-1

I have a peculiar use case in which I want to override the public DNS mapping for a specific domain alone. The domain does not belong to me.

I have currently setup a BIND DNS server which forwards all requests except for this domain to Google's public DNS (8.8.8.8) and DNS records are setup for this domain alone. This solution works well except that there is up to around 350 ms lag if the request is from a location far away from the DNS server.

I would like to do away with the trouble of hosting DNS servers in different regions. Does there already exist hosted/cloud products which provide the same service - a fast, secure, reliable public DNS service in which individual DNS records can be overridden?

5
  • What OS are your clients running that are 350ms away? Are they at a remote site or something? Can you simply setup another DNS server? Why does this need to be anycast?
    – Zoredache
    Nov 26, 2014 at 22:51
  • Do you already have an anycasted block of IP addresses or a spare block of IP addresses large enough to be used for anycast?
    – kasperd
    Nov 26, 2014 at 22:59
  • 3
    this question is very unclear and could do with clarification.
    – Sirex
    Nov 26, 2014 at 23:15
  • Even with the edit, I'm absolutely at a loss as to EXACTLY what you're trying to achieve. Why do you need to "override" the DNS for a domain you don't own?
    – Dan
    Nov 27, 2014 at 14:19
  • Your clarified question is off-topic for Serverfault as it appears to be looking for a product/service recommendation.
    – Andrew B
    Nov 27, 2014 at 22:40

2 Answers 2

0

There are multiple providers of public recursive resolvers. At least one of those has some configurable filtering of DNS queries. However the specific provider I know of has taken the questionable move to filter certain domains by default, and for that reasons I wouldn't recommend using that particular provider.

But there are technical challenges in what you are asking for, which a provider cannot eliminate, so you need to understand what the limitations are and what that means to what you can expect.

The DNS protocol does not include any information to identify the individual users of the service. This leaves client and server IP addresses as the only way to distinguish users.

If the provider uses client IP addresses for this purpose, they will run into lots of shortcomings. Clients may have dynamic IP addresses or possibly connect through a NAT. Additionally they will have trouble verifying that the customer really owns all the IP addresses they say they own. This is not just a problem to resolve once two customers claim to own the same IP space, because the service may very well support unregistered users as well.

The alternative is to allocate different server IP addresses to each customer. This does not suffer from the same shortcomings. Because once a server IP has been allocated to one customer, the provider can do whatever that customer wants with requests sent to that IP without affecting other users, because no other user will send legitimate requests to that IP.

However there is a shortage of IPv4 addresses. With IPv4 a typical anycast prefix has 256 addresses. From this the provider might need to reserve four addresses for network address, gateway address, broadcast address, and server address for users without dedicated server address. This leaves 252 other IPv4 addresses, they could allocate for specific customers. So if you would be one of that provider's 252 largest customers, chances are they would be willing to sell such a service to you, otherwise you'll probably have to deal with the problems caused by using client IP to identify you.

If you decide to go IPv6 this is much less of a problem. I don't know what a typical anycast prefix length is on IPv6, but surely it is somewhere between 32 and 64 bits, which means there will be more than 18 trillion server addresses to chose from, which is more than enough to allocate one for each customer.

-1

Yes there is, and is it called the hosts file.

3
  • I am not sure you understand my question/my question is not clear enough. The DNS will be configured on the network and the clients connecting on the network will get the IP of the DNS server I have created as their DNS IP. The overriding of DNS mapping should happen for the clients in this scenario.
    – nijanthanh
    Nov 26, 2014 at 22:30
  • @nijanthanh If the clients get the DNS server IP through DHCP, then you don't need anycast. You can just have each DHCP server hand out the IP of a DNS server close by. You don't need to have all the DHCP servers hand out the same DNS server IP.
    – kasperd
    Nov 26, 2014 at 23:04
  • @kasperd Thanks for the suggestion. That should work, but instead I would love to offload the trouble of hosting DNS servers in different regions to some third party service if available.
    – nijanthanh
    Nov 27, 2014 at 13:54

Not the answer you're looking for? Browse other questions tagged .