In the Domain Name System s language, rcode 0 stands for: no error condition.

Transcription

1 12/2017 SIMPLE, FAST, RESILIENT In the Domain Name System s language, rcode 0 stands for: no error condition. If a DNS server answers a query with this result code, the service is running properly. This is the reason why we named our product.

2 WE ALL RELY ON THE DOMAIN NAME SYSTEM Nowadays an enormous part of business success depends upon the availability of the Internet. All relevant services such as web, , FTP and media servers are accessed via the Domain Name System (DNS) by people typing in the domain names of these servers. This is why the DNS has to be extremely robust and fail-proof and should be an essential part of a company s security strategy. With you will improve the security and reliability of your and your customers Internet presence. An Introduction to Anycast Technology The classical addressing method in the Domain Name System is unicast; a DNS server has a dedicated IP address. Queries to this IP address all lead to this one server no matter where in the world the client is located. This may cause delays and timeouts for remote clients. Furthermore, if the server is down or a victim of a DoS attack, the whole service provided under this dedicated IP address is affected and not available anymore. Anycast routing helps to avoid this single point of failure ; name servers distributed as a cloud in different locations (so-called nodes) all advertise the same IP address. If a client looks up a domain name, the nearest anycast instance will respond. Due to several geographically distributed anycast nodes, this technology not only allows shorter response times and better traffic balance but has a set of further advantages. ROUTING SCHEMES Unicast Anycast Anycast: Fast, Secure and Reliable THE CAPACITY AND PERFORMANCE of the service increases with every anycast location. DoS ATTACKS affect only the anycast location nearest to the DoS source. Therefore, other anycast locations usually still answer the DNS queries from other regions in the world, which means that the service remains available. ALL LOCATIONS OF THE SERVICE appear as one global server with one IP address, keeping the size of the DNS responses small. Thus, DNS services based on anycast ensure optimal load balancing, increase reliability, decrease latency and are a highly effective response to DoS attacks. is the solution for private companies, internet service providers and domain registries to improve DNS response times, to reduce downtime and to protect themselves against attacks. Additional information: 2

3 Cloud: State-of-the-Art Infrastructure The network is continuously expanding the globally distributed nodes and locations with two command and control servers in Vienna and Salzburg, Austria. The actual number of nodes is shown on our website The number of locations is not the only criterion for a high-performance network; the technical architecture and hardware play an even more important role. This is where we commit ourselves to the highest available standards and quality. The capacity of each location mounts up to 500,000 DNS queries per second which adds up to 5 million queries per second for the whole anycast network. This capacity allows hosting of over 50 million customer zones in an extremely robust and latest state-of-the-art environment. The technical architecture complies with the respective RFC (request for comments) 4786 of the IETF (Internet Engineering Task Force). Product Features In addition to the state-of-the-art technical architecture described above, is characterized by the following features and services: MANAGING AND PROVISIONING services can be easily managed via a DNS editing interface, via a web API or one of our integrations in panels like Plesk or Domainmanager, where you can easily add, change, manage and delete zones (domains). Everything else is done automatically: Within seconds the zones are deployed in the entire anycast network. All you have to do is to add a hostname that points to the IP-address of the service. Any information given to the command and control servers via these interfaces is validated and automatically deployed in the anycast network. SERVICE MONITORING AND SUPPORT All services are monitored 24 hours a day year round. As soon as an error is reported, recovery measures are taken immediately. Emergency and support hotlines guarantee minimal response times and personal customer care. Our support hotline is available from Monday to Friday from 8 am to 6 pm CET, our emergency hotline round-the-clock. STATISTICS Our comprehensive monitoring system delivers a wide range of statistics, which are made available to customers depending on their needs and the product selected. We offer basic, daily per-zone DNS statistics, long term traffic statistics and raw traffic dumps. For your data analysis, you will receive one data set per zone and day or week with your daily query statistics. Statistical data is presented in a webinterface and can also be downloaded in CSV format for further processing. HOST NAME & IP-ADRESSES As an client you can brand the host name with your preferred name (e.g. ns1.customer.com instead of ns1.rcodezero.at) while pointing to the IP address of IP- Com. We also offer to operate with exclusive IP addresses from the IPCom address range or even IP addresses from your own network (then we announce your prefix in BGP). IPv4 AND IPv6 The nodes provide name service via both IPv4 and IPv6. Second Anycast Cloud Starting from the product Medium customers get additional redundant anycast instances with a second IP address. MASTER DNS Enterprise customers can take advantage of the free of charge feature Master DNS in order to outsource their entire DNS infrastructure. Until further notice, this eliminates the DNSSEC functionality, but no longer it is required to operate your own servers and allows complete outsourcing of your DNS. 3

