What is DNS?

What is the Domain Name System (DNS)?

Imagine how difficult it would be to use the Internet if you had to remember dozens of number combinations to do anything. The Domain Name System (DNS) was created in 1983 to enable humans to easily identify all the computers, services, and resources connected to the Internet by name—instead of by Internet Protocol (IP) address, an increasingly difficult-to-memorize string of information. Think of all the website domain names you know off the top of your head and how hard it would be to memorize specific IP addresses for all those domain names. Think of DNS as the Internet's phone book. A DNS server translates the domain names you type into a browser, like www.f5.com, into an IP address (104.219.105.148), which allows your device to find the resource you're looking for on the Internet.

DNS is a hierarchical distributed naming system for computers, services, or other resources connected to the Internet. It associates various information with domain names that are assigned to each of the participating DNS entries.

How DNS Works

The user types the address of the site (www.f5.com as an example) into the web browser. The browser has no clue where www.f5.com is, so it sends a request to the Local DNS Server (LDNS) to ask if it has a record for www.f5.com. If the LDNS does not have a record for that particular site, it begins a recursive search of the Internet domains to find out who owns www.f5.com.


First, the LDNS contacts one of the Root DNS Servers, and the Root Server responds by telling the LDNS to contact the .com DNS Server. The LDNS then asks the .com DNS Server if it has a record for www.f5.com, and the .com DNS Server determines the owner of www.f5.com and returns a Name Server (NS) record for f5.com. Check out the diagram below:

Next, the LDNS queries the f5.com DNS Server NS record. The f5.com DNS Server looks up the name: www.f5.com. If it finds the name, it returns an Address (A) record to the LDNS. The A record contains the name, IP address, and Time to Live (TTL). The TTL (measured in seconds) tells the LDNS how long to maintain the A record before it asks the f5.com DNS Server again.

When the LDNS receives the A record, it caches the IP address for the time specified in the TTL. Now that the LDNS had the A record for www.f5.com, it can answer future requests from its own cache rather than completing the entire recursive search again. LDNS returns the IP address of www.f5.com to the host computer, and the local browser caches the IP address on the computer for the time specified in the TTL. After all, if it can hold on to the info locally, it won't need to keep asking the LDNS.

The browser then uses the IP address to open a connection to www.f5.com:80 and sends a GET /... and the web server returns the web page response.

DNS can get a lot more complicated than what this simple example shows, but this gives you an idea of how it works.

DNS Importance

As arguably the primary technology enabling the Internet, DNS is also one of the most important components in networking infrastructure. In addition to delivering content and applications, DNS also manages a distributed and redundant architecture to ensure high availability and quality user response time—so it is critical to have an available, intelligent, secure, and scalable DNS infrastructure. If DNS fails, most web applications will fail to function properly. And DNS is a prime target for attack.

The importance of a strong DNS foundation cannot be overstated. Without one, your customers may not be able to access your content and applications when they want to—and if they can't get what they want from you, they'll likely turn elsewhere.

Growing Pains

DNS is growing especially with mobile apps and IoT devices requiring name resolution.  Add to that, organizations are experiencing rapid growth in terms of applications as well as the volume of traffic accessing those applications.

In the last five years, the volume of DNS queries on for .com and .net addresses has more than doubled. More than 10 million domain names were added to the Internet in 2016 and future growth is expected to occur at an even faster pace as more cloud, mobile and IoT implementations are deployed.

Security Issues

If DNS is the backbone of the Internet—answering all the queries and resolving all the numbers so you can find your favorite sites—it is also one of the most vulnerable points in your network. Due to the crucial role it plays, DNS is a high-value security target. DNS DDoS attacks can flood your DNS servers to the point of failure or hijack the request and redirect requests to a malicious server. To prevent this, a distributed high-performing, secure DNS architecture and DNS offload capabilities must be integrated into the network.

Generally, DNS servers and DNS cloud services can handle varying amounts of requests per second with the costs increasing as the queries-per-second increase.

