Anycast is a standard, table-stakes feature of every authoritative DNS service. It makes sense: inbound queries should always be routed to the best available servers—usually the ones that are geographically closest. Yet, there is one glaring exception: China.
The internet in mainland China is walled off from the rest of the world. Any DNS query that crosses into or out of mainland China must pass through a series of filters and other controls before it can be passed along for resolution. These filters and controls impose a gigantic performance hit—if the query is allowed to resolve at all.
Several authoritative DNS providers deal with this issue by extending their network into mainland China so they can resolve traffic inside mainland China. These additional points of presence (PoPs) are attached to a global anycasted network but primarily serve users in mainland China due to the use of geographic traffic steering.
At first look, this approach seems logical. Since anycast DNS queries in mainland China will be answered by the nearest server, the more PoPs in China you have, the more likely you are to respond from a server that sits inside the system of filters and controls.
This approach isn’t foolproof. Global brands serve up applications, services and content from nearby countries as well. Even with a large number of PoPs in mainland China, the Border Gateway Protocol (BGP) often sends users in mainland China to resolving servers in neighboring countries based on prevailing internet conditions and the number and cost of “hops” needed to find the resolver. When that traffic goes across the system of filters and controls, the performance hit is significant.
In this sense, anycasting an authoritative DNS service in mainland China is a bit of a crapshoot. If you’re not deliberately directing users in China to a domestic server, there’s always going to be a risk of poor performance.
IBM® NS1® offers a distinctive approach to resolving DNS queries in China—one that removes the risk of anycast-induced performance issues by geolocating the query source. We call it Nameserver Acceleration.
NS1’s DNS infrastructure is essentially two separate but related networks: NS1’s anycasted Managed DNS service and our Managed DNS for China offering. Instead of blindly relying upon BGP to find a resolver, we use our own traffic steering technology to figure out which network should respond to a query.
If a request comes from China (as determined by geolocating the source IP), it is answered by one of our DNS servers in China. If not, the request is answered by a server on our global anycasted network.
When a user in mainland China initiates a DNS query, the first “hop” goes to a local resolver. In the second “hop”, the resolver does an IP address lookup.
This second hop is where BGP often routes traffic to a nearby country. NS1 adds a step to the resolution process to ensure that doesn’t happen.
Normally, the nameserver for the top-level domain (TLD) returns both a domain name and an IP address, stored in a “glue record”, to reduce the number of lookups. Nameserver acceleration is configured to remove this glue record.
When the recursive resolver doesn’t get the glue record it needs, it performs a separate lookup to find the missing IP address. When the resolver looks up the IP address of the authoritative nameserver at NS1, we respond with an IP address based on the resolver’s location.
If that resolver is in China, NS1 responds with an IP address of a China-based nameserver. If the resolver is outside of China, the response goes back with an IP address for a server on NS1’s global anycast network.
Now, you may be asking, “doesn’t that extra lookup actually degrade performance?” It is true that inserting an additional step into the query resolution process takes extra time. However, we’ve found that the impact on performance is so negligible that it’s hardly worth mentioning. And in comparison to the drag on performance produced by the system of filters and controls, it’s clearly worth doing.
The numbers clearly bear this out. Here’s some data we pulled on DNS response times in mainland China from IBM NS1 Connect® and its primary competitors. As you can see, our approach yields significant dividends—on average, our service is over three times faster than any other network.
If you’re a global business with a significant user base in mainland China, Nameserver Acceleration makes NS1 the clear choice for DNS services. But it’s not the only reason.
NS1’s Managed DNS for China does all of this through a single control plane. All of the technical magic and fancy traffic steering happens within our platform. From a management perspective, queries from China sit right alongside the rest of your network.
Not all DNS providers can say that. Due to Chinese regulations around serving content, many of them require entirely separate accounts and credentials to specifically manage queries that originate in China. Since NS1 is a pure play DNS provider, we can offer a single control plane without the need for an ICP license.
Learn more about the distinctive benefits of NS1 Managed DNS for China.
5 min read – Enterprises across the world will be investing to upskill talent and prepare their organizations for the arrival of quantum computing.
9 min read – Explore how using AI in commerce has the capacity to create more fundamentally relevant and contextually appropriate buying experiences.
10 min read – Learn about the background and history of the central processing unit (CPU).
3 min read – The exchange of securities between parties is a critical aspect of the financial industry that demands high levels of security and efficiency. Triparty repo dealing systems, central to these exchanges, require seamless and secure communication across different platforms. The Clearing Corporation of India Limited (CCIL) recently recommended (link resides outside ibm.com) IBM® MQ as the messaging software requirement for all its members to manage the triparty repo dealing system. Read on to learn more about the impact of IBM MQ…
2 min read – Generative AI is a transformative technology that many organizations are experimenting with or already using in production to unlock rapid innovation and drive massive productivity gains. However, we have seen that this breakneck pace of adoption has left business leaders wanting more visibility and control around the enterprise usage of GenAI. When I talk with clients about their organization’s use of GenAI, I ask them these questions: Do you have visibility into which third-party AI services are being used across…
4 min read – We live in a world where businesses must be able to respond to change rapidly, whether it is to meet changing customer expectations or to take advantage of technology shifts that, while disruptive, offer the ability to surpass competitors. This is often at odds with the continual pressures that businesses face around reducing risk and costs across IT operations. To perform well against these diverse challenges, businesses must have an architectural foundation that: is stable and robust to reduce risk…
About The Author
More Stories
Anatomy of a Scam
Climate and Environmental Sustainability Within the IETF and IRTF
From Commitments to Practice: Internet Society’s Priorities for WSIS+20 Implementation