It was always going to be DNS

There is a joke that is not really a joke, which is that whatever has broken, it is DNS. It sits underneath everything, which makes it the first suspect in everything. The service is old, it is boring, it is somebody else's problem, and when the network stops working it is the first thing anyone checks and disappointingly often the answer. Getting to the bottom of why requires knowing what it replaced, and what it replaced is genuinely funny.

For the first decade or so, the entire network's list of names lived in a single text file. One file. Every machine that wanted to reach another machine by name held a copy, and the copy was maintained by hand at one institute in California. When it changed, which it did constantly, you got the new version by fetching it. Everybody, individually, on their own schedule, forever.

This worked for the same reason a village noticeboard works, and stopped working for the same reason. The file grew. The fetching got heavier. Two people wanted the same name. And nobody could add a machine without going through the one office that owned the list, which is a bottleneck with a phone number.

In November 1983 Paul Mockapetris published two documents describing the replacement, and the design decision in them is the one everything since has rested on. Do not centralise the list. Centralise only the question of who is allowed to answer.

That is the elegant bit and it is also, precisely, the problem. A design where the answer is assembled from several parties, each of whom is allowed to cache what they were told for as long as they were told to, has no single place to look when the answer is wrong. There is no map to check. There is only a chain of people repeating what they last heard.

Which produces the failure mode everybody recognises. It works for you and not for them. It worked an hour ago. It works when you bypass the thing in the middle. Nothing is broken, exactly. Something is merely still saying what used to be true, with complete confidence, until a timer runs out.

So the joke is unfair in an interesting way. DNS is not fragile. It is the oldest thing on the network still doing its original job at roughly five hundred million times the scale it was designed for, which is not the record of a bad system. It gets blamed because it is the layer that turns something readable into something routable, so it sits underneath everything, and anything underneath everything is underneath every failure too.

It also gets blamed because the alternative explanations are worse. If it is DNS, it is a record and a timer and twenty minutes. If it is not DNS, somebody is going to have to read a packet capture until it confesses.

There is one more thing, and it is the detail that makes people who love this stuff love this stuff. Every name you have ever typed ends in a full stop you did not type. The root of the tree is an empty label, written as a trailing dot, and it is there in the specification, and your browser quietly adds it for you. The whole naming system for the entire internet terminates in a character nobody sees.