To address DNS surges and DNS DDoS attacks, companies add more DNS servers, which are not really needed during normal business operations. This costly solution also often requires manual intervention for changes. In addition, traditional DNS servers require frequent maintenance and patching, primarily for new vulnerabilities.

The Traditional Solution

When looking for DNS solutions, many organizations select BIND (Berkeley Internet Naming Daemon), the Internet's original DNS resolver. Installed on approximately 80 percent of the world's DNS servers, BIND is an open-source project maintained by Internet Systems Consortium (ISC).

Despite its popularity, BIND requires significant maintenance multiple times a year primarily due to vulnerabilities, patches, and upgrades. It can be downloaded freely, but needs servers (an additional cost, including support contracts) and an operating system. In addition, BIND typically scales to only 50,000 responses per second (RPS), making it vulnerable to both legitimate and malicious DNS surges.

Next Step

If you're ready to learn more or dig deeper into DNS, check out these more advanced articles

DNS - DevCentral Wiki

Application Layer DNS Firewall

Lightboard Lessons: DNS Scalability & Security

DNS Express and Zone Transfers

DNS Does the Job

Intelligent DNS Animated Whiteboard

DNS will become even more important as additional sensors, monitors, actuators and other 'things' connect to the internet. It helps those devices like refrigerators and automobiles get their updates and helps us people find those things in our digital world. Here is a short Whiteboard explaining how F5 can help solve DNS challenges. And check out our Intelligent DNS Scale Reference Architecture which delivers the peace of mind that comes with knowing that your web applications will respond to all DNS queries—keeping your content and applications available to your users wherever and whenever they want to access them.

ps

Related

• CloudExpo 2014: The DNS of Things
• GartnerDC 2013: Intelligent DNS Scale Reference Architecture
• The DNS of Things
• DNS Does the Job
• A Living Architecture

Technorati Tags: dns,f5,iot,things,reference architecture,availability,silva

Connect with Peter:	Connect with F5:

A Living Architecture

You often hear people say, 'oh, this is a living document,' to indicate that the information is continually updated or edited to reflect changes that may occur during the life of the document. Your infrastructure is also living and dynamic. You make changes, updates or upgrades to address the ever changing requirements of your employees, web visitors, customers, partners, networks, applications and anything else tied to your systems.

This is also true for F5's Reference Architectures. They too are living architectures.

F5's Reference Architectures are the proof-points or customer scenarios that drive Synthesis to your data center and beyond.

When we initially built out these RA's, we knew that they'd be continuously updated to not only reflect new BIG-IP functionality but also show new solutions to the changing challenges IT faces daily. We've recently updated the Intelligent DNS Scale Reference Architecture to include more security (DNSSEC) and to address the highly hybrid nature of enterprise infrastructures with Distributed DNS.

F5’s end-to-end Intelligent DNS Scale reference architecture enables organizations to build a strong DNS foundation that maximizes the use of resources and increases service management, while remaining agile enough to support both existing and future network architectures, devices, and applications. It also provides a more intelligent way to respond and scale to DNS queries and takes into account a variety of network conditions and situations to distribute user application requests and application services based on business policies, data center conditions, network conditions, and application performance. It ensures that your customers—and your employees—can access your critical web, application, and database services whenever they need them.

In this latest DNS RA rev, DNSSEC can protect your DNS infrastructure, including cloud deployments, from cache poisoning attacks and domain hijacks. With DNSSEC support, you can digitally sign and encrypt your DNS query responses. This enables the resolver to determine the authenticity of the response, preventing DNS hijacking and cache poisoning.

Also included is Distributed DNS. Meaning, all the DNS solution goodness also applies to cloud deployments or infrastructures where DNS is distributed.  Organizations can replicate their high performance DNS infrastructure in almost any environment. Organizations may have Cloud DNS for disaster recovery/business continuity or even a Cloud DNS service with signed DNSSEC zones. F5 DNS Services enhanced AXFR support offers zone transfers from BIG-IP to any DNS service allowing organizations to replicate DNS in physical, virtual, and cloud environments. The DNS replication service can be sent to other BIG-IPs or other general DNS servers in Data Centers/Clouds that are closest to the users.

