Re: [Resolverless-dns] Load-balancing concerns

[Justin Henck <[e-mail]>]

>
>
> I'm afraid I don't understand the connection you're making.  What does
> the setup, "would have to push an entire RRSET", have to do with the
> rest of "If we combine that..."?  I'm not clear on how DNSSEC makes
> any difference at all in this particular problem.
>
> My guess is that you are imagining a situation where all possible
> addresses that clients could receive are put into one A or AAAA
> RRset.  This isn't the way most such systems work though.
>

You'll have to forgive my ignorance - I definitely don't pretend to be an
expert in any of these areas.  My understanding (please correct me!) was
that generally an authoritative will return a single A or AAAA record based
on a particular query, but with DNSSEC it will return an entire relevant
RRSET.  So although there might be multiple such RRSETs you will at least
have (perhaps) more than one IP.

I was imagining a worst-case scenario (heavily simplified):
-----Definitions-----
Primary Server  - In country "A"
Referred Service - Global. Has different sets of servers for different
locations/networks
Many Users - In country "B"

------Scenario:------
1. Many Users load page from Primary Server in a short time.
2. Primary Server queries for a record for Referred Service.
3. Primary Server caches a single IP in country "A" for Referred Service
4. Many Users hit single IP for Referred Service which experiences Bad
Things

The partial alleviation I was hypothesizing about was:
------Scenario:-------
1. Many Users load page from Primary Server in a short time.
2. Primary Server queries for a complete RRSET for Referred Service
3. Primary Server caches country "A" RRSET for Referred Service
4. Many Users' clients pick different IPs for Referred Service and connect
to them
5. Many Users' clients receive AltSvc records telling them to use an IP in
country "B" for their next connection

Pure point of ignorance: To your point about different clients getting
different IPs - does that extend beyond the resolver+ECS level? E.g. if
10,000 customers using a mobile carrier in a single city hit their ECS-less
resolver for a particular domain, will they get different IPs?

Justin Henck
Product Manager
212-565-9811
google.com/jigsaw

PGP: EA8E 8C27 2D75 974D B357 482B 1039 9F2D 869A 117B