Welcome!

Containers Expo Blog Authors: Elizabeth White, Liz McMillan, Yeshim Deniz, Pat Romanski, Amit Gupta

Related Topics: @DevOpsSummit, Linux Containers, Containers Expo Blog

@DevOpsSummit: Blog Feed Post

DNS: What Can Go Wrong and How You Can Fix It | @DevOpsSummit #APM #Agile #DevOps

DNS enables users of all skill sets and technical knowledge levels to use this incredibly advanced resource on a daily basis

DNS: What Can Go Wrong and How You Can Fix It
By Ankit Kumar

DNS is a core component of the Internet. This rather complex system exists to perform the basic function of translating website Domain names (ex: Catchpoint.com) into an IP address. It acts as the liaison between the language that users can understand, and the address of the data center or destination in which the site is being hosted.

DNS is what shapes the modern Internet. It enables users of all skill sets and technical knowledge levels to use this incredibly advanced resource on a daily basis. Businesses that exist entirely on the Internet like online banking and ecommerce companies have not only emerged into the market, but have steadily gained a global presence.

Despite its critical role, DNS isn’t impenetrable; even with redundancies and a fast, efficient design, it’s still vulnerable to performance issues and failures. When these issues occur, it means that your applications and websites are inaccessible and users are likely feeling frustrated. Performance degradation can have serious consequences that can affect your revenue and brand reputation, so it’s crucial that your DNS is reliable and consistent.

Regardless of where your DNS is hosted (internally vs. third-party such as OpenDNS, NS1, etc.), reliability should always be a priority. To ensure it’s reliable, you must use a DNS monitor that allows you to test and analyze the results so you can make improvements. Monitoring also gives you the ability to recognize performance trends and patterns, and identify areas of concern.

Let’s take a look at some of the real world concerns that can cause DNS resolution issues.

Not using a multiple name server architecture:
DNS name servers are very important; they are the primary source that directs to the actual hostnames, which is what a client is looking for. These name servers can go down at times due to an issue (i.e. DDoS attacks, network issues with the server, etc.). This can be cause for serious concern if there is only one name server in place because the DNS resolution will fail and the end user wouldn’t be able to visit the page at all. It’s always advisable to have multiple name servers to answer DNS queries so that even if one fails, others can answer the query.

Let’s say I have a hostname www.abc.com and I have configured only one name server to handle the DNS query. So when the request reach abc.com, it gets the following information in the zone file:

abc.com   172,800   IN   NS     ns1.abc.com

Now imagine if this name server goes down; the complete DNS query will fail and the client will not be able to reach www.abc.com because there isn’t a second name server to handle failure.

Let’s look at another example: www.google.com has four name servers which enables them to handle a name server failure more effectively.

google.com   172,800   IN   NS     ns1.google.com

google.com   172,800   IN   NS     ns2.google.com

google.com   172,800   IN   NS     ns3.google.com

google.com   172,800   IN   NS     ns4.google.com

In this case, whenever any of the four name server fails, there are other three name servers which will be answering DNS queries, making sure there is not a complete outage of DNS resolution process for www.google.com.

Absence of glue records:
A glue record is the IP address of the name server that is present in the same zone file. Now, this is a very important resource record considering how the whole DNS resolution works. Let’s try to understand this with the help of an example:

Say I have a hostname www.abc.com and for that I have three name servers, which will be used in my zone file when a DNS query comes for abc.com

abc.com 172,800 IN NS ns1.abc.com

abc.com 172,800 IN NS ns2.abc.com

abc.com 172,800 IN NS ns3.abc.com

Now consider the case in which I do not give information about all three of the name servers in the form of an IP address (or glue records). Next, the DNS resolver will query one of the name servers; say ns1.abc.com is chosen. Now since the IP address of NS1 is not present in that zone file, our DNS resolver will start resolving from root, then .com, and, after querying abc.com, again it will end up with the same three name servers’ information as shown above. The DNS resolution process will be stuck in this loop forever until finally it fails. Hence, it is very important to add glue record while configuring the name server information in the zone file.

abc.com   172,800   IN   NS   ns1.abc.com

abc.com   172,800   IN   NS   ns2.abc.com

abc.com   172,800   IN   NS   ns3.abc.com

ns1.abc.com   800   IN   A      1.2.3.4

ns2.abc.com   800   IN   A      3.2.4.6

ns3.abc.com   800   IN   A      5.4.1.2

DNS cache poisoning:
To put it simply, DNS cache poisoning means incorrect DNS information. For example, if www.facebook.com starts pointing to a Google IP, that means Facebook will tell its user to search on a Google machine for Facebook content. DNS cache poisoning can occur in multiple ways, like if an attacker (middle man) gets ahold of the zone file of the authoritative name servers, they could change the value of A records and can cause incorrect DNS mapping.

It can also spread because of ISP caching wrong DNS entry, which is obtained from some compromised servers and can virtually spread from one ISP to the other and cause serious poisoning issues.

Insecure Zone transfer:
As explained earlier, having multiple name servers for a domain gives it a better chance of handling any kind of name server failure. It’s also very important for all the name servers to have updated information of the zone file, which is why you have to make sure all the Name servers have same information when it comes to zone transfer.

An insecure zone transfer can reveal a lot of critical information about a domain. Although zone transfer takes place over TCP protocol to make sure information transferred is more reliable, sometimes improper configuration of a particular name server can allow zone transfer to a third party (middle man), which means the third party will have all the critical information related to that particular domain. Hence, transferring zone information should happen between the same domain name servers. For example, if there are two name servers for example.com (NS1, NS2), then ns1.example.com should allow zone transfer only to ns2.example.com, and discard all other third-party requests for transfer.