In addition, Organizations can send users to a site that will give them the best experience. F5 DNS Services uses a range of load balancing methods and intelligent monitoring for each specific app and user. Traffic is routed according to your business policies and current network and user conditions. F5 DNS Services includes an accurate, granular geolocation database, giving you control of traffic distribution based on user location.

DNS helps make the internet work and we often do not think of it until we cannot connect to some resource. With the Internet of Nouns (or Things if you like) hot on our heels, I think Port 53 will continue to be a critically important piece of the internet puzzle.

ps

Related:

• Intelligent DNS Scale Resources
• F5 Synthesis
• DNS Reimagined keeps your Business Online
• DNS Does the Job
• The DNS of Things
• DNS Doldrums
• The Internet of Things and DNS

 

Technorati Tags: f5,big-ip,dns,reference architecture,dnssec,iot,things,name_resolution,silva,security,cloud,synthesis

 

Connect with Peter:	Connect with F5:

The DNS of Things

Hey DNS - Find Me that Thing!

There's a new craze occurring in homes, highways, workplaces and everywhere imaginable - the Internet of Things or as I like to call it, The Internet of Nouns. Sensors, thermostats, kitchen appliances, toilets and almost every person, place or thing will have a chip capable of connecting to the internet. And if you want to identify and find those things with recognizable words instead of a 128-bit IP address, you're going to need DNS.

DNS translates the names we type into browser or mobile app into an IP address so the services can be found on the internet. It is one of the most important components of the internet, especially for human interaction. With the explosion of mobile devices and the millions of apps deployed to support those devices, DNS growth has doubled in recent years. It is also a vulnerable target.

While the ability to adjust the temperature of your house or remotely flush your toilet from around the globe is cool, I think one of the biggest challenges of the Internet of Nouns will be the strain on DNS. Not only having to resolve the millions of additional 'things' getting connected but also the potential vulnerabilities and risks introduced when your washing machine connects to the internet to find the optimal temperature and detergent mix to remove those grass, wine and blood stains.

Recent research suggests that the bad guys are already taking advantage of these easy targets. Arstechnica reports that the malware that has been targeting routers has now spread to DVRs. Not my precious digital video reorder!! Last week, Sans found a Bitcoin mining trojan that can infect security camera DVRs. As they were watching a script that hunted the internet for data storage devices, they learned that the bot was coming from a DVR. Most likely, they say, it was compromised through the telnet defaults.

In another report, ESET said it found 11 year old malware that had been updated with the ability to compromise a residential broadband router's DNS settings. The malware finds a vulnerable router and changes the default DNS entries to either send the person to a rogue site to install more malware (join the bot, why don't ya) or to just redirect them to annoying sites. Imagine if the 50+ connected things we will soon have in our homes also joined the bot? Forget about needing compute and bandwidth from machines around the globe, you can zero in on a neighborhood to launch an attack.

Nominum research shows that DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers all over. A simple attack can create tens-of-gigs of traffic to disrupt networks, businesses, websites, and regular folks anywhere in the world. More than 24 million home routers on the Internet have open DNS proxies which expose ISPs to DNS-based DDoS attacks and in February 2014 alone, more than 5.3 million of these routers were used to generate attack traffic. These are especially hard to track since it is difficult to determine both the origination and target of the attack.

Lastly, Ultra Electronics AEP says 47% of the internet remains insecure since many top level domains (TLDs) have failed to sign up to use domain name system security extensions (DNSSEC). These include heavy internet using countries like Italy (.it), Spain (.es) and South Africa (.za), leaving millions of internetizens open to malicious redirects to fake websites. Unless the top level domain is signed, every single website operating under a national domain can have its DNS spoofed and that's bad for the good guys.

