DNS Operators Research Articles

Disjointly non-singular operators on Banach lattices

An operator T from a Banach lattice E into a Banach space is disjointly non-singular (DN-S, for short) if no restriction of T to a subspace generated by a disjoint sequence is strictly singular. We obtain several results for DN-S operators, including a perturbative characterization. For E=Lp (1<p<∞) we improve the results, and we show that the DN-S operators have a different behavior in the cases p=2 and p≠2. As an application we prove that the strongly embedded subspaces of Lp form an open subset in the set of all closed subspaces.

Benchmarking Authoritative DNS Servers

In this paper, we examine the performance of four authoritative DNS server implementations (BIND, NSD, Knot DNS, and YADIFA). In our tests, we apply the measurement procedure defined in Section 9 of RFC 8219. Our aim is threefold: to provide DNS operators with ready to use measurement results to support their selection of the best fitting authoritative DNS server implementation for their needs, to assist researchers and DNS64 server developers in finding a suitable authoritative DNS server implementation for their DNS64 benchmarking measurements, and to advance the theory and practice of benchmarking DNS servers. We examine how the different conditions such as the number of active CPU cores, the size of the zone file, the applied timeout, and the type of the processor influence the performance of the tested authoritative DNS server implementations. The performance of all four tested DNS servers scales up more or less well with the number of CPU cores, except for YADIFA. The increase of the size of the zone file causes significant degradation only in the performance of BIND, which shows different anomalies described in the paper. The change of the timeout from 250ms (required by RFC 8219) to 100ms usually causes only a small performance degradation. We point out that NSD and Knot DNS can achieve an order of magnitude higher performance than BIND and YADIFA.

Energy-aware DNS server allocating

Faced with the scalability and reliability challenge, the DNS is increasingly operated by geographically dispersed data centers. Energy management across those distributed diverse data centers is critical to reducing revenue loss for DNS operators. This paper addresses the DNS server allocating problem aiming at optimizing revenue loss in terms of delay cost and energy cost. An analytical model is proposed taking network delay, query processing delay, energy costs, and server selections into consideration. The optimal solution is obtained analytically given static parameters or using an iteration method given dynamic parameters. The effectiveness of energy-aware DNS server allocating and the feasibility of the proposed iteration method are validated through simulations.

A First Look at Certification Authority Authorization (CAA)

Shaken by severe compromises, the Web’s Public Key Infrastructure has seen the addition of several security mechanisms over recent years. One such mechanism is the Certification Authority Authorization (CAA) DNS record, that gives domain name holders control over which Certification Authorities (CAs) may issue certificates for their domain. First defined in RFC 6844, adoption by the CA/B forum mandates that CAs validate CAA records as of September 8, 2017. The success of CAA hinges on the behavior of three actors: CAs, domain name holders, and DNS operators. We empirically study their behavior, and observe that CAs exhibit patchy adherence in issuance experiments, domain name holders configure CAA records in encouraging but error-prone ways, and only six of the 31 largest DNS operators enable customers to add CAA records. Furthermore, using historic CAA data, we uncover anomalies for already-issued certificates. We disseminated our results in the community. This has already led to specific improvements at several CAs and revocation of mis-issued certificates. Furthermore, in this work, we suggest ways to improve the security impact of CAA. To foster further improvements and to practice reproducible research, we share raw data and analysis tools.

DNSSEC simulator for realistic estimation of deployment impacts

DNS is one of important infrastructures on the Internet. If widely-known domain names are forged by DNS spoofing, a number of users have the potential to be forged and lead to phishing sites. In order to protect users, DNSSEC is an important technology. However, DNSSEC is not widely deployed now because the deployment has side effects in operator’s point of view. It is anxious for DNS operators to enable DNSSEC without creditable estimations of its impacts. In this paper, we propose DNSSEC simulator which can estimate the impacts. Our DNSSEC simulator can estimate and simulate the impacts using actual DNS queries, DNS topology, and actual DNS implementations. Moreover, there is no need of knowledge of DNS simulation. The simulator estimates the impacts easily by just providing DNS query log. The software can contribute the deployment of DNSSEC and achieving safe DNS world.