DNS in the cloud

September 2011

Jennifer Pigg, Vice President, [email protected]

DNS in the Cloud: Critical, Different and Difficult

DNS Is Essential for the Cloud

In two years, 39 percent of enterprises plan to shift at least one-third of their IT budget to cloud services, according to Yankee Group’s 2011 US FastView: Cloud Computing Survey. This is an enormous shift in resources. It means enterprises will be moving beyond the low-hanging fruit of applications such as sales automation and will transition complex and sensitive applications to the cloud.

However, to turn this intent into reality, a long list of barriers to cloud adoption must be overcome (see Exhibit 1). Out of our list of 11 barriers, eight will be affected by the DNS infrastructure of the cloud service (i.e., all but existing IT investments, contract lock-in and vendor financial health).

Exhibit 1: DNS Impacts Eight of 11 Barriers to Cloud Adoption Source: Yankee Group’s 2011 US FastView: Cloud Computing Survey, June 2011

TABlE of CoNTENTS

DNS Is Essential for the Cloud 1

The Cloud Is Different 2

It Will Get Worse 4

Conclusions and Recommendations 6

This custom publication has been sponsored by CloudFloor.

http://www.yankeegroup.com/ResearchDocument.do?id=56488

http://www.yankeegroup.com/ResearchDocument.do?id=56488

DNS in the Cloud: Critical, Different and Difficult September 2011

© Copyright 1997-2011, Yankee Group Research, Inc. All rights reserved. Page 2

Robust DNS services are critical as large online retailers, media companies, gamers and entertainment providers, and service organizations move to cloud computing and resource virtualization. Cloud DNS infrastructure must be:

Accurate:• IP addresses and routing information must be continuously updated. Cloud computing relies on an up-to-date, strong DNS system to locate resources at the specific moment they are requested.

Flexible:• It should be able to bring resources both up and down, and redirect traffic.

Fast:• DNS queries must be resolved immediately with a latency overhead that approaches zero.

Secure: • The DNS infrastructure must be secured against attack and must help buffer the resources under its control from attack.

Fault-tolerant:• It must be geographically distributed in highly recoverable, secure data centers.

However, these attributes could apply to any DNS infrastructure. What makes DNS in the cloud a special case?

The Cloud Is Different

There are three key characteristics to DNS in the cloud that differentiate it from fixed-resource private applications:

Cloud resources move.• In the cloud, end-user applications have no way of knowing where in the network a unit of work, or “instance” of compute or storage capacity, resides at any given time so they cannot point to the specific IP address. This is overcome, in theory, by DNS addressing the domain name which, in turn, points to the current, correct IP address or set of addresses. A cloud computing application is only as good as its DNS information.

Clouds are proprietary.• Each cloud service has its own “secret sauce,” or unique constructs for automatic scaling, load balancing, etc. These almost always involve addressing since locating, moving and balancing resources is what clouds do.

Clouds and enterprises must interoperate.• Less than 10 percent of cloud applications communicate only with the end-user or consumer; the remaining 90 percent also must communicate with the enterprise. Businesses that use the cloud for backup, recovery, storage, additional compute power or as the link between corporate resources and databases and the end-user must be able to seamlessly address resources on either the enterprise network or in the cloud.

How do these attributes affect the DNS infrastructure? We can break them down further to illustrate. To provide enterprises with the greatest benefit, cloud providers offer the following features, all of which can impact and be impacted by DNS:

Extending internal resources with a public cloud: • The debate over public versus private clouds is dead. Enterprises see value in both and tell us they want to use both (see Exhibit 2).

DNS impact:• To allow enterprises to leverage both internal and cloud-based resources, the application may be called on to use both A records (IPv4 addresses)—for enterprise infrastructure that may reside behind a traditional load balancer—and a cloud address proxy. For example, Amazon Web Services’ (AWS’) EC2 Elastic Load Balancing service assigns a CNAME, which in turn points to a group of instances over which incoming traffic is balanced. Problems arise, however, when you attempt to use both CNAMEs and A records within the same host name. The private cloud would expect an A record to be served up, whereas the public cloud would require a CNAME. The DNS spec forbids serving up CNAMEs and A records for the same host name.

Exhibit 2: Hybrid Clouds Are the Norm, Not the Exception Source: Yankee Group’s 2011 US FastView: Cloud Computing Survey, June 2011



Automatic scaling:• Cloud applications must be able to add instances of memory or CPU capacity or take them down according to performance parameters defined by the enterprise.

