RFC 7108
A Summary of Various Mechanisms Deployed at L-Root for the Identification of Anycast Nodes
RFC 7108: A Summary of Various Mechanisms Deployed at L-Root for the Identification of Anycast Nodes 🌸
Okay bestie, here's the title block first 💅
- Stream: Independent Submission ✨
- Authors: J. Abley (Dyn, Inc.) and T. Manderson (ICANN) 👑
- Category: Informational 🦋
- ISSN: 2070-1721
- Date: January 2014 🎀
- Obsoletes / Updates: this title block has no Obsoletes or Updates line, so it doesn't obsolete or update anything 🙈
Abstract
Okay so, anycast is a deployment technique that's super common for authoritative-only servers in the Domain Name System (DNS) 🧚 L-Root is one of the thirteen root servers, and it's set up exactly this way 🌈
People have used a bunch of techniques to map anycast infrastructure from the outside, meaning without any inside knowledge of where and how it's deployed 👀 The reasons people do this include operational troubleshooting and infrastructure risk assessment 💜 For L-Root specifically, you can measure and map its anycast infrastructure with the techniques in this document, and that's offered for the sake of operational transparency 🫶
This document lists all the facilities deployed at L-Root to help map its infrastructure, and it doubles as documentation for L-Root as a measurable service 🔥
Status of This Memo
This document is not an Internet Standards Track specification. It's published for informational purposes 🍓
This is a contribution to the RFC Series, independent of any other RFC stream 🌸 The RFC Editor chose to publish it at their discretion, and they make no statement about its value for implementation or deployment 💅 Documents approved for publication by the RFC Editor are not candidates for any level of Internet Standard. See Section 2 of RFC 5741 for more on that ✨
For info about this document's current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7108 🦋
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), which are in effect on the date of publication. Please read those carefully, because they describe your rights and restrictions regarding this document 💜
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions Used in This Document . . . . . . . . . . . . . . 3
3. Naming Scheme for L-Root Nodes . . . . . . . . . . . . . . . 3
4. Identification of L-Root Nodes . . . . . . . . . . . . . . . 3
4.1. Use of NSID . . . . . . . . . . . . . . . . . . . . . . . 4
4.2. Use of HOSTNAME.BIND/CH/TXT . . . . . . . . . . . . . . . 5
4.3. Use of ID.SERVER/CH/TXT . . . . . . . . . . . . . . . . . 6
4.4. Use of IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT and .../IN/A . 6
4.5. Use of NODES.L.ROOT-SERVERS.ORG/IN/TXT . . . . . . . . . 8
5. Provisioning of IDENTITY.L.ROOT-SERVERS.ORG . . . . . . . . . 9
6. Security Considerations . . . . . . . . . . . . . . . . . . . 9
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
8.1. Normative References . . . . . . . . . . . . . . . . . . 10
8.2. Informative References . . . . . . . . . . . . . . . . . 111. Introduction 🧚
The Domain Name System (DNS) is described in [RFC1034] and [RFC1035] 📚 L-Root is one of the thirteen root servers, and it uses anycast [RFC4786] ✨ Its service addresses are published in the A and AAAA Resource Record (RR) Sets for "L.ROOT-SERVERS.NET", and they're served from a substantial number of semi-autonomous servers spread across the Internet 🌍 You can find a list of the locations L-Root serves at [ROOT-SERVERS] 📍
Same deal as the abstract: there are lots of techniques for mapping anycast infrastructure from the outside, without inside knowledge of the deployment 👀 People do it for operational troubleshooting and infrastructure risk assessment, and for L-Root it's about operational transparency 💜
This document covers all the facilities L-Root currently offers to help identify nodes 🫶
2. Conventions Used in This Document 💅
This document has a bunch of examples of commands typed at a Unix (or Unix-like) command line, to show how the mechanisms for identifying L-Root nodes work 💻 In these examples, lines the user types start with the "%" prompt character, and a bare "%" means the output from the command has ended 🎀
Sometimes the output is too long to fit in the text, so a backslash character ("") marks a continuation 🌸
3. Naming Scheme for L-Root Nodes 🦋
Individual L-Root nodes have structured hostnames built like this:
<IATA Code><NN>.L.ROOT-SERVERS.ORGwhere:
<IATA Code>is picked from the list of three-character airport codes published by the International Air Transport Association (IATA) in the IATA Airline Coding Directory [ACD]; and<NN>is a two-digit numeric code that tells apart two different nodes near the same airport ✨
