5

I see that almost all registered domains have at least two authoritative name servers configured (and for most of them, exactly two), and that using two servers provides redundancy against any kind of server failure. Technically there's no restriction on number of auth NS servers, so a single NS also works.

However, for some zones, there are already multiple addresses for one server configured, like ns1.qq.com (4 IPv4 addresses, auth NS for qq.com.). And for some other zones, the name servers are distributed using techniques like anycast, like ns3.cloudflare.com (one anycast IPv4 and one anycast IPv6).

In those cases, why would one still configure multiple authoritative name servers for a zone, when one NS entry can already provide redundancy against physical server failure?

9

In the early days of internet, registrars required you to have two DNS servers at different physical locations before they would register your domain. I don't know what today's requirements are, but I'm sure that historical tradition has carried on past the point where it was strictly necessary to provide redundancy. And a lot of the ones you see are probably the original NS pairs that were registered, and it just never changed.

It's also much simpler to do it that way than to set up anycast, hot failovers, etc.

2
  • 2
    The tradition even goes back to the very beginnings of DNS, when there was just the one registrar (the 'hostmaster' as in "master of HOSTS.TXT"), e.g. <datatracker.ietf.org/doc/html/rfc1032#page-11>. – user1686 May 16 at 19:20
  • Yes, it comes a lot from history and it is still today enforced by some registries (it, de, etc.), and even IANA for TLDs (see iana.org/help/nameserver-requirements). However just testing if there 2 or more nameservers does not really provide by itself a lot of guarantees. You can have 10 nameservers, but if all have the same IP addresses, or all in some block, or all in same AS, or all in same POP, or all behind the same transit provider, then having 10 of them provides absolutely no more guarantees than having just one. – Patrick Mevzek May 16 at 21:01
8

First off, the title asks "why are there multiple authoritative nameservers?", while the question body clearly assumes that "of course there will have to be multiple authoritative name servers for redundancy" (indeed the answer to the question posed by the title), and instead asks "why are there multiple NS records?".
With this in mind, I consider the question posed by the title to have been largely answered already in the question itself. Redundancy is desirable, one does not want to rely entirely on a single host or a single network.

Traditionally, the NS records were simply pointing to different hosts that were acting as name servers, and with that as the starting point it makes sense to simply add NS records for each host that is authoritative for this zone.
This in turn led to some default behaviors that assumes that each name represents a host rather than any arbitrary grouping of hosts, like the notify behavior suggested in the spec is to send notifications to the NS hosts except SOA MNAME (ie, notify all nameservers except what SOA identifies as the master).

Now, the remaining part of the question splits into examples of two cases:

  • Multiple addresses (of each type, like multiple A / multiple AAAA) for a single NS name that could then represent multiple authoritative servers providing redundancy:
    This can certainly be done, but to me the use suggested by the question just seems like a less conventional way of doing the exact same thing that the question criticizes. The advantage is unclear and it breaks expectations and thereby might cause unexpected issues (like maybe your registrar does not allow you to provide any number of glue records for a single host, or whatever).
    In the actual example mentioned in the question they have four such NS records all with multiple addresses, so they are doing both things at the same time. With their large number of addresses maybe there might be an advantage to this approach, but that seems like an edge case beyond what the question is truly going for.

  • Anycast for redundancy:
    This might be the stronger argument in one way, where a single address (per type, like single A / single AAAA) can represent multiple authoritative servers. However, the way anycast is BGP-based, first of all, it's not available to just any name server operator so that makes it hard to argue that everyone could/should just do it this way, but more importantly with just a single address it still creates a big dependency on one specific route advertised in BGP "working right". Ideally one will still want multiple addresses in different networks.

6
  • 1
    furthermore, using multiple addresses for a single NS name is risky -- a query to any of the addresses can fail, and some (buggy?) clients can mark said NS name as failed rather than trying other provided addresses. – mforsetti May 16 at 7:49
  • @mforsetti Indeed, that is a more detrimental example of what the broken expectations could cause. I don't know to what extent that behavior exists in the wild, but it sounds like something that is entirely plausible for some implementation to (incorrectly) do. – Håkan Lindqvist May 16 at 8:00
  • I agree that there might be bad resolver implementation not dealing with multiple IPs,but they would be non compliant per §7.2 of RFC1035: "The resolver then adds to SLIST all of the known addresses for the name servers, [..]". Same for §2.3 of RFC1123: "When the remote host is multihomed, the name-to-address translation will return a list of alternative IP addresses. [..] Application protocol implementations SHOULD be prepared to try multiple addresses from the list until success is obtained." – Patrick Mevzek May 16 at 21:16
  • 1
    @PatrickMevzek At least in RFC1123 it's a SHOULD and not a MUST requirement, so a resolver which doesn't support this is not necessarily non compliant. – Marcel Krüger May 17 at 1:01
  • @MarcelKrüger SHOULD means "This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course." What would be the valid reasons to not take into account all IP addresses? Considering that today any nameserver, or any host for that matter, should have both IPv4 AND IPv6 adresses so you are immediately in the territory of "multiple" addresses... – Patrick Mevzek May 17 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.