It was always going to be DNS

There is a joke that is not really a joke: whatever has broken, it is always DNS. DNS sits underneath almost everything online, so when a site or service stops working, it is one of the first suspects. It is old, boring and usually managed by somebody else. It is also disappointingly often the answer. To understand why DNS failures are so common and so strange, start with the system it replaced.

For the first decade or so, the entire internet's list of names lived in a single text file. One file. Every machine that wanted to reach another machine by name held a copy, and the copy was maintained by hand at one institute in California. When it changed, which it did constantly, you got the new version by fetching it. Everybody fetched it individually, on their own schedule. Forever.

This worked for the same reason a village noticeboard works, and stopped working for the same reason. The file grew. The fetching got heavier. Two people wanted the same name. And nobody could add a machine without going through the one office that owned the list, which is a bottleneck with a phone number.

In November 1983 Paul Mockapetris, the computer scientist who designed DNS, published two documents describing the replacement. The whole system still rests on one decision in those documents: do not centralise the list. Centralise only the question of who is allowed to answer.

That is the elegant bit and it is also, precisely, the problem. A design where the answer is assembled from several parties, each of whom is allowed to cache what they were told for as long as they were told to, has no single place to look when the answer is wrong. There is no map to check. There is only a chain of people repeating what they last heard.

Which produces the failure mode everybody recognises. It works for you and not for them. It worked an hour ago. It works when you bypass the thing in the middle. Nothing is broken, exactly. Something is merely still saying what used to be true, with complete confidence, until a timer runs out.

The joke gives DNS too little credit. DNS has kept doing the same job since 1983 while the network around it grew to roughly five hundred million times its original scale. A fragile system does not manage that. DNS turns readable names into addresses computers can route. Because that lookup sits underneath so much of the internet, it is involved in many failures even when it did not cause them.

DNS also gets blamed because the other possible causes are harder to find. A DNS problem can be one wrong record and a wait for its timer to expire. When DNS is not the cause, somebody may have to inspect a packet capture until the network confesses.

The dot at the top of the diagram is not decoration. The complete DNS form of “example.com” is “example.com.” The second full stop is part of the name. DNS reads the name from right to left. The last dot leads to the unnamed root of the whole system, then comes “com”, then “example”. Your browser adds the root quietly, so you almost never type or see it. The entire naming system ends in a character that is usually hidden.