[as112-ops] DNS Blackhole servers requests question

[Grant Taylor]

On 04/18/2018 10:31 AM, Roberto Carna wrote:
> Dear, I want to use and test the DNS BLACKHOLE servers for RFC 1918 
> network addresses:
> 
> BLACKHOLE-1.IANA.ORG (192.175.48.6)
> BLACKHOLE-2.IANA.ORG (192.175.48.42)
> 
> But every time I query these servers, I can’t reach them.

I'm somewhat surprised that you can't reach them.

> Are they running? Or maybe they don’t work for every people from 
> Internet?

It's my understanding that the two blackhole servers are anycasted and 
should be running all over the place.  However that does not mean that 
you can actually get to or are allowed to communicate with them.

> In all my attempts to query these blackhole servers, just one time I 
> get a NXDOMAIN valid response.

That sounds like you had one query go to a different anycast DNS server 
that did not have the domain names configured.  Or it at least responded 
incorrectly.

> Always I can’t reach them:
> 
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.6
> ;; connection timed out; no servers could be reached
> 
> root at MITLPDNS01:~# host -t NS 10.IN-ADDR.ARPA 192.175.48.42
> ;; connection timed out; no servers could be reached
> 
> Please can you help me?

I'll share my understanding of how the AS 112 DNS servers are supposed 
to operate.  Hopefully that will help you.

> I know I can create local DNS zones for RFC 1918 networks in my BIND 
> server,

I think you will end up doing that (in a manner of speaking) if you 
configure your DNS server to function as an AS 112 DNS server.

> but I want to understand the use of DNS Blackhole servers.

Fair enough.

My understanding is that the blackhole DNS servers are meant to be run 
on widely anycasted IPs.  Further, the parent domain (192.in-addr.arpa.) 
delegates the zone to the blachole DNS servers.

The idea being that if multiple people run local instances of the 
blachole DNS servers, the traffic to said DNS servers will functionally 
be spread across the internet to the blackhole DNS server that is 
closest to the clients issuing queries to the delegated domains.

When I run the following command at home, the query ends up being 
hitting my persronal / private DNS server that is functioning as an AS 
112 blackhole DNS server.

dig +trace -x 192.168.1.1

1)  The above command causes dig to query the root DNS servers
2)  which delegates to servers authoritative for the in-addr.arpa. zone,
3)  which delegates to servers authoritative for the 192.in-addr.arpa. zone,
4)  which delegates to servers authoritative for the 
168.192.in-addr.arpa. zone.

Seeing as how my personal / private DNS server is functioning as an AS 
112 blachole DNS server, it has the IP addresses for blachole-1.iana.org 
and blachole-2.iana.org bound and is answering queries.

So, when the DNS servers authoritative for 192.in-adr.arpa. delegate to 
blachole-1.iana.org or blachole-2.iana.org, queriese for the 
168.192.in-addr.arpa. zone end up going to my local DNS server at the 
well known / established anycast IP addresses of 192.175.48.6 and 
192.175.48.42 (respectively).

Thus, queries for IP addresses in AS 112 zones (read: RFC 1918 address 
ranges) hit my local DNS server and do not transit the internet.

Ultimately my AS 112 DNS server is helping reduce the load on the 
internet by answering the queries locally.

> Thanks in advance, regards!!!

I hope that helps.  Feel free to ask follow up questions, or correct me 
if I'm wrong about something.

Aside:  It's also possible to slave the root DNS zone, there by helping 
reduce some additional load -and- (I believe) speed up some queries 
because the data is local.



-- 
Grant. . . .
unix || die

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3982 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20180418/5df63d37/attachment.bin>