These examples are just a few that demonstrate why monitoring is important for organizations to keep an eye on any anomalies to their DNS service. Stay tuned for a follow-up article that will examine other DNS scenarios, and how to handle the issues that can occur.

The post DNS: What Can Go Wrong and How You Can Fix It appeared first on Catchpoint's Blog.

Read the original blog entry...

More Stories By Mehdi Daoudi

Catchpoint radically transforms the way businesses manage, monitor, and test the performance of online applications. Truly understand and improve user experience with clear visibility into complex, distributed online systems.

Founded in 2008 by four DoubleClick / Google executives with a passion for speed, reliability and overall better online experiences, Catchpoint has now become the most innovative provider of web performance testing and monitoring solutions. We are a team with expertise in designing, building, operating, scaling and monitoring highly transactional Internet services used by thousands of companies and impacting the experience of millions of users. Catchpoint is funded by top-tier venture capital firm, Battery Ventures, which has invested in category leaders such as Akamai, Omniture (Adobe Systems), Optimizely, Tealium, BazaarVoice, Marketo and many more.

@ThingsExpo Stories
SYS-CON Events announced today that Taica will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Taica manufacturers Alpha-GEL brand silicone components and materials, which maintain outstanding performance over a wide temperature range -40C to +200C. For more information, visit http://www.taica.co.jp/english/.
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
SYS-CON Events announced today that Nihon Micron will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Nihon Micron Co., Ltd. strives for technological innovation to establish high-density, high-precision processing technology for providing printed circuit board and metal mount RFID tags used for communication devices. For more inf...
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities – ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups. As a result, many firms employ new business models that place enormous impor...
SYS-CON Events announced today that MIRAI Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MIRAI Inc. are IT consultants from the public sector whose mission is to solve social issues by technology and innovation and to create a meaningful future for people.
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
SYS-CON Events announced today that Dasher Technologies will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Dasher Technologies, Inc. ® is a premier IT solution provider that delivers expert technical resources along with trusted account executives to architect and deliver complete IT solutions and services to help our clients execute their goals, plans and objectives. Since 1999, we'v...
SYS-CON Events announced today that TidalScale, a leading provider of systems and services, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale has been involved in shaping the computing landscape. They've designed, developed and deployed some of the most important and successful systems and services in the history of the computing industry - internet, Ethernet, operating s...
SYS-CON Events announced today that Massive Networks, that helps your business operate seamlessly with fast, reliable, and secure internet and network solutions, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. As a premier telecommunications provider, Massive Networks is headquartered out of Louisville, Colorado. With years of experience under their belt, their team of...
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.
Infoblox delivers Actionable Network Intelligence to enterprise, government, and service provider customers around the world. They are the industry leader in DNS, DHCP, and IP address management, the category known as DDI. We empower thousands of organizations to control and secure their networks from the core-enabling them to increase efficiency and visibility, improve customer service, and meet compliance requirements.
SYS-CON Events announced today that TidalScale will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale is the leading provider of Software-Defined Servers that bring flexibility to modern data centers by right-sizing servers on the fly to fit any data set or workload. TidalScale’s award-winning inverse hypervisor technology combines multiple commodity servers (including their ass...
As hybrid cloud becomes the de-facto standard mode of operation for most enterprises, new challenges arise on how to efficiently and economically share data across environments. In his session at 21st Cloud Expo, Dr. Allon Cohen, VP of Product at Elastifile, will explore new techniques and best practices that help enterprise IT benefit from the advantages of hybrid cloud environments by enabling data availability for both legacy enterprise and cloud-native mission critical applications. By rev...
As popularity of the smart home is growing and continues to go mainstream, technological factors play a greater role. The IoT protocol houses the interoperability battery consumption, security, and configuration of a smart home device, and it can be difficult for companies to choose the right kind for their product. For both DIY and professionally installed smart homes, developers need to consider each of these elements for their product to be successful in the market and current smart homes.
Join IBM November 1 at 21st Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA, and learn how IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Cognitive analysis impacts today’s systems with unparalleled ability that were previously available only to manned, back-end operations. Thanks to cloud processing, IBM Watson can bring cognitive services and AI to intelligent, unmanned systems. Imagine a robot vacuum that becomes your personal assistant tha...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, will lead you through the exciting evolution of the cloud. He'll look at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering ...
SYS-CON Events announced today that N3N will exhibit at SYS-CON's @ThingsExpo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. N3N’s solutions increase the effectiveness of operations and control centers, increase the value of IoT investments, and facilitate real-time operational decision making. N3N enables operations teams with a four dimensional digital “big board” that consolidates real-time live video feeds alongside IoT sensor data a...
In a recent survey, Sumo Logic surveyed 1,500 customers who employ cloud services such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). According to the survey, a quarter of the respondents have already deployed Docker containers and nearly as many (23 percent) are employing the AWS Lambda serverless computing framework. It’s clear: serverless is here to stay. The adoption does come with some needed changes, within both application development and operations. Tha...
SYS-CON Events announced today that Avere Systems, a leading provider of enterprise storage for the hybrid cloud, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Avere delivers a more modern architectural approach to storage that doesn't require the overprovisioning of storage capacity to achieve performance, overspending on expensive storage media for inactive data or the overbui...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.