DNS impact: • Assuming these instances are identified though DNS (and not through a proxy as described above), the enterprise must be sure that, as cloud instances are added, they are mapped to the correct host name or Fully Qualified Domain Name (FQDN). The DNS changes will be reflected on the cloud authoritative name server and will eventually be updated and cached on the enterprise’s authoritative name server. However, depending on how DNS is configured and managed at both the enterprise and the cloud service, this could take less than a second or it could take an hour. In the meantime, DNS does not know that the instance has been terminated and may continue to send traffic. Again, the enterprise can write code that disassociates the IP address from the domain every time an instance shuts down, but this leads to more complexity, updates that are not timely and errors.

Static IP addresses:• This feature allows the enterprise, in the case of an instance failure or an unreachable cloud location, to programmatically remap its public IP addresses to a replacement instance. It also allows the enterprise to configure the reverse DNS record (i.e., mapping the IP address to a domain name, rather than vice versa).

DNS impact: • This is a fine feature if you are a small office/home office (SOHO) with a limited number of instances and a restricted geography. However, for a large enterprise with thousands of instances and hundreds of locations, this falls into the stone knives and wooden spears school of automation.

Load balancing:• This feature automatically and dynamically distributes application traffic across multiple instances.

DNS impact:• We discuss some of the impact cloud load balancing can have on the enterprise above; however, the ability to load balance traffic across multiple hosts is always in conflict with DNS’ desire to associate one host name with a single IP address. Load balancing, which is central to the way the cloud operates, offers the most challenge in terms of efficient DNS operation that supports, rather than conflicts with, the cloud. Numerous examples exist that illustrate the problems developers have with designing applications that meet both the requirements of the cloud and DNS specs. Some problems manifest as poorly written code. For example, a popular open source Web application accelerator at startup resolves an EC2 ELB CNAME to an IP address and caches it. When ELB is invoked

and load balances incoming traffic, the IP address the CNAME resolves to changes. As a result, the app accelerator ends up being directed to random EC2 instances in the cloud. The fix? A hard restart. Other applications resolve the fact the DNS RFC 1033 requires the root domain to be an A record, not a CNAME, by just violating the RFC. Enterprises should look for DNS cloud solutions that provide robust, high-availability connectivity in a manner that complies with accepted standards.

Multiple locations: • Cloud applications are distributed across multiple locations to improve response time and resiliency in the case of failure.

DNS impact:• The application does not automatically know where it’s distributed and where the closest name server is. The world is full of examples where an enterprise is unwittingly resolving all DNS queries on a name server thousands of miles away and is then baffled by the response time. This can add precious seconds or tens of seconds to query latency, which in turn can dramatically impact the enterprise’s bottom line. Amazon has found that every 100 msec of latency costs it 1 percent in sales. Google reports that an extra half second in search page generation time drops traffic by 20 percent.

Persistent storage:• This provides up-to-date snapshots of the enterprise’s data that are then stored in the cloud and automatically replicated across multiple availability zones. These snapshots can be used as the starting point for new volumes, and can protect enterprise data for long-term durability.

DNS impact:• The ability of an enterprise to recover from an outage or failure is only as good as its ability to locate and identify the recovery data. If DNS data is lost (see next feature), the recovery cannot happen.

DNS hosting:• Enterprises can house their DNS data as part of their software- and infrastructure-as-a-service (SaaS/IaaS) contracts.

DNS impact:• This leads to trouble when the service provider network or site, which also houses the enterprise DNS data, goes down, taking with it all access to DNS as well. Ideally, DNS servers or services should not be collocated with user application or data. When the DNS service is managed separately from other applications, users can be redirected to a redundant site when a network or data center goes down. Even if there is no redundant data center, the redirect can take customers to a site that informs them of the outage and provides an estimate of when service will be restored. The same scenario can occur when an enterprise outsources its Web hosting, e-mail or disaster recovery services.



It Will Get Worse

Users are funneling an increasing percentage of their IT budget into the cloud, and the cloud market has moved beyond the initial stage when only SOHOs relied on it and only non-mission-critical applications where deployed on it. Today, large enterprises (those with 500 or more employees) account for the biggest piece of the revenue pie and, by 2015, they will account for half of all cloud revenue (see Exhibit 3). In addition, even those enterprises that claim they will never trust the cloud with their revenue-generating applications can be unwitting cloud users, invoking cloud services in, for example, the order fulfillment process. The issue of DNS in the cloud is a pain that is going to emerge and descend on everyone.

