Weird, I haven't researched DNS as well as I should have. I always lived under the impression that there was this extensive DNS cache network where intermediaries responded to queries with cached results from root DNS servers.
Instead, the second that this DDos hits is the second we have websites stopping working.
How is it that in this day and age we can't have distributed caches of DNS entries at our providers of full dns databases. I mean there can't be more than like a few billion dns entries in the world total, which fits easily in a modern desktop computers RAM.
If that is an underestimate, I can't believe a single modern server wouldn't be able to mirror the world's DNS queries for at least a providers worth of users.
Yes, perhaps there lies our folly. It's the choice between being flexible in ability to move our servers really quick, or being tolerant of DNS servers going down.
I sort of hoped that a DNS client would just use an expired DNS result in case the servers would not respond, but perhaps that is naieve/dumb.
Comments
Weird, I haven't researched DNS as well as I should have. I always lived under the impression that there was this extensive DNS cache network where intermediaries responded to queries with cached results from root DNS servers.
Instead, the second that this DDos hits is the second we have websites stopping working.
How is it that in this day and age we can't have distributed caches of DNS entries at our providers of full dns databases. I mean there can't be more than like a few billion dns entries in the world total, which fits easily in a modern desktop computers RAM.
If that is an underestimate, I can't believe a single modern server wouldn't be able to mirror the world's DNS queries for at least a providers worth of users.
Depends on the TTL (time to live) settings for the DNS entries, doesn't it?
Yes, perhaps there lies our folly. It's the choice between being flexible in ability to move our servers really quick, or being tolerant of DNS servers going down.
I sort of hoped that a DNS client would just use an expired DNS result in case the servers would not respond, but perhaps that is naieve/dumb.
This would break the whole concept of TTLs.
Not at all. Hard problems are hard to solve.