Posts by Duncan Hart

Is DNS important for reliable email delivery?

(This is an occasional rant about how to make things on the Internet just simply work without problem or hinderance).

You bet it is!!!

Your email delivery is dependent upon the wide and reliable visibility of your MX record. In order to assure this, your zone file should be published on at least two DNS servers, or nameservers, and preferably more — four is ideal. This is so that at least one of them is reachable and working correctly, from the standpoint of someone trying to send you email.

If all of your nameservers are unreachable from a given point on the Internet (your correspondent’s originating mailhost), at a given time (when they hit “send”), your domain will appear not to exist, and mail will likely bounce immediately with:

HOST UNKNOWN

This is what we most want to avoid. If your nameservers are up, even if your mailhost is temporarily offline, mail will queue at the origin, rather than bounce, and this is much to be preferred. It gives you a while to fix your mailhost before the senders notice anything is wrong.

Your nameservers should be separated widely, in several ways, to avoid so-called common-mode failures that would otherwise affect them all. They should be:

On multiple hosts - Not on a single host that may be down.

This shouldn’t need much explanation. Computers do not run without incident for long times. Even with no errors and no equipment failures, they need maintenance and upgrades from time to time. DNS requires that every domain have at least two nameservers. Host redundancy is built into the protocol.

Separated in space - Not in the same city, let alone the same building, or the same rack.

To protect against local physical accidents: fire, flood, tripping over the power strip, meteor strike, et cetera.

On separate IP networks - Not on the same IP network or physical (Ethernet) segment.

To protect against common-mode network failures, such as routes being dropped, or border router or LAN switch equipment failures. This is the most commonly violated principle.

In separate Autonymous Systems - Not on networks sharing major routes from the Internet.

Here we get into the core of routing in the Internet. An AS is a group of IP networks run by a single organization, such as an ISP. Where ISPs’ networks connect to one another, they exchange routing information about their networks, but they summarize the exact path that a packet will take. They just advertise the so-called AS Path. It will get your packets to the right ISP, and then a more-detailed system takes over and routes the packet to the exact router and host.

If you have four nameservers, in four cities, on widely different IP networks, but all these networks terminate in the same AS (for example, data centers all run by one ISP), then there is still an important, but subtle, common failure mode. That ISP (that AS) can have a widespread failure that makes all of their networks unreachable. If at least one of your nameservers is in another AS entirely, you are protected against even this.

Should they be on separate nations/continents/tectonic plates?

All the world is not the USA. Though of course there is a point of diminishing returns.

Constant promiscuity

“Our wealth sits upon a very large device that copies promiscuously and constantly. Yet the previous round of wealth in this economy was built on selling precious copies, so the free flow of free copies tends to undermine the established order.”  The new reality. I wonder how many organisations openly acknowledge this? And how many have their head in the sand?

The security sky is falling (but what should I do?)

I’m increasingly becoming irked by lots of security folks who are screaming ‘the security sky is falling.’ Stopping there, with simply the frightening aspect of worrying, is like screaming “Danger!” without knowing what to do or where to run. All that happens is that the screaming causes disturbance but has not told anyone what they can do to avoid the danger.

The fallacy of control in all broadcast era organisations

If you think you have control then think again

Mike Bracken

Really pleased to see that Mike Bracken has been appointed Executive Director of Digital Efficiency and Reform Group. Great news. Good luck Mike.

IT Fascism

A friend mentioned that security might well be the last bastion of IT fascism. He could well be right. But surely it doesn’t have to be that way?

Steal time, everyday

Another gem from Hugh Macleod and his Evil Plans:

Napoleon once said, “I can always regain lost territory. A single second, never.”

Extinction Management

From Hugh Macleod’s Evil Plans….

“Either get with the programme or hire a consultant in Extinction Management.”

Reading or ignorance

I really do believe this quote:

“No matter how busy you may think you are, you must find time for reading, or surrender yourself to self-chosen ignorance”, Confucius.