Exhibit 3: Cloud Revenue from large Enterprises Dominates and Is IncreasingSource: Yankee Group’s TopicView Cloud Computing, July 2011

In addition, upcoming major changes to the network will impact DNS overall, including DNS in the cloud. These include:

DNSsec. • To improve the security of DNS, many government agencies and enterprises have already started to implement DNSsec, and the momentum is increasing. With its exchange of zone-signing and key-signing key pairs, DNSsec can take 14 operations and seven times the query traffic to validate a session. This adds latency as well as complexity to all sessions. DNSsec is also naturally hostile to load balancing because load balancing does not allow a specific name to be associated with a specific IP address and signature. DNSsec really hates load balancing in the cloud because not only are there multiple hosts reachable with the same name, but those hosts change frequently. Correct implementation of DNSsec in the cloud is a substantial challenge—it is not a do-it-yourself (DIY) project for the large enterprise. It is tedious and unforgiving.



IPv6. • Somewhere in the long history of IPv6, the rumor started circulating that IPv6 would help security. In fact, the opposite is true, at least in the early implementations of the new addressing scheme. Many DNS service providers rely on the use of continuously updated “blacklists,” lists of know malware, phishing, illegal or botnet sites, to protect their users. With IPv6, hackers have a virtually unlimited number of IP addresses to choose from (2128 addresses, or about 340 followed by 36 zeros). DNS service providers will not be able to use the same mechanisms to protect the enterprise from malicious sites because blacklists could swell to be so large they could easily overwhelm the cache memory and severely impact query response time, even without an attack. Also, IPv6 is not backward-compatible with IPv4, hence the use of dual stacks, tunneling and network translation. An IPv6 preparedness test of security devices recently conducted by one DNS service provider revealed—much to its dismay, if not surprise—that no security device tested (including firewalls, load-balancers and routers) had functional parity with their IPv4 versions. As cloud applications start to communicate with IPv6 endpoints, the DNS infrastructure must be in place with name server support for IPv6 and new strategies and solutions to protect the enterprise and end-user from security threats.

We summarize these challenges in Exhibit 4.

Exhibit 4: Cloud features Result in Complications for DNSSource: Yankee Group, 2011

About the Author

CorporateOne Liberty Square7th FloorBoston, Massachusetts617-598-7200 phone617-598-7400 fax

European30 Artillery LaneLondon E17LSUnited Kingdom44-20-7426-1050 phone44-20-7426-1051 fax

HEADQUARTERS

© Copyright 2011. Yankee Group Research, Inc. Yankee Group published this content for the sole use of Yankee Group subscribers. It may not be duplicated, reproduced or retransmitted in whole or in part without the express permission of Yankee Group, One Liberty Square, 7th Floor, Boston, MA 02109. All rights reserved. All opinions and estimates herein constitute our judgment as of this date and are subject to change without notice.

Jennifer Pigg is a vice president in Yankee Group’s Network Research group. Her area of expertise is network carrier infrastructure, examining the challenges facing service providers in provisioning the edge and core network, and the solutions and technology that will meet the demands of mobile data networking, cloud computing, Web 2.0 and LTE including mobile backhaul, carrier Ethernet, core and edge routers, packet optical transport and the Evolved Packet Core.

Jennifer Pigg Vice President

Conclusions and Recommendations

What was good for the SOHO cloud user will not work for the large enterprise. Enterprises can’t be expected to hard-code the way the cloud works with DNS into applications. To do so is too complex and costly in terms of flexibility, time and operational expense. There must be a better way. Enterprises need to look for the following from their DNS platform or managed DNS service provider:

Immediate proliferation of DNS updates to accommodate cloud scaling.•

The ability to implement load balancing capabilities without breaking the • application or DNS.

A robust, recoverable, geographically diverse DNS infrastructure.•

The ability to address the idiosyncrasies of a wide variety of cloud services and • provide superior DNS performance, regardless of the cloud vendor.

A plan for implementing DNSsec within the next three years that demonstrates a • solution that is automated and will provide improved security without impacting cloud performance.

A plan for implementing IPv6 within the next five years that demonstrates a • solution that will maintain performance, enable seamless communications between IPv4 and IPv6 endpoints, and maintain or improve security.

Enterprises that are planning to move critical applications to the cloud must verify that their DNS architecture is ready to support a cloud application. The issue is that it requires an intimate knowledge not only of DNS, but of the idiosyncrasies affecting DNS, the “DNS fingerprint,” of the selected cloud service. Managed DNS service providers, which can help enterprises improve their DNS security, performance and management, are not cloud experts. They are not aware of nor have they architected solutions around the different nuances of today’s cloud services. Enterprises need a managed DNS service that is cloud-aware.

Technology

DNS in the cloud