Anycast DNS

What is Anycast DNS?

Anycast DNS is a network routing method where multiple DNS servers share the same IP address across different geographic locations. When a user queries a DNS server using anycast, the network automatically routes the request to the nearest or best-performing server, improving response times and providing built-in redundancy and DDoS protection.

How Anycast Works

Traditional Unicast vs Anycast

User Query → Specific Server IP → Fixed Location
London User → 203.0.113.1 → New York Server (high latency)

User Query → Shared IP → Nearest Server
London User  → 203.0.113.1 → London Server (low latency)
Tokyo User   → 203.0.113.1 → Tokyo Server (low latency)
Sydney User  → 203.0.113.1 → Sydney Server (low latency)

Routing Mechanism

1. Multiple Servers, One IP: All anycast servers announce the same IP address

2. BGP Routing: Border Gateway Protocol routes traffic to the "closest" server

3. Network Proximity: Determined by BGP metrics (hops, latency, network policies)

4. Automatic Failover: If one server fails, traffic routes to the next nearest

Benefits of Anycast DNS

1. Reduced Latency

Geographic distribution minimizes DNS query time:

DNS Resolution Time:
Unicast:  150ms (distant server)
Anycast:  10ms  (local server)
Savings:  140ms per query

For a page with 20 DNS lookups:
Total savings: 2,800ms (2.8 seconds!)

2. Built-in Redundancy

Multiple points of presence (PoPs) provide automatic failover:

Normal Operation:
London Server  → Online  → Serving traffic
Paris Server   → Online  → Serving traffic
Frankfurt Server → Online  → Serving traffic

Server Failure:
London Server  → OFFLINE
Paris Server   → Online  → Absorbs London traffic automatically
Frankfurt Server → Online  → Absorbs London traffic automatically

3. DDoS Mitigation

Distributed infrastructure absorbs attacks:

Attack: 100 Gbps DDoS → Single Server → Overwhelmed → Service Down

Attack: 100 Gbps DDoS → Distributed across 20 servers
Each server receives: ~5 Gbps
Result: Attack absorbed, service continues

4. Improved Performance

Anycast reduces DNS query resolution time:

# Query time comparison
dig @8.8.8.8 example.com    # Google's anycast DNS
# Query time: 12 msec

dig @single-server.dns.com example.com  # Unicast DNS
# Query time: 145 msec

Anycast DNS Architecture

Network Structure

[Global Anycast IP: 203.0.113.1]
                              |
        ┌─────────────────────┼──────────────────────┐
        |                     |                      |
   [US West PoP]         [Europe PoP]          [Asia PoP]
   - Los Angeles         - London               - Tokyo
   - San Francisco       - Frankfurt            - Singapore
   - Seattle             - Amsterdam            - Hong Kong

Server Configuration

Each anycast location:

• Identical DNS zones: All servers host the same DNS records
• Shared IP address: Same IP announced via BGP
• Autonomous operation: Each PoP operates independently
• Synchronized updates: Zone changes propagate to all locations

BGP Announcement

Example BGP Configuration:
IP Block: 203.0.113.0/24

London PoP announces:     203.0.113.1 via AS64500
New York PoP announces:   203.0.113.1 via AS64500
Tokyo PoP announces:      203.0.113.1 via AS64500

Internet routers select nearest announcement based on BGP metrics.

Popular Anycast DNS Providers

Public Resolvers

Authoritative DNS Providers

• Free anycast DNS hosting
• Global network (300+ PoPs)
• Automatic DDoS protection

• Anycast network across AWS regions
• 99.99% SLA
• Geo-routing capabilities

• Advanced anycast with filter chains
• Real-time traffic management
• API-first architecture

• Enterprise anycast DNS
• Traffic director for advanced routing
• Global load balancing

Setting Up Anycast DNS

For Authoritative DNS

Select an anycast DNS hosting service:

# Cloudflare example
Name Servers:
ns1.cloudflare.com (anycast)
ns2.cloudflare.com (anycast)

Point your domain to anycast nameservers:

example.com.    NS    ns1.cloudflare.com.
example.com.    NS    ns2.cloudflare.com.

Add your DNS records at the provider:

example.com.    A     203.0.113.50
www             A     203.0.113.50
mail            MX    mail.example.com.

For Recursive DNS

nameserver 1.1.1.1
nameserver 1.0.0.1

Preferred DNS:  1.1.1.1
Alternate DNS:  1.0.0.1

Set DNS servers at router level to apply network-wide.

Anycast vs Other DNS Architectures

Anycast vs Unicast

Anycast vs GeoDNS

Performance Comparison

DNS Query Resolution Time

Test: 1000 DNS queries from various global locations

Unicast DNS (single server in US):
Average:  145ms
Min:      12ms  (US queries)
Max:      340ms (Asia/Australia queries)

Anycast DNS (20 global PoPs):
Average:  18ms
Min:      5ms
Max:      45ms

Performance Improvement: 87% faster average response

Real-World Testing

# Test anycast DNS performance
for location in us-east eu-west asia-pacific; do
  dig @1.1.1.1 example.com | grep "Query time"
done

# Results:
# US East:       Query time: 8 msec
# EU West:       Query time: 11 msec
# Asia Pacific:  Query time: 14 msec

# Compare to unicast:
dig @unicast-server.com example.com | grep "Query time"
# Query time: 167 msec (from Asia)

Anycast Limitations

1. Stateless Protocol Requirement

Anycast works best with stateless protocols like DNS:

• Each query is independent
• No session persistence needed
• Response doesn't depend on previous queries

• TCP connections requiring session state
• Streaming protocols
• Database connections

2. Routing Asymmetry

Traffic may take different paths:

Query:    User → Nearest anycast server → Response
Next Query: User → Different server (if routing changes)

3. BGP Convergence Time

During failures, BGP routing updates take time:

Server Failure → BGP update propagation (30-120 seconds)
During convergence: Some queries may fail
After convergence: Traffic rerouted automatically

Monitoring Anycast DNS

Key Metrics

# Monitor from multiple locations
curl "https://api.monitoring-service.com/dns/check?domain=example.com&locations=all"

• Track uptime at each location
• Alert on regional failures
• Monitor query success rates

PoP Statistics:
US East:     35% of queries
EU West:     28% of queries
Asia:        22% of queries
Other:       15% of queries

Health Checks

# Verify anycast is working
dig +short @anycast-server.com example.com

# Test from multiple locations
for server in probe1 probe2 probe3; do
  ssh $server "dig @anycast-ip example.com +short"
done

# Should see responses from geographically appropriate servers

Best Practices

1. Use Anycast for Authoritative DNS

Switch to anycast DNS hosting for:

• Improved global performance
• Better DDoS protection
• Higher availability

2. Combine with GeoDNS

Layer anycast (infrastructure) with GeoDNS (application):

Anycast → Fast routing to nearest DNS server
GeoDNS  → Return geographically appropriate IP addresses

3. Monitor All PoPs

Set up monitoring for each anycast location:

• DNS query success rate
• Response times
• Availability percentage

4. Plan for BGP Convergence

During incidents, expect 30-120 second routing updates:

• Communicate expected behavior
• Set appropriate monitoring thresholds
• Don't over-alert on transient routing changes

5. Test Failover Scenarios

Regularly test how your anycast network handles failures:

# Simulate PoP failure
# Verify traffic reroutes automatically
# Measure convergence time
# Check user impact

Anycast DNS is essential for modern, high-performance internet infrastructure, providing fast DNS resolution, automatic redundancy, and built-in DDoS protection for websites and applications serving global audiences.