Hacker News Reader

Comment by overstay8930 | Hacker News Reader

Internet stability is not threatened by the loss of a single root server, it’s not even a blip on the radar. In fact most people wouldn’t even notice if they all went down for a few minutes, DNS operators do not actually use these servers directly. You can even run your own if you are crazy enough.

Everyone likes to meme on DNS but it’s literally designed to make these servers as unimportant as possible. It’s a really well designed system that will probably be around as long as humans exist.

View on HN

> DNS operators do not actually use these servers directly.

No, but a lot of servers do. In 2020 the root servers saw 120 billion queries a day, which was double what they saw in 2018:

https://blog.apnic.net/2020/09/28/scaling-the-root-of-the-dn...

It's probably closer to half a trillion queries a day now.

IIRC a large chunk of those is spam from chrome which most people wouldn't notice if they stopped working

… under what circumstance is Chrome hitting the root DNS servers?

Old bug fixed in 2020. OP didn’t know of the fix it seems. Was covered on Hacker News at the time. Still top google result.

Well that's horrifying.

For those that are wondering like me: https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-d...

Essentially, it generated 3 random, single-label (so, "TLD") queries, and ran them through DNS. Whatever recurser that lands at obviously wouldn't have random junk in its cache (unlike probably any other root record) and thus had to go to the root servers for it.

They did this to try to not display an omnibox result for single words (the example in the article is "marketing") on what I'm going to just call "broken networks"; see TFA if you're curious.

Note that running your own mirror of the root on the recursive nameserver(s) on your network will keep the traffic generated from these sorts of queries off the rest of the internet.

If you're already running your own recursive resolver on reasonably up-to-date software it can be surprisingly easy to set this up; see rfc8806 for some config examples.

Is there a use case for that? I mean other than that it's kinda cool

Per rfc8806, because the data in the root zone has long TTL values, most queries to the root servers are for nonexistent top-level domains due to typos and search paths gone wrong, so in some sense it's community service to reduce useless traffic to the roots -- you do a single burst download of about 2MB daily instead of all of your query traffic.

Other reasons why you might do it are covered in rfc8806 - slightly reduced latency on cold-cache DNS queries, added resilience against DoS attacks against root DNS servers.

> that will probably be around as long as humans exist.

My goodness, that's a strong claim to make, about a glue layer in a computing technology that's been around for just 50 years. I mean, arguably the internet as we knew it is already dying. The original design of DNS was flawed (no security), and the patches to fix those flaws are far from perfect.

Replacing Internet infrastructure is incredibly difficult. We'll all be switching over to IPv6... any decade now.

DNS was flawed, but it was very good for the time, and it still is the keystone around which the entire Internet functions. That's pretty incredible for a system that has indeed received a lot of patches. And DNSSEC might turn out to be just as well designed as the original DNS. Besides, what are we going to replace it with, namechain? I'll put you on hold while all the ISPs switch over.

Over 50% of Internet traffic is IPv6, by the way.

> but it was very good for the time

It's still very good. People keep finding new ways to apply DNS.

I was just grumbling about the OTT claim that the DNS will still be there as the last human becomes extinct.

I think the conventional wisdom is that we are going to replace DNSSEC with nothing. Security is provided at other layers of the stack.

Certain forms of security cannot be provided by other layers of the stack.

it's Good Enough and Not Broke, so there's little incentive to iterate

I wouldn't mind some alien technology taking over for TCP/IP but that's squarely within the "unforseeable" IMO

A bit pessimistic, but maybe the subtext is we won’t be around for very much longer

Reply on news.ycombinator.com