Noticed some issues loading web applications in recent weeks? The recent major cloud outage was a reminder of something we should all know by now, that we seem to keep forgetting until the next crisis: if DNS stumbles, everything depending on it does too. <\/p>\n
This time it was a problem with one of the major public cloud providers. But every digital service provider\u2014really, every business running a network\u2014has dealt with DNS issues at some point. In this incident, a domain name pointed to a database service that wasn\u2019t resolvable, which prevented many of that provider\u2019s customers\u2014and many of their own internal services\u2014from reaching that database service, causing widespread outages. <\/p>\n
We\u2019ve seen this movie before. In 2016, a withering distributed denial-of-service (DDoS) attack on Dyn, one of the largest DNS hosting providers, knocked many well-known web properties offline for hours. Last year\u2019s big CrowdStrike outage was actually caused by a software bug that had nothing to do with DNS, but crashed Windows Servers and endpoints the CrowdStrike agent was running on. It still caused global network failures\u2014because many of those servers were also running DNS.<\/p>\n
Why does this problem keep biting us? Because virtually every digital connection starts by asking a DNS server how to reach some destination. As the \u201cdigital phonebook\u201d for IP networks, DNS handles the mundane but extremely important task of translating human-readable domain names into IP addresses. When DNS fails, applications can\u2019t find other endpoints\u2019 addresses. No address, no connection. No connection, no business. <\/p>\n
As a protocol, DNS is designed to be fairly resilient (if one authoritative DNS server fails, for example, recursive DNS servers on the internet will automatically find another to resolve queries). The problem is that DNS is so fundamental to digital communication, when there\u2019s an issue, it tends to have a large blast radius, rippling out to many other connections and dependencies. Additionally, as one of the foundational elements of a business\u2019s online presence, DNS is a prime target for cyberattacks. <\/p>\n
Common causes of DNS failures include: <\/p>\n
The good news is that there are many things organizations can do to avoid these kinds of problems. The simplest steps take advantage of DNS\u2019s built-in resiliency: Give recursive servers multiple authoritative DNS servers to choose from. Give stub resolvers, or DNS clients, multiple recursive servers to choose from. And use DNS anycast to automatically route queries to the nearest healthy resolver in the event of a failure. <\/p>\n
Here are some other best practices I\u2019ve recommended over the years: <\/p>\n
Here\u2019s a video<\/a> where I discuss some of the best practices above. <\/p>\n