We often don't think about the Wizard behind the curtain until we are unable resolve an internet resource. DNS will become even more critical as additional nouns are connected and we want to find them by name. F5 DNS Solutions can help you manage this rapid growth with complete solutions that increase the speed, availability, scalability, and security of your DNS infrastructure.

And I do imagine a time when our current commands could also work on, for instance, the connected toilet: /flushdns.

Just couldn't let that one go.

ps

Related:

• “Internet of Things” is the new Windows XP—malware’s favorite target
• Win32/Sality newest component: a router’s primary DNS changer named Win32/RBrute
• 24 million home routers expose ISPs to massive DNS-based DDoS attacks
• 24 million reasons to lock down DNS amplification attacks
• Half the internet lacks DNS security extensions
• F5 Intelligent DNS Scale

 

Technorati Tags: f5,dns,dnssec,ddos,security,iot,things,big-ip,malware,silva,trojan

 

Connect with Peter:	Connect with F5:

DNS Does the Job

Imagine how much you'd use the internet if you had to remember dozens of number combinations to do anything.  DNS is arguably the primary technology enabling the Internet – translating the domain names people type into a browser into an IP address so the requested service can be found on the internet.  We always expect DNS to work and no one thinks about it until it breaks.

Every icon, URL, and all embedded content on a web page requires a DNS look up. Loading complex sites may require hundreds of DNS queries and even simple smart phone apps can require numerous DNS queries just to load. In the last five years, the volume of DNS queries on for .com and .net addresses has more than doubled, increasing to an average daily query load of 77 billion in the fourth quarter of 2012.   More than six million domain names were added to the Internet in the fourth quarter of 2012.  Future growth is expected to occur at an even faster pace as more cloud implementations are deployed and practically everything connected to the internet, including your future fridge, coffee machine and toilet will need a DNS entry

Over the last 5 years, there has been a 180% growth of active websites, 230% growth in active users, a 22% growth in software applications and 100% growth in DNS queries. Add to that, nearly 60% of web users say they expect a website to load on their mobile phone in 3 seconds or less. Organizations are experiencing rapid growth in terms of applications and the volume of traffic accessing those applications.

When a user requests a web page, the requests access local DNS services and these in turn communicate with the main DNS servers. This is not a problem until a traffic surge or a hacker floods the server with DNS query requests since it might be more than what the DNS servers can handle which in turn, can disable the main DNS server. The DNS server then stops responding and sites are unavailable, unreachable or even offline. Generally organizations have a set of DNS servers, each one capable of handling up to 150,000 DNS queries per second. High performance DNS servers are capable of handling around 200,000 queries per second. The bad guys can easily exceed that as exemplified by the recent DNS outages affecting NY Times, LinkedIn, Network Solutions and Twitter. DNS failures account for 41% of web infrastructure downtime so organizations must keep their DNS available. According to a survey by the Aberdeen Group, organizations lose an average of $138,000 for every hour their data centers are down.  Downtime has an impact on visiting customers, can lead to loss of revenue and can also impact employees trying to access their corporate resources.  To address DNS surges, companies add more DNS servers which are not really needed during normal business operations.

Instead of worrying about DNS outages and purchasing additional DNS infrastructure to combat surges, simply place BIG-IP in front of your primary DNS server. It’s a full DNS server and handles requests on behalf of your main DNS server.  BIG-IP can respond much faster to a DNS query request up to millions of queries per second. Whether it is a legitimate request or an attack, BIG-IP responds. The BIG-IP engine handles application requests at very high levels and it is that same engine that responds to DNS queries. So high, in fact, that even large surges of DNS requests (including the malicious ones) will not cripple your critical content. DNS is always available which is important to having good services for your users. Administrators enjoy the peace of mind that their site will respond to all DNS queries, keeping the site available.

