Thomas Kernen wrote:
And what happens if the 4.0.0.0/8 route is flapped from the
routing table? No more DNS. So you still want route diversity
that isn't in the same block or aggregated block.
You know, some folks simply decide that, for the cost and complexity of
managing a box in someone else's space (not to mention potential security
issues, et al, for some) that the loss of DNS server is fairly irrelevant
if the entire rest of their netblock is offline.
"Gee, DNS says that www.joebobsisp.com is over here... but I can't get
there with the route yoyo-ing like mad". Have you *really* gained much,
in this situation?
(Note that I'm not claiming in the least that there aren't situations in
which having off-AS servers is worthwhile, and if you have multiple ASes
from aquisitions or the like, it would certainly seem wise to make use of
that fact, but there ARE issues, and for some number of folks, those
issues can easily outweigh the (often limited) benefits gained...)
<Soapbox>
Remember: one of the most important things about knowing the rules is that
it makes it possible to evaluate whether breaking the rules is worth the
consequences.
</Soapbox>
[ On Saturday, January 27, 2001 at 01:08:38 (-0800), lucifer@lightbearer.com wrote: ]
Subject: Re: How common is lack of DNS server diversity?
Thomas Kernen wrote:
>
> And what happens if the 4.0.0.0/8 route is flapped from the
> routing table? No more DNS. So you still want route diversity
> that isn't in the same block or aggregated block.
You know, some folks simply decide that, for the cost and complexity of
managing a box in someone else's space (not to mention potential security
issues, et al, for some) that the loss of DNS server is fairly irrelevant
if the entire rest of their netblock is offline.
Well maybe, but, it depends on what your offered services are too.
If you're offering e-mail and you've published your addresses as
<user@subdomain.yourdomain.tld> but you've got no DNS to hand MX records
back then there's a good chance that many improperly implemented mailers,
and/or DNS resolver libraries that those mailers might use, will bounce
any of your e-mail instead of keeping it in their queues and retrying at
regular intervals. Whether this is worse than just being off the air
temporarily or not depends on many factors.
Of course if you're doing DNS for many zones then, as others have
already pointed out, having all the nameservers routing into one AS is
definitely going to be less reliable than some of your users might think
it should be.