If there are multiple airports near a single L-Root node, one of them is chosen arbitrarily 🎲
Any more granular location data published for L-Root nodes (see Section 4.4 for an example) comes from the airport's location, not the node's actual location 📍 So it's not exact, bestie 🙈
4. Identification of L-Root Nodes ✨
L-Root service runs on one IPv4 address (199.7.83.42) and one IPv6 address (2001:500:3::42) 🌐 It's better to refer to the service by its DNS name (L.ROOT-SERVERS.NET) than by literal addresses, since addresses can change from time to time 💖
At the time of writing, there are 273 separate name server elements ("nodes") deployed in 143 locations, and together they provide L-Root service 🔥 A DNS query sent to an L-Root service address gets routed to exactly one of those nodes for processing, and the DNS response comes from that same node 🦋 Different clients may get routed to different nodes, and successive queries from the same client may also land on different nodes 😭 It's giving unpredictable routing, honestly 💀
The next sections summarise all the mechanisms L-Root provides so a client can tell which node is answering 🧚
Using HOSTNAME.BIND/CH/TXT (Section 4.2), ID.SERVER/CH/TXT (Section 4.3), or IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT or IDENTITY.L.ROOT-SERVERS/IN/A (Section 4.4) to identify a node when you're reporting a problem is usually reasonable 👍 But there's potential for re-routing between successive queries, so keep that in mind 🙈 An observed problem might relate to one node, while a later query using one of those three techniques could be answered by a different node 😬 If you use the Name Server Identifier (NSID) option on the exact queries that gave problematic responses, that gets rid of this possibility (see Section 4.1) 💅
4.1. Use of NSID 🎀
L-Root supports the Name Server Identifier (NSID) option [RFC5001], which returns the identity of an L-Root node along with the response to a DNS query 🌸 The NSID payload in those responses is the fully qualified hostname of the responding L-Root node 🫶
NSID lets you identify the node that sent a specific, requested response 🔎 This is super useful if you want to know exactly which node sent a particularly troublesome response 😤 The output of the diagnostic tool "dig" with NSID requested gives you the problem response along with the node identification, and that output can be the basis of a really useful trouble report 📝
NSID is specified as an EDNS(0) option [RFC6891] 🧚 Clients that don't support EDNS(0) signaling (or that depend on other systems that don't support EDNS0) may find this mechanism unavailable 🙈
You can request the NSID option with the widely used diagnostic tool "dig" and its "+nsid" option, like below 💻 Long lines have been truncated for this document, and a "" at the end of a line means it continues 🌈
% dig -4 @L.ROOT-SERVERS.NET . SOA +nsid \
+norec +noall +comments
; <<>> DiG 9.6.-ESV-R3 <<>> -4 @L.ROOT-SERVERS.NET . SOA +nsid \
+norec +noall +comments
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14913
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 23
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; NSID: 79 74 7a 30 31 2e 6c 2e 72 6f 6f 74 2d 73 65 72 76 65 72 73 \
2e 6f 72 67 (y) (t) (z) (0) (1) (.) (l) (.) (r) (o) (o) (t) (-) \
(s) (e) (r) (v) (e) (r) (s) (.) (o) (r) (g)
%
% dig -6 @L.ROOT-SERVERS.NET . SOA +nsid \
+norec +noall +comments
; <<>> DiG 9.6.-ESV-R3 <<>> -6 @L.ROOT-SERVERS.NET . SOA +nsid \
+norec +noall +comments
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33374
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 23
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; NSID: 79 74 7a 30 31 2e 6c 2e 72 6f 6f 74 2d 73 65 72 76 65 72 73 \
2e 6f 72 67 (y) (t) (z) (0) (1) (.) (l) (.) (r) (o) (o) (t) (-) \
(s) (e) (r) (v) (e) (r) (s) (.) (o) (r) (g)
%4.2. Use of HOSTNAME.BIND/CH/TXT 🦋
L-Root supports HOSTNAME.BIND/CH/TXT queries to return the identity of an L-Root node 💜 The TXT RDATA that comes back is the fully qualified hostname of the responding L-Root node ✨
The HOSTNAME.BIND/CH/TXT convention is described in [RFC4892] 📚
% dig -4 @L.ROOT-SERVERS.NET HOSTNAME.BIND CH TXT +short
"ytz01.l.root-servers.org"
%
% dig -6 @L.ROOT-SERVERS.NET HOSTNAME.BIND CH TXT +short
"ytz01.l.root-servers.org"
%4.3. Use of ID.SERVER/CH/TXT 🌸
L-Root supports ID.SERVER/CH/TXT queries to return the identity of an L-Root node 🎀 The TXT RDATA that comes back is the fully qualified hostname of the responding L-Root node 🫶
ID.SERVER/CH/TXT works exactly the same as HOSTNAME.BIND/CH/TXT (apart from the QNAME), as covered in Section 4.2 🧚 The re-routing caveat from that section between successive queries applies to ID.SERVER/CH/TXT too, so keep it in mind 🙈