 

If you have high volume DNS coming into your data center, it is more advantageous to respond to those queries from the DMZ rather than from deep within the infrastructure, potentially affecting the back end primary DNS servers along with other critical servers. Instead of responding from deep within the infrastructure, respond using BIG-IP from the DMZ so that no request touches the back end which greatly increases the primary server’s ability can scale. Offload DNS to BIG-IP. With these large scale capabilities, even if a site is flooded due to some unexpected event, DNS can respond to all queries, good or bad. This keeps all your critical web, application and database services available. Organizations can secure DNS while achieving high scale. There is less equipment to purchase, manage and support. Plus, BIG-IP offers easy DNS management that integrates with your existing infrastructure. Error checking, auto population of protocols and importation of zones help eliminate any downtime from DNS errors. Organizations can make their applications fast, available and secure but if DNS is not responding, it doesn’t really matter since no one can get to it anyway.

ps

Related:

• f5 Synthesis
• F5 Introduces Synthesis Architecture
• Intelligent DNS Scale Video
• DNS Solutions
• Scaling DNS Services with BIG-IP Devices
• So That DNS DDoS Thing Happened
• DNS Doldrums
• RSA2013: BIG-IP DNS Services (Video)
• F5 DNS Express: DNS Die Another Day (Video)

Technorati Tags: dns,dns attack,availability,synthesis,dns express,big-ip,f5,silva,reference architecture

 

Connect with Peter:	Connect with F5:

DNS Doldrums

DNS is one of the primary technologies enabling the Internet – translating the names people type into a browser into an IP address so the requested service can be found on the internet. It is one of the key elements in the network that delivers content and applications to the user.  If DNS goes down, most web applications will fail to function properly so it is critical to have a strong, secure and scalable DNS infrastructure.

A bunch of recent DNS outages show that while protecting the application from the typical SQLi, XSS and other OWASP Top 10 related risks is important, if DNS is not answering, those application hacks do not really matter since no one can get to the site anyway.

This month, 3 Dutch web hosting companies had their name servers altered by attackers.  They, according to articles, changed the various company's name servers to malicious servers hosted by the crooks.  They apparently managed to break into the national domain registrar, SIDN, to make the malicious change along with setting the Time to Live value to 24 hours.  This meant that any ISP that cached the bad information would continue to deliver the wrong address for the next day.  Among others, a large Dutch electronic retailer had to take down a bunch of servers that were delivering malware due to the breach but thousands of domains were affected.

This past June, the popular business social network LinkedIn was offline for at least a half a day due to a DNS issue.  The company claims that this was not due to criminal behavior but internal human error.  Somehow the main home page was redirected to a domain parking page which indicated the name was up for sale.

Also in June, DNSimple detected a DNS Amplification Attack on their network.  This is where an attacker attempts to use additional servers to 'amplify' the attack - small queries that turn into huge responses.  Instead of allowing the bounce, DNSimple tried to absorb the attack by blocking some IP addresses but ultimately at some point, all the name servers were no longer responding.  All hands to respond.  In their incident report, they noted that their current DNS server implementation allowed ANY queries on UDP to pass through and attempted to respond to them, albeit with the TC (truncation) bit set. In addition, the overhead created by their ALIAS resolution system was also a factor, especially with ALIAS records pointing to other records within DNSimple.  With some adjustments they hope to mitigate this from happening again.

There were a few others of note, In June, Network Solutions had its DNS servers hijacked and reconfigured to a malicious website after it botched efforts to thwart a DDoS attack.  The Spamhaus Project was nailed by a DNS DDoS attack.  And last week, a reported vulnerability in the BIND DNS software could give an attacker the ability to easily and reliably control queried name servers.

We rely on DNS for almost every interaction we have with web applications.  It helps us find our favorite e-tailer, social network, travel, news, gaming or entertainment site along with potentially finding our work related resources when we are mobile.  For organizations, it helps direct and bring people to your content.  Without it, our letter managed mind would have to start remembering a bunch of numbers.  Imagine how much you'd use the internet if you had to remember dozens of number combinations to do anything.  I bet the growth, the internet of everything, would come to a screeching halt.

ps

Related:

• BIND Vulnerability Enables DNS Cache Poisoning Attack
• DNS impairment redirects thousands of websites to malware
• How Spamhaus’ attackers turned DNS into a weapon of mass destruction
• LinkedIn hit by outage from 'DNS issue'
• Incident Report: DNS Outage due to DDoS Attack
• DDoS Attack Behind Latest Network Solutions Outage
• How whitehats stopped the DDoS attack that knocked Spamhaus offline
• The Domino Effect of LinkedIn’s DNS Outage
• RSA2013: BIG-IP DNS Services (video)
• F5 DNS Express: DNS Die Another Day (video)
• F5 DNS Series (videos)

Technorati Tags: dns,f5,outage,dns attack,ddos,security,bind,cache poisoning,big-ip,silva

Connect with Peter:	Connect with F5:

RSA2013: BIG-IP DNS Services

Taking a moment from behind the camera to appear in frame with me, F5 PMM Jonathan George shares some excellent insight, along with a well-drawn whiteboard, on all the ways BIG-IP can secure and optimize your DNS services. Jonathan also closes out the video in style. This one was especially fun.

 

ps

Related:

• RSA2013: Aloha from RSA
• RSA2013: Find F5
• RSA2013: Gimme 90 Seconds Security Edition
• RSA2013: Partner Spotlight – Websense
• RSA2013: Partner Spotlight – Quarri
• RSA2013: F5 RSA Security Trends Survey
• RSA2013: BIG-IP SSL/TLS Services
• F5′s YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5
• Also this week, check out: Mobile World Congress – Day 1 & Mobile World Congress – Day 2

Technorati Tags: f5,rsac,rsa,rsa2013,psilva,video,dns, dnssec,ddos

F5 Agility Summit 2012 - Infoblox

I meet with Infoblox's Senior Product Manager, Andy Voltmer about the F5/Infoblox partnership, the importance of DNS and the security around DNSSEC.  Reporting from the F5 Agility Conference in Times Square.

ps

Resources:

• F5 Rethink Your World
• F5 Agility Summit 2012 - Welcome to New York
• F5 Agility Summit 2012 – Splunk
• F5 Agility Summit 2012 - Infoblox
• F5 Agility Summit 2012 - Welcome to Shanghai
• Rackspace uses F5 to create a hybrid platform to meet customer needs
• Using F5, Future Com helped Sysco unify its network
• MLB Network, uses F5 to achieve zero downtime for its cable programming
• F5 Friday: Infoblox and F5 Do DNS and Global Load Balancing Right.
• Upcoming Event: F5 Agility Summit 2012
• F5 Announces Winners of 2012 Agility Customer and Partner Awards
• F5 Networks Selects Westcon Group as First Global Distributor
• F5 YouTube Channel

Technorati Tags: F5, big-ip, agility summit, cloud computing, Pete Silva, security, new york, times square, partners, network firewall,internet,dnssec, big-ip, dns, analytics, infoblox, video

Connect with Peter:	Connect with F5:

Audio White Paper - High-Performance DNS Services in BIG-IP Version 11

With an increasing number of devices, applications, and services on the Internet, it’s becoming more difficult to achieve network and application response times that deliver a quality user experience. This problem is not only a bandwidth issue—it’s also closely tied to network and infrastructure architecture.  To provide high-quality user experiences on the Internet, networks must be designed with optimized, secure, highly available, and high-performance IP services. Domain Name System (DNS) is one of the most difficult, but important, IP services to optimize and secure. DNS Services in F5 BIG-IP version 11 provides an intelligent DNS architecture that delivers high performance and scalability while negating the effects of network attacks.  Running Time: 14:17  Read full white paper here.  And click here for more F5 Audio.

Listen on Posterous
 

ps

Technorati Tags: F5, integration, data center, Pete Silva, security, business, dnssec, technology, application delivery, dns, cloud, gtm, dynamic, web, internet, security, hardware, audio, whitepaper, big-ip

Connect with Peter:	Connect with F5: