Passive observations of a large DNS service

By xuande - 2 days ago

Showing first level comment(s)

"Due to the centralization that is caused by public DNS services, large content delivery networks (CDNs), such as Akamai, are no longer able to rely on the source IP of DNS queries to pinpoint their customers. Therefore, they are also no longer able to provide geobased redirection appropriate for that IP."

I always thought that the go-to way to solve geobased redirection was to make all your PoPs listen to the same IP(s) (I think some BGP is involved here), and let Dijkstra's algorithm let all clients find the shortest path to the nearest PoP? Isn't this exactly what Google and CloudFlare are doing with their own DNS IPs?

stingraycharles - a day ago

I would naively assume that with the huge number of POPs that Google has and the desire to provide a low latency service, Google would only need to have the queries that originate from their resolvers have the right local addresses.

What might be a problem is that for those addresses there is no geolocation information. Which Google could solve by supplying that to maxmind, etc.

Hence the need for the privacy violating subnet option.

phicoh - a day ago

Are out-of-country DNS queries necessarily bad? If I were in upstate New York, for example, I would much prefer to use a resolver in Toronto than one in San Francisco. Measuring actual distance or network latency would be a much better way to detect suboptimal geolocation than simply checking whether the server is in the same country as the user.

kijin - a day ago

I don't feel comfortable with DNS services being "observed".

jedisct1 - 20 hours ago