The ID.SERVER/CH/TXT convention is described in [RFC4892] 📚
% dig -4 @L.ROOT-SERVERS.NET ID.SERVER CH TXT +short
"ytz01.l.root-servers.org"
%
% dig -6 @L.ROOT-SERVERS.NET ID.SERVER CH TXT +short
"ytz01.l.root-servers.org"
%4.4. Use of IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT and .../IN/A
okay so the L-Root operator runs a second DNS service right next to L-Root 🎀 it lives on the exact same nodes but on different addresses than the real L-Root service ✨ measuring this separate one should give you results that are representative of L-Root 💅 more on it in Section 5 🦋
the fully qualified DNS name IDENTITY.L.ROOT-SERVERS.ORG (note it's ORG, not NET 🙈) has TXT and A RR Sets that are unique to whichever node answers 💖 so clients can query IDENTITY.L.ROOT-SERVERS.ORG/IN/A and IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT and use the results to figure out individual nodes AND tell apart responses from different nodes 🧚
the TXT record in those answers is structured like this 🍓
- the fully qualified hostname of the node that answered 🌸
- the city the node is in 🌸
- the region the node is in, if it applies 🌸
- the economy the node is in (usually a country) 🌸
- the ICANN region the node is in 🌸 (the list of ICANN regions at the time of writing is at <http://meetings.icann.org/regions> ✨)
the A record in those answers is guaranteed to be unique to the responding node 🔥 the A RRType was picked so that as many client setups as possible could use this, because mapping a hostname to an IPv4 address seemed way more widespread than mapping it to anything else 💜 and whether a client can use this at all is totally separate from whether it has IPv4 or IPv6 transport locally 🫶
since identity data is published with IN-class resource records, you don't need to send queries straight to L-Root to get results 😭 you can get responses through recursive servers, and in that case the answer is the identity of the L-Root node that the recursive server reaches, not the "closest" L-Root node to the client 💅 this helps with remote troubleshooting, because asking a remote recursive resolver for IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT or IDENTITY.L.ROOT-SERVERS.ORG/IN/A can show which L-Root node that server is using (or was using when the cache got filled) 🌈
one caching thing to know 👀 responses to IDENTITY.L.ROOT-SERVERS.ORG/IN/A and IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT can get cached at different times, so they can stick around in a cache for overlapping periods 🦋 one possible visible effect is that when you read them from a cache, they can look incoherent (they refer to different nodes) even when the queries hit the cache (near) at the same time 😵 caches may also throw out the TTLs published by the authoritative server and swap in longer ones, as a matter of local policy 💀 so interpreting responses for these queries from caches should always keep these possible effects in mind 🫶
it's been noticed that IDENTITY.L.ROOT-SERVERS.ORG/IN/A queries are a super useful way to troubleshoot DNS problems with non-technical users 🥹 they can usually be walked through looking up an A record (for example, as a side effect of tools like ping) way more easily than they can be told how to use DNS-specific tools like dig 🎀
% dig IDENTITY.L.ROOT-SERVERS.ORG TXT +short
"ytz01.l.root-servers.org" "Toronto" "Ontario" "Canada" "NorthAmerica"
%
% dig IDENTITY.L.ROOT-SERVERS.ORG A +short
67.215.199.91
%4.5. Use of NODES.L.ROOT-SERVERS.ORG/IN/TXT
the fully qualified DNS name NODES.L.ROOT-SERVERS.ORG (note again, ORG not NET 💀) gives you multiple TXT RRs, one per node 🍓 it's basically the effective concatenation of every possible response to IDENTITY.L.ROOT-SERVERS.ORG/IN/TXT ✨
heads up: in the example below, we forced dig to use TCP 🧚 because we expect the response to be too big for UDP to handle 😭 also the list is truncated for clarity, and it'll change over time as new L-Root nodes get provisioned and old ones get decommissioned 🌸
% dig NODES.L.ROOT-SERVERS.ORG TXT +short +tcp | head -10
"abj01.l.root-servers.org" "Abidjan" "" "Cote d'Ivoire" "Africa"
"abj02.l.root-servers.org" "Abidjan" "" "Cote d'Ivoire" "Africa"
"akl01.l.root-servers.org" "Mangere" "" "New Zealand" "AsiaPacific"
"akl41.l.root-servers.org" "Mangere" "" "New Zealand" "AsiaPacific"
"akl42.l.root-servers.org" "Mangere" "" "New Zealand" "AsiaPacific"
"akl43.l.root-servers.org" "Mangere" "" "New Zealand" "AsiaPacific"
"akl44.l.root-servers.org" "Mangere" "" "New Zealand" "AsiaPacific"
"ams01.l.root-servers.org" "Haarlemmermeer" "" "Netherlands" "Europe"
"anc01.l.root-servers.org" "Anchorage" "Alaska" "United States" \
