Why are there no GeoDNS solutions anywhere in sight?

Mailman List Mirror (Read Only)
1

Dear NANOG@,

Not every operator has the ability to setup their own anycast.

Not every operator is big enough to be paying 25 USD/month for a
managed GeoDNS solution, just to get their hands on GeoDNS. (Hey, for
25$/mo, I might as well have an extra POP or two!)

Why so many years after the concept has been introduced and has been
found useful, can one not setup GeoDNS in under 5 minutes on one's own
infrastructure, or use GeoDNS from any of the plentiful free or
complementary DNS solutions that are offered by providers like he.net,
xname.org, linode.com and others?

I'm an NSD3 user and have a POP in Europe and NA, and, frankly, the
easiest (and only) solution I see right now is, on both servers,
running two copies of `nsd` on distinct sockets, and redirecting
incoming DNS traffic through a firewall based on IPv4 /8 address
allocation (RIPE and AfriNIC -- to an `nsd` instance with zone files
with an `A` record of a POP in Europe; ARIN, APNIC, LACNIC and the
rest of /8 allocations -- an `A` record for NA), with zone replication
managed through git. Yeap, it's rough, and quite ugly, and
unmaintainable, and will give optimal results only in 80 to 95 per
cent of actual cases, and will not benefit from the extra webapp
redundancy one otherwise might have had, but what other alternatives
could be configured in 5 or 15 minutes?

Any plans to make DNS itself GeoDNS-friendly?

When editing a zone file in `emacs`, why can one not say that one has
3 web servers -- Europe, NA, Asia -- and have the dns infrastructure
and/or the web-browser figure out the rest?

Why even stop there: all modern browsers usually know the exact
location of the user, often with street-level accuracy. It should be
possible to say that you have a server in Fremont, CA and Toronto, ON
or Beauharnois, QC, and automatically have all East Coast users go to
Toronto, and West Coast to Fremont. Why is there no way to do any of
this?

Cheers,
Constantine.

2

No. And I say this as someone working for a vendor that provides that
service.

Any sort of "Geo" DNS is what protocol people would call a "stupid DNS
trick". It works in particular, narrowly-scoped ways because of the
loose coherence of the DNS. But as a matter of protocol, you can't
really standardize it, because it's actually taking advantage of
certain flexibilities in the DNS and its interaction with the routing
system. Turning that operational fact into a protocol feature would
be a bad idea.

A

3

Constantine A. Murenin wrote:

Why so many years after the concept has been introduced and has been
found useful, can one not setup GeoDNS in under 5 minutes on one's own
infrastructure, or use GeoDNS from any of the plentiful free or
complementary DNS solutions that are offered by providers like he.net,
xname.org, linode.com and others?

Because we are mobile and want to use our IP addresses and domain
names regardless of our current locations.

            Masataka Ohta

4

The first hit on Google for "dns geolocation" results in http://backreference.org/2010/02/01/geolocation-aware-dns-with-bind/, or the first hit for "dns geolocation patch" leads you to http://www.caraytech.com/geodns/

5

I guess there could be with LOC records.

~Seth

6

You can set up GeoDNS without anycast with PowerDNS and Bind easily
enough (I found PowerDNS easier to setup). If you are using Bind you can
use the geoip patch or use views which is a quick hacky way.

http://doc.powerdns.com/html/geo.html

I can't comment on either solution if it supports getting the real
remote IP address (PowerDNS does for the PipeBackend if its enabled so I
assume it may be available) rather than the address of the resolver.

For management I would lean towards PowerDNS of the two, you can stick
on any of the available web interfaces if you want and use the SQL
backend (replication can be used here to update records on slaves). The
country management would still need to be done out of files though the
records themselves would be edited/served out of the database.

I don't run Bind any more but if you want a copy of the configs for
PowerDNS or other details email me offlist and I am happy to help.

7

Constantine A. Murenin wrote:

Why even stop there: all modern browsers usually know the exact
location of the user, often with street-level accuracy.

If you think mobile, they don't, especially because "often" is
not at all "enough times".

Why is there no way to do any of this?

Because it is impractical to assume an IP address can be mapped
uniquely to a geolocation.

            Masataka Ohta

8

You are coming to this from the perspective of the existing
conventions, and the current way that GeoDNS is done through a
Split-Horizon DNS hack.

But this is not what I want.

What I want is an ability to specify multiple A and AAAA records, and
their locations, and make it possible for the web-browser to
automatically select the best location based on the presumed location
of the user. Browsers might have a couple of rules, e.g. that Europe
and parts of Asia are currently not directly connected to Asia, but NA
is, and such rules would influence browser's decision to choose a
Quebec server for a user in Japan, since it'll likely be much closer
than the one in Moscow.

Does it sound too complicated and pointy? Yes, it's not exactly
trivial, and not as good as BGP, but better than having 300ms latency
from a simple round-robin.

C.

9

peice of cake. add loc records to your rrset.

/bill

10

Apart from not being supported by anyone, it's also broken by design
in regards to the "Searching by Network or Subnet" section (e.g. the
party who controls 0.0.0.88.in-addr.arpa is not at all related to the
party that has 88.198.0.0/16), and also has no IPv6 support:

http://tools.ietf.org/html/rfc1876#section-5.2.2

C.

11

Constantine A. Murenin wrote:

Why even stop there: all modern browsers usually know the exact
location of the user, often with street-level accuracy.

If you think mobile, they don't, especially because "often" is
not at all "enough times".

Are you suggesting that geolocation is inaccurate enough to misplace
Europe with Asia?

Why is there no way to do any of this?

