Best Practice 1: Use a hidden master
A hidden master is a name server that is not advertised and does not appear in any name server records. In other words, it is not known publicly on the Internet and does not answer any queries. The hidden master’s purpose is to provide zone transfers to a set of secondary name servers that are known publicly and answer queries.
FAULT TOLERANCE
Master can go down without impacting the resolution of your domain.
SECURITY
IP address of the name server is not published, and is less likely to be hacked.
EASY ADMINISTRATION
Reloads and restarts of the hidden master do not impact resolution of your domain.
Best Practice 2: Disable recursion and use TSIG
Disable recursion on your hidden master and authoritative external nameservers. Turning off recursion reduces the vulnerability to denial of service attacks and cache poisoning, and helps improve performance.
USE TSIG TO SECURE NAMESERVER TO NAMESERVER COMMUNICATIONS
Communication between the hidden master and secondary nameservers should be cryptographically authenticated using Transaction Signatures (TSIG). TSIG is much more secure than source IP address filtering which can be easily spoofed with UDP.
Best Practice 3: Place nameservers close to users
The latency of DNS lookups is important for your website. Long latency can translate into lost customers and revenue. Your authoritative nameservers answer queries from other nameservers on the Internet. To ensure a good user experience and fast access to your website, place your nameservers close to, or quickly accessible from the nameservers querying them. Optimally, this would involve placing nameservers in locations with good access to the Internet such as Internet Exchange Points (IXPs).
The highly recommended solution is an outsourced secondary anycast DNS service. With anycast, multiple geographically distributed nameservers share a single IP address and queries are routed to the closestnameserver. When selecting an anycast DNS secondary service, make sure the nameservers are located in IXPs that map geographically to your customers.
Best Practice 4: Make your DNS resilient to DDoS attacks
DDoS attacks using DNS as the attack vector are on the rise. Increase resiliency to DDoS attacks with the extra query capacity and bandwidth of an anycast DNS cloud. To the world, the anycast cloud appears as a single IP address. In reality it is a network of geographically distributed nameservers. An anycast cloud is much more resilient to a DDoS attack than single unicast servers because it uses geo-location to specify what server answers a query and it has the combined capacity and bandwidth of all the servers. With anycast, the impact of an attack is isolated to the name server closest to the source(s) of the attack.
Most DDoS attacks originate offshore. When selecting an anycast DNS service ensure there are international nodes that can soak offshore attacks. An international node sinks traffic from an offshore attack while helping domestic name servers to remain unaffected.
Best Practice 5: Make your DNS disaster-proof
Use redundancy to make your external DNS disaster-proof. With unicast servers, this means at least two nameservers in different locations. A better alternative is an anycast DNS cloud to provide redundancy. If a nameserver in an anycast cloud goes down, it is automatically removed from the routing tables. In this way, anycast adds redundancy and fault tolerance.
With anycast, the highest level of redundancy is achieved with two separate clouds. When compared to unicast redundancy, it is like replacing two unicast nameservers with two anycast clouds. Make sure the clouds use independent hardware and transit providers. This protects against a routing problem or transit network outage from bringing down your DNS.
Best Practice 6: Use Anycast DNS
Anycast has been in use for more than 10 years to provide name services for the root server on the Internet as well as many top-level domains including .CA. Anycast DNS is the optimal solution for fault-tolerance, DDoS resiliency and placing name servers close to users. For most organizations, building and managing their own anycast DNS infrastructure is too expensive and not practical. Fortunately, an anycast DNS service like D-Zone Anycast DNS can be easily added to your DNS infrastructure.