"NorthAmerica"
%5. Provisioning of IDENTITY.L.ROOT-SERVERS.ORG
okay so individual L-Root nodes each run their own dedicated, separate authority-only DNS server process that serves the IDENTITY.L.ROOT-SERVERS.ORG zone 🔥 the contents of that zone are unique to every node, so every responding node generates a node-specific response 💅
the contents of the IDENTITY.L.ROOT-SERVERS.ORG zone are therefore deliberately incoherent 🙈 the apparent zone contents depend on which node answers the query 🌈
the IDENTITY.L.ROOT-SERVERS.ORG zone is delegated to the single name server BEACON.L.ROOT-SERVERS.ORG 🧚 it's numbered on IPv4 and IPv6 addresses covered by the same routing advertisements as the L-Root service addresses ✨ so reachability of BEACON.L.ROOT-SERVERS.ORG lines up nicely with reachability of L.ROOT-SERVERS.NET 💖 which means measuring the IDENTITY service ought to give you similar results to measuring the L-Root service 🦋
it's considered best practice to always delegate a DNS zone to more than one name server [RFC2182] 👑 BUT as described, the IDENTITY.L.ROOT-SERVERS.ORG zone is delegated to just one server 😬 normally that would be a risk of failure if that single server isn't available 💀 however, given the purpose of the delegation here, and that the expected mitigation for a single node failing is routing the query to a different node, delegating to a single server in this use case is effective 🫶
at the time of writing, the ROOT-SERVERS.ORG zone is not signed with DNSSEC 🥲 when DNSSEC is deployed in that zone, the L.ROOT-SERVERS.ORG zone will also be signed 🔥 this will enable secure responses for queries for BEACON.L.ROOT-SERVERS.ORG and NODES.L.ROOT-SERVERS.ORG 💜
secure responses for IDENTITY.L.ROOT-SERVERS.ORG are unlikely to become available even with DNSSEC deployed in the parent 😭 the IDENTITY.L.ROOT-SERVERS.ORG service involves widely distributed static zone data, and managing key materials distributed to every L-Root node would be impractical to audit 🙈 signatures returned in secure responses would be correspondingly low value 💅
6. Security Considerations
okay this one is serious bestie 🥺 some operators of anycast services choose not to disclose the locations (or even the numbers) of their nodes, citing security concerns 🙈 the L-Root operator considers that none of the published information described in this document is truly secret 😤 any service element that provides service to the Internet can never truly be hidden from view 👀 since location info can be found no matter what, and easy access to it has diagnostic value, the L-Root operator has adopted a policy of operational transparency 🔥
the information presented in this document presents no new threat to the Internet 👑
7. Acknowledgements
the parts of the L-Root service that were deployed to facilitate IN-class mapping were discussed and implemented as part of an informal collaboration with Xun Fan, John Heidemann, and Ramesh Govidan 🫶 their contributions are acknowledged 💖 the motivation to facilitate mapping of L-Root as an anycast service using IN-class queries was inspired by [Fan2013] ✨
helpful reviews and comments on earlier versions of this document from Gaurab Upadhaya, Hugo Salgado, Brian Dixon, Bob Harold, Paul Hoffman, Jakob Schlyter, Andrew Sullivan, Bruce Campbell, S. Moonesamy, and Stephane Bortzmeyer were so appreciated 🥹🌈
8. References
8.1. Normative References
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[RFC2182] Elz, R., Bush, R., Bradner, S., and M. Patton, "Selection
and Operation of Secondary DNS Servers", BCP 16, RFC 2182,
July 1997.
[RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast
Services", BCP 126, RFC 4786, December 2006.
[RFC4892] Woolf, S. and D. Conrad, "Requirements for a Mechanism
Identifying a Name Server Instance", RFC 4892, June 2007.
[RFC5001] Austein, R., "DNS Name Server Identifier (NSID) Option",
RFC 5001, August 2007.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891, April 2013.8.2. Informative References
[ACD] International Air Transport Association (IATA), "Airline
Coding Directory (ACD)", 2013,
<http://www.iata.org/publications/Pages/coding.aspx>.
[Fan2013] Fan, X., Heidemann, J., and R. Govidan, "Evaluating
Anycast in the Domain Name System", Proceedings of the
IEEE Infocom Turin, Italy, April 2013.
[ROOT-SERVERS]
"root-servers.org", <http://www.root-servers.org>.Authors' Addresses
Joe Abley
Dyn, Inc.
470 Moore Street
London, ON N6C 2C2
Canada
Phone: +1 519 670 9327
EMail: jabley@dyn.com
Terry Manderson
ICANN
12025 Waterfront Drive
Suite 300
Los Angeles, CA 90094-2536
USA
EMail: terry.manderson@icann.org📦 where this page comes from
- ietf: rfc7108 2014-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms