DNS service

2.1 Frontend

2.2 Backend

3.1 Protocols

• DNS (UDP/TCP) on port 53 (frontend and backends)

• DNS over TLS (DoT) on port 853 (RFC 7858; frontend and backends)

• DNS over HTTPS (DoH) on port 443 (RFC 8484; frontend and backends)

3.2 ACLs

• queries are accepted from 2a07:6b40::/29, 147.87.0.0/16 and 10.0.0.0/8 only, everything else is denied (= reject)

• queries without the RD bit are denied (= reject).

3.3 TTL, Cache

• global TTL of 10s to 1h is enforced server-side

• queries to frontend are not cached on purpose

• queries to frontend for own zones (that have no CNAMEs) are not cached on purpose and directly stub-forwarded to NS servers

• queries to backend for own zones are not cached on purpose and directly forwarded to NS servers

• queries for expiring and frequent records are automatically prefetched

• cached (round-robin) records are answered with randomized order of records to workaround “dumb” clients

3.4 Forwarding

• forwarded queries to resolver backends are hashed to get answers for same records from one backend cache

• forwarded queries to authoritative backend are based on least outstanding connection count

3.5 Static hints

• Microsoft Active Directory at BFH unfortunately is named bfh.ch instead of e.g. ad.bfh.ch, hence static hints are used to let bfh.ch internally resolv to AD instead of the bfh.ch-Homepage

• all static hints have a TTL of 1h configured

3.6 Details

• both frontend and backends use SO_REUSEADDR and SO_REUSEPORT

• backends use QNAME minimization

• backends do DNSSEC validation, i.e. query to zones with invalid signatures will return empty answers with SERVFAIL

• in case upstream servers for foreign zones are not answering, stale records are served

4.1 Troubleshooting

    ssh node1.dns.bfh.info sudo kresctl cache clear .
    ssh node2.dns.bfh.info sudo kresctl cache clear .
    ssh node3.dns.bfh.info sudo kresctl cache clear .
    ssh node4.dns.bfh.info sudo kresctl cache clear .
  

4.2 Statistics

    ssh dns.bfh.info

    sudo dnsdist-console
    > showServers()
    > dumpStats()
    > showBinds()
    > getPool('dns.bfh.info'):getCache():printStats()
  

4.3 BEnet

5.1 Knot Resolver

• Debian tracker

• Homepage

• Documentation

• Reference

• Manpages:

  • kresd(8)

  • kresd.systemd(7)

5.2 dnsdist

• Debian tracker

• Homepage

• Configuration reference

• Manpages:

  • dnsdist(1)

5.3 other

• Manpages:

  • resolv.conf(5)

Legacy

• remove node{1,2}.dns.net.bfh.ch [after Cisco]

• regenerate containers with Debian 12

• upgrade to current knot-resolver/dnsdist

• also forward 172.16.0.0/12 from knot-resolvers to knots

Setup

• moving dnsdist webfrontend behind apache with ldap auth

• restricting backend subnet access to frontend and management only

• dynamic rate limiting

• review hints und redirect configs

• document dnssec validation and how to (temporarily) disable it

• move other disastery-recovery methods currently placed in the config to some document

• KeyTrap Vulnerability

• automatically trigger kresd config updates when pushing to ns repositories

• add priming hints so that local zones are forwarded when there’s no internet connectivity

Features

• hyperlocal root zone deployment

• kresd cache prefill module

• verify if using redis as a central cache for all knot-resolver instances is a good idea

• verify if using kresd http module is any good

• anycasting dns.bfh.info instead of HA loadbalancing

• enable DNScrypt once it has been standardized

• test environment

• benchmarking

• rebinding protection once it has been implemented to allow excluding subnets

Known issues

• upstream: enforce artifically lowered TTL to clients consistently for all queries (#127, #736 for kresd; SetMaxTTLResponseAction for dnsdist)

• upstream: dnsdist does not support forward, only stub-resolving queries send to backends. For answers with CNAMEs, the records are not resolved to A/AAAA records. Therefore sending queries for own zones that have CNAMEs not to the authoritiative servers but to the resolvers.

• downstream: when priming fails due to loss of internet connection, local forwards don’t work either, needs evaluation of super priming vs local root.