Hacker News Reader

Comment by m348e912 | Hacker News Reader

What's the benefit to cloudflare for offering dns services for free other than data-mining? Facilitating 1.3T DNS requests per day can't be cheap.

View on HN

It (coincidentially or not) limits the performance of competing regional CDNs to that of Cloudflare, since 1.1.1.1 truncates the EDNS client subnet parameter, which means that the only location/region hint a third-party CDN DNS has to go by is Cloudflare's location, not the user's.

As an example, consider a user in Paris, and assume for the sake of this example that Cloudflare's closest POP is in Berlin. Assume that user visiting a site hosted by a French CDN, with POPs in both Paris and Berlin.

If that user tries to resolve cdn.mysite.fr via 1.1.1.1, they'd get a Berlin-based location, since the French CDN has no way of knowing that the user is actually closer to them, and Paris would have been the better option.

Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic. Honestly I don’t take any CDN that doesn’t operate on anycast seriously these days, the issues with GeoDNS are well established at this point and if your network operations can’t handle the complexity of an anycast deployment you’re probably dropping the ball on a lot of other fronts.

Have you ever built a CDN or anycast network? I have, many times.

Anycast isn't magic, and it can't be used in all situations. For example Akamai has 16 times as many POPs as Cloudflare does, and many of them reside within smaller ISPs where you might not be able to establish BGP sessions. Long running downloads and websockets are better served over unicast addresses. Not to mention you don't have a lot of knobs to fix things when anycast does go wrong and you have a network in the US sending your traffic to an EU POP because they have cheaper transit in Europe.

You might find this work from LinkedIn informative: https://engineering.linkedin.com/network-performance/tcp-ove...

> Cloudflare doesn’t use GeoDNS for their CDN, it’s all anycast. They have no use for EDNS for their own traffic.

Which makes it all the more dubious to block it…

More control over ip selection for clients to better direct traffic for their customers is the obvious first order benefit. Passive competitor data collection is useful too.

DNS traffic has good traffic ratios, at least compared to typical http traffic. That's got to help with peering negotiations. Although DNS traffic isn't that much, so it probably doesn't help much.

Same for accepting and dropping inbound volumetric DDoS. Larger ISPs want to see roughly balanced inbound and outbound flows before they'll agree to settlement free peering, and options for attracting inbound flows from residential ISP customers are limited (run a backup service, run a 1:1 multimedia messaging service and/or video chat, DNS helps a bit)

If we think more complexly we can find a much better answer. Cloudflares profitable services depend on DNS working properly for both the customer and the customers userbase. DNS servers outside of cloudflares control may not be correct, or may not route properly in various edge conditions. Therefore an easy way to solve this is to simply host their own DNS.

This is probably it; the very first thing support can ask is "try it with 1.1.1.1 and see if it works" - if it does, it's a DNS issue.

Also, by running their own DNS they can ensure that some percentage of the Internet does NOT cache results beyond what they want (to some extent) - much of what Cloudflare does is DNS trickery to route to the appropriate CDN.

Latency. Cloudflare is selling speed. When you use their DNS, then lookup of their CDN domains is going to be faster, since you're querying the source directly rather than through intermediate DNS servers.

They have an accurate internal number of what websites people are going to. They could use this to direct their sales people. They might also use it with their secret score on every user to decide if they need a captcha. They could also just have it in their back pocket as a potential extra revenue stream selling user data.

The "other than data-mining" part is still unanswered

They have a free offering for anti-malware and anti-porn DNS server (1.1.1.2 and 1.1.1.3). Right now it's targeting for "families", but at some point they could easily monetize this especially to corporate networks.

And from a corporate perspective, historically no one ever got fired for using IBM. Who would you want running your Fortune 500 corporate CDN, a company that can handle 1.3T reqs/day or another CDN provider that's one-tenth the price but doesn't have the scale/reach of Cloudflare?

> but doesn't have the scale/reach of Cloudflare?

Akamai is IBM in this example. They are "enterprise" and have been long before Cloudflare existed and have 4,200 POPs compared to Cloudflare's 250.

Isn't this typical tech development? Gain monopoly through free offerings and then squeeze the segment for max profit

Commoditize your complement.

Users need working DNS to use Cloudflare’s paid services. That used to be a business in and of itself, where OpenDNS made money showing people ads. But now the market price has been driven to zero.

Google has been offering 8.8.8.8 forever and never charged.

Tap tap tap, is this thing on?

To quote: The "other than data-mining" part is still unanswered

I would presume they're getting plenty of value out of that data.

Do no evil always comes to a hard stop when investors realize it also means do no capitalism.

Almost like the modern corporate structure is what's really evil. Sixty or Seventy years ago, in the golden age of US manufacturing, companies were mostly privately owned. No shareholders to please. That let them make long-range strategic plays, instead of making short term anti-plays just to make the next quarter number go up.

Considering their core products, DNS might be an early-warning sign of DDoS. A sudden surge in requests for a domain will trip a circuit breaker before the HTTP sessions begin. There's probably a way to tell the difference between a bot attack and a hug-of-death by the pattern of DNS.

One of the more evil things they could do is show you ads, for example every 100 requests, you are shown a full page ad for a few seconds, then directs to where you were going. Pretty much like how youtube does it.

I'm not saying they will do this, but they could if they wanted to. I've seen this from DNS providers in other countries.

OpenDNS used to hijack DNS to show ads, which is one of the reasons Google launched the non-hijacking 8.8.8.8 in 2009. OpenDNS quickly followed suit. No one would attempt it today, seeing as it would instantly make you the worst DNS resolver on the Internet and switching away is trivial.

Thankfully that's probably not feasible anymore given how prevalent HTTPS is these days.

Given that almost every site now uses HTTPS, they could only do this for users navigating to non-existing domains (and furthermore have to register the domain names themselves, or they wouldn't be able to get any TLS certificate for them).

Would that work over HTTPS? My understanding is that, when the browser connects to the IP returned over DNS, it validates the TLS cert returned by the server at that IP contains the website name.

Reply on news.ycombinator.com