Akamai's Fast DNS service provides cloud-based, authoritative domain services to thousands of organizations. Fast DNS is the most widely deployed cloud DNS service pushed to the edge of the Internet. Every organization must protect their domain name. Akamai's built Fast DNS to focus on domain name availability, security, resiliency, and performance. The domain name must be 100% available at all times. These domain names must be secured with DNSSEC to minimize spoofing. DoS attacks cannot be allowed to knock down the domain names. Clients who are trying to get to the domain must be able to get that information as fast as possible. DNSSEC, DoS resiliency, and global performance are all provided by Akamai's Fast DNS Service.
Using Fast DNS as a secondary DNS service is one of the quickest ways for organization ease into the benefits of a globally robust cloud DNS solution. Secondary DNS servers are a layer before the DNS Primary. The DNS Primary servers control the domain's zone records. These can be configured to push the zone information out to secondary DNS servers. The whole architecture can be configured where the Internet only communicates with the DNS secondary servers. This protects the critical Primary DNS server and zone information from attack.
Akamai's Fast DNS streamlines the Secondary DNS's benefits. Organizations can plug into Akamai's global DNS deployment and push their DNS Secondary to a global edge deployed throughout the world. The Secondary DNS's benefits are then enhanced, with DNS servers closer to the edge, spread throughout the world, and resiliently deployed. Closer to the edge means better application response. Global deployment means it is more resilient to DoS attacks. Resiliently deployed means that Akamai shifts the organization's domain to work around Internet faults.
One conundrum domain owners face is how to properly update their DNS records when they are ready to leverage Fast DNS as a secondary service. There are two steps that need to be executed:
There are a number of valid implementation strategies involving these two steps, but a few core principles should be incorporated into the go-live deployment plan:
A. While the IETF DNS spec does not provide clarity on the order of operations, it is recommended to list all authoritative name servers in your zone file at all times*. Consequently:
B. While not recommended long term, the two recordsets can be different
C. The domain owner can add as many or as few of the Akamai nameservers as they see fit for each record update
With these key principles in mind, the implementation steps will follow this high-level order of operations:
1.) Update zone file, add one, several, or all Akamai Fast DNS name servers (retain current name servers; i.e. additive change)
2a.) Update Registrar to add the same Akamai name servers referenced in Step 1
2b.) Remove legacy nameservers from Registrar's NS records (if necessary***)
3.) Remove legacy nameservers from zone file (if necessary***)
Steps 1-2b will be repeated until the steady state is achieved with the Registrar.***
There are a number of different iterations, but the overall execution will follow this basic template. In addition, it is always best practice to reduce the TTLs for the zone file's authoritative NS records during the implementation in case a rollback is needed.
*Recursive resolvers exhibit inconsistent behavior when there is a mismatch between the record sets between parent (Registrar) and zone. As a result, we want to avoid a situation where a resolver does not accept a response from a nameserver because it is not listed as authoritative in the zone file
**This is due to recursive resolvers caching practices: resolvers will cache NS records listed in a zone even if the resolver is only querying for an A record. Thus, future A record queries may be sent to a Fast DNS server.
***Domain owners may want to use another authoritative DNS provider alongside Akamai
If you find this blog useful, continue your exploration with these references. Everything Akamai deploys depends on our Intelligent Edge DNS platform. Akamai expands our platform to enable a range of services for domain owners:
Use this form to ask for Akamai help. We can have someone contact you to help with your DNS questions.****