4 The security extension DNSSEC supports the DNSSEC standard. DNSSEC technology is a security extension for the DNS that guarantees the authenticity and data integrity of DNS transactions. DNSSEC ensures that your domain queries are answered by the server responsible and ensures that they are not manipulated en route. This DNSSEC security protocol prevents a phenomenon known as cache poisoning, where DNS data is tampered with and users are directed to malicious websites. Many domain registries have already launched DNSSEC in their zones, and it is only a question of time until registrars and end customers will implement it as well. With you are prepared for this development. HOW DOES DNSSEC WORK? Verification of DNS entries is achieved using public private cryptographic keys. There are separate key pairs for each zone, from the root to the top level domain and on to the domain. Each pair of keys consists of a public and private component; while the zone is signed with the confidential private key, the public key is published within the zone itself for the purpose of verification. Under this system, the higher-level zone always validates the zone below in a chain of trust. WHAT ARE THE DIFFERENT STAGES OF THE DNSSEC SIGNING PROCESS? To protect a zone with DNSSEC the following criteria must be fulfilled: 1. A pair of keys must be generated and the private key protected from unauthorised access. This pair of keys must be regularly updated to preserve integrity. 2 The zone must be signed with the necessary software, and the signature must be updated each time any changes are implemented within the zone. Complete can take care of both steps for you i.e. key generation and subsequent administration and the signing process. 3 The DS record with the fingerprint of the public key must be registered in the upper zone responsibility for which rests with you as customer. 4

5 DNSSEC included in all products Life is good for customers: and not just because they don t have to waste their time worrying about the availability and performance of their DNS. Thanks to, DNSSEC uncertainties are a thing of the past. SEC Basic is included for all customers and the ideal solution if you want to sign your zones yourself. You provide the signed zones, recognises the signatures itself and ensures that the relevant DNSSEC resource records are supplied with a DNS response in a fully automated process. SEC Complete This is the full service carefree package included free of charge starting from Medium which allows customers to fully outsource responsibility for DNSSEC administration and management. You continue to deliver unsigned zones, as before. As soon as the DNSSEC Complete has been activated for a particular zone, generates the necessary DNSSEC key and signs the zone. We take care of the entire key management process for you and ensure that private keys are kept confidential. We supply you with the necessary public keys for entering the DS records in the upper zones. SIGNING DNS Master SIGNING Zone Transfer Control Server DNS Hidden Master Zone Transfer Control Server SIGNING Customer SEC Basic Self-signing. Customer SEC Complete signs for you. DNSSEC PROVISION Both activating and deactivating the signature service and triggering the key rollover function is managed simply using the web interface or the SOAP-API. KEY ROLLOVER Rolling over the Zone Signing Keys (ZSKs) can be handled by independently if required. It goes without saying that you can trigger a rollover of the key signing key (KSK) at any time as a zone operator. In this case you must enter the fingerprint of the new key (DS record) in the upper zone to conclude the rollover process. COMPLETE VALIDATION In the event of a key rollover and any deactivation of the signature service, we ensure that zone changes are implemented in accordance with the relevant TTL (time to live). This means that the zone can be successfully validated at any time. NAME SERVERS With Complete you can either add name servers from or your own nameservers to the zone s NS records thanks to the feature Outbound Zone Transfer with DNSSEC AXFR incl. TSIG. 5

6 : Anycast at Anytime for Anyone! Setting up and maintaining an anycast DNS network requires lots of money and resources. So why develop these services on your own? Save money and effort instead by relying on a professional and experienced partner. - the perfect enhancement of your DNS infrastructure FOR TOP LEVEL DOMAIN REGIS- TRIES is the perfect solution for TLD Registries fulfilling their high requirements on availability and security. With, a TLD operator immediately increases the footprint of his DNS server in an efficient way. The result: more resilience, better performance, and lower latency for customers. FOR INTERNET SERVICE PROVIDERS & REGISTRARS There are still many Internet Service Providers whose nameserver network is solely based on a few unicast servers. With, you can get access to a high level DNS service that is a benefit for both you and your customers: a state of the art DNS infrastructure that provides optimum performance, unlimited scalability and a professional management. makes your DNS service IPv6-compliant, even if your own infrastructure is solely based on IPv4. FOR ENTERPRISES For companies means a maximum improvement of their DNS infrastructure with a minimum effort, you can fully outsource your DNS infrastructure. Users will benefit from the technology by experiencing shorter response times, an upmost availability and sufficient capacity even in times of traffic peaks. These features will make your customers domains faster and resilient. helps you stand out from your competitors and provides a basis for new products. 6

7 WE HAVE THE PERFECT SOLUTION FOR YOU 7

8 WHO IS ipcom? ipcom is a subsidiary of nic.at, the Austrian domain registry. nic.at has managed the.at-zone since 1998 on a highly professional and reliable level. The RcodeZero DNS network has been developed by nic.at s R&D department and has been successfully in use for zones like.at,.versicherung,.tirol,.hamburg or.hu. External name service monitoring by RIPE NCC proves that.at is one of the most reliable top level domains. Rely on our experience for your DNS diversity and resilience. ipcom GmbH Karlsplatz 1/2/ Wien Austria T F -29 rcodezero@ipcom.at Status date: Dec 2017