott Tucker in particular 🕊️. His huge systems experience and plain common sense shaped the editor's own deployment experience a lot, and everyone who knew him misses him 💜.
6. References 📚
- [SECONDARY] Elz, R., Bush, R., Bradner, S. and M. Patton, "Selection and Operation of Secondary DNS Servers", BCP 16, RFC 2182, July 1997.
- [ROOT] Bush, R., Karrenberg, D., Kosters, M. and R. Plzak, "Root Name Server Operational Requirements", BCP 40, RFC 2870, June 2000.
- [ANYCAST] Patridge, C., Mendez, T. and W. Milliken, "Host Anycasting Service", RFC 1546, November 1993.
Appendix A. 🧩
Here's the diagram, the full setup with the peers, the switch, the routers, and the WAN, all laid out 🗺️:
__________________
Peer 1-| |
Peer 2-| |
Peer 3-| Switch |
Transit| | _________ _________
etc | |--|Router1|---|----|----------|Router2|---WAN-|
| | --------- | | --------- |
| | | | |
| | | | |
------------------ [NTP] [DNS] |
|
|
|
|
__________________ |
Peer 1-| | |
Peer 2-| | |
Peer 3-| Switch | |
Transit| | _________ _________ |
etc | |--|Router3|---|----|----------|Router4|---WAN-|
| | --------- | | --------- |
| | | | |
| | | | |
------------------ [NTP] [DNS] |
|
|
|
|
__________________ |
Peer 1-| | |
Peer 2-| | |
Peer 3-| Switch | |
Transit| | _________ _________ |
etc | |--|Router5|---|----|----------|Router6|---WAN-|
| | --------- | | --------- |
| | | | |
| | | | |
------------------ [NTP] [DNS] |
|
|
|
|
__________________ |
Peer 1-| | |
Peer 2-| | |
Peer 3-| Switch | |
Transit| | _________ _________ |
etc | |--|Router7|---|----|----------|Router8|---WAN-|
| | --------- | | ---------
| | | |
| | | |
------------------ [NTP] [DNS]7. Editor's Address 📬
Ted Hardie
Nominum, Inc.
2385 Bay Road.
Redwood City, CA 94063
Phone: 1.650.381.6226
EMail: Ted.Hardie@nominum.com8. Full Copyright Statement ©️
Copyright (C) The Internet Society (2002). All Rights Reserved. 🌈
Okay, the legal bit, and it matters 🫡. You can copy and share this document, and translations of it, and you can make derivative works that comment on or explain it, or help people implement it. You can publish and distribute those in whole or in part, with no restrictions of any kind, as long as the copyright notice and this paragraph stay on every copy and derivative work 💖. The document itself can't be modified in any way, though. That means no removing the copyright notice or the references to the Internet Society or other Internet organizations. The exceptions are when you need it to develop Internet standards, in which case the copyright procedures in the Internet Standards process have to be followed, or when you're translating it into languages other than English 🌍.
The permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns ♾️.
This document and the information in it are provided "AS IS", and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 💐
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society ✨
📦 where this page comes from
- ietf: rfc3258 2002-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms