This document discusses how F5 Networks' Dynamic DNS Services provide scalability, security, and availability for DNS infrastructure. The services improve web performance, protect sites from attacks, and direct traffic based on location. F5's solutions include BIG-IP Global Traffic Manager for robust, flexible, and secure DNS delivery globally. DNSSEC validation is supported for complete security while mitigating denial of service attacks and scaling to handle large traffic loads.

1. Dynamic DNS Services with Added
Scalability and Security

2. 2
Dynamic and Intelligent DNS
DNS is the Foundation of the Internet
• Improve web performance and browsing - Fast
• Protect your site and reputation - Secure
• Direct customers to right data center and clouds - Available
• Reduce data center costs - Flexible
© F5 Networks, Inc.

3. 3
Complete DNS Delivery and Protection
BIG-IP Global Traffic Manager
DNSSEC
BIG-IP
GTM
© F5 Networks, Inc.

4. 4
The F5 Value of Complete DNS / Web Solution
Scalable 10x; 70% Denial of Service Mitigation
Support client requests
Complete DNS control
and consolidates IT
Access Denied:
IPv6 to IPv4
Route based on location and distribute load Secure DNS Query Responses
http://f5.com
© F5 Networks, Inc.
Simple and Robust Cloud DNS and App Management

5. 5
Larger, More Complex Web = More DNS/HTTP
• Fundamental change in the way apps. are used
• Every image, add button, widget, link, etc. has a potential IP address lookup
• Last 5 years, volume of DNS queries 2x+ (.com/.net) to 57B daily queries*
© F5 Networks, Inc.
*https://investor.verisign.com/releaseDetail.cfm?ReleaseID=591560 Visual by https://www.dnssec-tools.org/

6. 6
Dynamic Site Response and App. Delivery
Data Center
DNS response time:
Without DNS Caching/Resolving
300ms = Mobile
100ms = PCs
With DNS Caching/Resolving
15ms
Cloud
15ms Private Public
400ms = blink of an eye
•
─
•
─ © F5 Networks, Inc.

7. 7
Slow Response on DNSSEC validation
• Validating secure site responses require lots of steps
that slows response times
• For example:
15 steps!! http://isc.org
A record for RRSIG record covering (ZSK) DNSKEY
is signed by is verified by is signed by
www.isc.org www.isc.org/A record for isc.org
RRSIG record covering (KSK) DNSKEY record is verified by DS record
is verified by is signed by
isc.org/DNSKEY for isc.org for isc.org
RRSIG record (ZSK) DNSKEY RRSIG record covering is verified by
is verified by is signed by
covering isc.org/DS record for org org/DNSKEY
(KSK) DNSKEY DS record RRSIG record
record for org is verified by for org is signed by covering org/DS is verified by
(ZSK) DNSKEY RRSIG record covering (KSK) DNSKEY
record for . is signed by ./DNSKEY is verified by record for .
© F5 Networks, Inc.
Example provided by infoblox.com

8. 8
Complete DNS Security
•
•
• http://f5.com
Data Center
“A high-performance DNSSEC validation solution is going to be extremely important as
more and more sites deploy DNSSEC.” Cricket Liu, VP of Architecture at Infoblox
© F5 Networks, Inc.

9. 9
Dynamic DNS Infrastructure for Rapid Growth
with BIG-IP Global Traffic Manager (GTM)
• Robust, Flexible and Secure DNS Infrastructure
• Easily mitigate DNS DDoS Attacks
• Support hybrid IP Environments
• Complete DNS Security
• Scale and manage DNS and Apps globally
© F5 Networks, Inc.

10. © 2012 F5 Networks, Inc. All rights reserved. F5, F5 Networks, the F5 logo, BIG-IP, ARX, FirePass, iControl, iRules, TMOS,
and VIPRION are registered trademarks of F5 Networks, Inc. in the U.S. and in certain other countries