Because it is impractical to assume an IP address can be mapped
uniquely to a geolocation.

Why is it impractical? If I have a server in Germany and in Quebec,
why would it be impractical to have the logic in place such that
European visitors would be contacting the server in Germany, and
visitors from US/Canada -- the one in Quebec?

C.

12

But what if the server in Quebec is a little VPS on a 10Mb/s link while the one in Germany is a rack of servers on a 10Gb/s link?

What if I just want the server in Quebec to serve people from Canada and the one in Germany serves the rest of the world?

What if it is 4am in Quebec but 9am in Germany? (it is right now)

What if I have half a dozen pops worldwide?

What if I have 20? 200? 2000?

What is closer to a user in New Zealand, A Pop in Japan, Singapore or LA?

The main thing with GSLB is:

The little guys don't need it,
The medium sized sites outsource,
The big guys roll their own.

Personally I outsource and it works very well.

13

> Constantine A. Murenin wrote:
>
>> Why even stop there: all modern browsers usually know the exact
>> location of the user, often with street-level accuracy.
>
> If you think mobile, they don't, especially because "often" is
> not at all "enough times".

Are you suggesting that geolocation is inaccurate enough to misplace
Europe with Asia?

last month, while in western australia, geoloc pegged me in utah.
this morning, geoloc pegged me in Kansas, while resident in Maryland.

>> Why is there no way to do any of this?
>
> Because it is impractical to assume an IP address can be mapped
> uniquely to a geolocation.

Why is it impractical? If I have a server in Germany and in Quebec,
why would it be impractical to have the logic in place such that
European visitors would be contacting the server in Germany, and
visitors from US/Canada -- the one in Quebec?

C.

secure dynamic update works. waht is TWC's incentive to allow clients to update
tjheir reverse DNS delegations, esp when clients are leaving them for T-Mobile?

your sugesting the cretion and deployment of something that already exists
in the LOC RR. Your rational is that LOC isn't used. If thats the case,
why would your proposal be any more successful?

/bill

14

Constantine A. Murenin wrote:

Are you suggesting that geolocation is inaccurate enough to misplace
Europe with Asia?

Yes, of course.

Think mobile.

            Masataka Ohta

15

I don't think that it is even a suggestion. It is trivially achievable:

I have a transit provider which is a US based company. They route a
small slice of their IP space to us over the transit link...
at their PoP in London...
where I pick it up and route it to Johannesburg.

All the while - geolocation is convinced those IPs reside in the
hometown of my transit provider.

I also know of many people who use VPNs to intentionally goelocate
themselves somewhere other than their real location in order to get
around certain content filtering.

16

Yes, sometimes very inaccurate.

  Just go to an IETF meeting and you will be placed all around the globe.
It is a corner case, but it shows some deficiencies in the current approach.

.as

17

I understand that you want a packaged solution in your authoritative DNS software, but with a little work you can get close without any knowledge of global topology or address distribution (i.e. no need for a geo-IP database). You need some unused address space to burn on anycast advertisements, though.

Here's an approach using anycast DNS:

$ORIGIN example.com.
...
www CNAME www.geo.example.com.
...
; number any1 and any2 using addresses that
; are anycast between our service locations
any1 A ...
     AAAA ....
any2 A ...
     AAAA ...
...
geo NS any1
    NS any2

; serve this version of geo.example.com
; in Asia on any1/any2, make www
; something sensible for Asian clients
$ORIGIN geo.example.com.
...
www A ....
    AAAA ...

; serve this version of geo.example.com
; in Europe on any1/any2, make www
; something sensible for European clients
$ORIGIN geo.example.com.
...0
www A ....
    AAAA ....

; etc

No reason that all the variants of the geo.example.com. zone can't be signed with the same keypair, and a suitable DS RRSet installed in example.com; this doesn't break DNSSEC.

Two nameservers in the example above; this gives no site diversity for the geo.example.com zone but perhaps it's useful to incorporate server diversity within the site (if not, use one).

You need to be able to advertise an anycast route to the world from each location, and you need spare numbers to be able to make those advertisements. For v4 that means an unpolluted /24; for v6 that probably means an unpolluted /56 or /48. Anycast of a single service is not a friend of efficient address utilisation.

As with any other use of anycast, "European client" means "client whose path to any1/any2 lands in the European service location" and doesn't actually say anything about the location of the user. But if the selected exits along the path for some client land in Europe for resolving names in geo.example.com, maybe that's a good way to send the HTTP traffic.

Another approach is to anycast the HTTP server serving www.example.com, and have that server return a 3xx redirect to www.asia.example.com or www.europe.example.com, which preserves the ability for the user of making a manual choice for one or the other at the expense of making your web people all flappy about the longer URL and the potential for particular content to be bookmarked with no future potential for geo-distribution. People get animated when you suggest you anycast a TCP service, but there is no shortage of examples of this working (and the redirect transaction is brief, which is generally nerve-settling).

Lots of ways to skin this cat.

Joe

18

You need something more sophisticated than that because for a single
domain name you can't say which LOC records correspond to which address
records.

Tony.

19

There is not "no way to do any of this." People do it all the time. They do it using anycast, which requires a certain amount of network build, or they do it using source-address databases, which have a certain amount of ridiculous FAIL. Are you actually asking why there's no way to do it perfectly at no cost?

                                -Bill

20

Why are you insisting that mobile will have wrong geolocation?

Yes, there are cases when due to the portable WiFi hotspots the
location may be wrong temporarily, but how is that much different from
a suboptimal node selection through a plain round-robin DNS?

C.