05 Mar

Different CDN technologies: DNS Vs Anycast Routing

And I am back from Malaysia after attending APRICOT 2014. It was a slightly slow event this time as less people came up due to change of location from Thailand to Malaysia. But I kind of enjoy the APRICOT in start of year. ūüôā

It has been quite sometime when I blogged. After getting into Spectranet I got relatively more busy along with bit of travelling to Delhi NCR which has been taking lot of time. I wish to blog more over time. 

In recent time I got chance to understand in detail the working of CDN from the point of view of delivery and this brings me to this post where I will be working on putting in detail how the popular CDN networks work and where they are dependent on DNS recursors and where on anycast routing. 


Understanding CDN

CDN’s as we know are Content Delivery Networks and these are specialized networks which are designed for the content delivery to the edge networks by serving content from as close location as possible. The location of servers and type of connectivity heavily depends on each CDN provider and their business model. E.g Google maintains it’s own delivery network consisting of large number of GGC (Google Global Cache) nodes placed on ISPs network and help in serving Google’s static content while other large networks like Akamai (whose core business is into Cache delivery) put their servers on large number of edge networks but they stay as disconnected small islands. While the new comers in the industry like Limelight, ¬†Cloudflare’s model of deployment is around putting node in major datacenter and direct connection to major networks via peering from IXPs.¬†


The key features of almost all these CDNs are:
  1. Low latency delivery of content giving very fast throughputs.
  2. Making networks more efficient by caching near to the point of serving and not consuming long haul International bandwidth.
  3. Ensuring that content is delivered with optimum performance with as low as possible dependency on middle networks/backbone. 
  4. Ensures that there is no single point distribution and hence during high load, traffic serving can be optimized. 


Technical side of “edge cache serving”

In order to make the “edge delivery” concept work, CDN providers have multiple options and it is slightly tricker here. Challenge here is to ensure that all users go to their nearest CDN node and get served from there rather then a node far away from them.¬†


Here we have ISP A with a Cache A deployed very near to it, ISP B with Cache B deployed just next to it and so does ISP C with Cache C right next to it. Assuming that end users visit a website which has services from the CDN provider. Here end user will get a url like “http://cdn.website.com/images/image1.jpg” and here cdn.website.com is supposed to be going to “nearest node”. Thus we expect that when users try to reach cdn.website.com on ISP A, it should hit Cache A, from ISP to Cache B and so on (under normal circumstances).¬†


Two fundamental ways to achieve that:

  1. Have DNS to do the magic i.e when users from network ISP A lookup for cdn.website.com, they should get a unicast IP address of Cache A in return, similarly for users coming from ISP B network, Cache B’s unicast IP should return.¬†
  2. Have routing to route to nearest cache node based on “anycast routing” concept. Here Cache A, Cache B and Cache C will use same identical IP address and routing will take care of reaching the closest one.¬†


Both of these approaches have their own advantages as well as challenges. Some of very large CDN providers like that of Akamai, Amazon Cloudfront rely on DNS. While some of new entrants like Cloudflare rely very much on anycast routing. I have discussed DNS and it’s importance in CDN and node selection in some previous posts, but will be going through this quickly in this one.¬†


Making use of DNS for CDN

DNS is pretty basic protocol. It’s role is simply into “hostname to IP resolution” (and vice versa). What makes is powerful is that based on certain logic, we can influence this “hostname to IP resolution” and do many cool things like load balancing, high availability, and more. However the key challenge in doing all that is first result of DNS changes usually is not instance since there is lot of caching by the “recursive DNS servers” and second that since recursive DNS servers contact authoritative DNS servers, thus authoritative DNS servers (as by default protocol design) don’t really know of end users. They only know that to which DNS recursor they are talking with (based on source IP of DNS recursor) which many times has relation with end users since primarily ISPs run the recursive DNS servers. But in modern world of large Open DNS recursors like OpenDNS, Google Public DNS – it faints out that impact.¬†


Here’s how DNS based CDN services work




Here we have users on ISP A requesting for “cdn.website.com” IP address. Requests will go to DNS recursor of ISP which will further hit authoritative DNS servers of CDN provider via DNS hierarchy. Green lines here show the flow of DNS information. Eventually based on IP of requesting DNS recursor, authoritative DNS will reply back with the IP address of cache node close to network A.¬†


Some of key features of this approach:
  1. Optimization logic is pretty much with authoritative DNS server which can change around IP in order to give a location which can serve off request in optimum manner. If one of edge servers is down, algorithm can take care of it by serving other location.
  2. In most of such deployments cdn.domain.com points to cdnxx.cdn-provider.com via cname record and thus actual resolution logic stays within domain of cdn-provider.com. The records like cdnxx.cdn-provider.com have very low TTL (less then a minute) to make changes reflect instantly. 
  3. These approaches fails significantly if end users do not use DNS recursors of their ISP since reply is very much dependent on location/GeoIP parameters of source IP of DNS recursor. 


Some of new CDN networks have came up with full anycast based setup with very little dependency on DNS. E.g Cloudflare.


Here’s how anycast routing based CDN providers work




Here  we have User1 & User 2 on ISP A connected to ISP A router, User 3 & User 4 on ISP B connected to ISP B router & finally User 5 & User 6 on ISP C connected on ISP C router. All off these routers are have CDN provider caches nearby and get multiple routes. So e.g for ISP A router, CDN server A is 1 hop away, while CDN server B is 2 hops away and CDN Server C is 3 hops away. If all servers use the same IP then ISP A will prefer going to CDN ServerA, B will go to CDN server B and so on with C. 


Some of key features of this approach:

  1. Optimization is based on BGP routing and announcement with little role of DNS. 
  2. This setup is very hard to build up and scale since for anycast to work perfectly at global level, one needs lot’s and lot’s of peering and consistent transit providers at each location. If any of peers leaks a route to upstream or other peers, there can be lot of unexpected traffic on a given cluster due to break of anycast.¬†
  3. This setup has no dependency on DNS recursor and hence Google DNS or OpenDNS works just fine. 
  4. This saves a significant amount of IP addresses since same pools are used at multiple locations. 



With that beings said, I hope you are getting served from nearest cache for static content of my blog. (since I use Amazon Cloudfront for static content). ūüôā


Disclaimer: This is my personal blog and does not necessarily reflect thoughts of my employer.

28 Oct

Akamai CDN and DNS resolution analysis

These days Open DNS resolvers are getting quite popular. With Open DNS resolver I mean resolvers including OpenDNS as well as Google Public DNS.

One of major issues these resolvers suffer is failure of integration with CDN providers like Akamai, Limelight etc. In this post I will analyse sample client site of Akamai –¬†Malaysia Airlines website –¬†http://www.malaysiaairlines.com. ¬†


Looking at OpenDNS, Google Public DNS and my ISP (BSNL’s) DNS resolver for its DNS records:


;www.malaysiaairlines.com. IN A

www.malaysiaairlines.com. 12169 IN CNAME www.malaysiaairlines.com.edgesuite.net.
www.malaysiaairlines.com.edgesuite.net. 12169 IN CNAME a1456.b.akamai.net.
a1456.b.akamai.net. 20 IN A
a1456.b.akamai.net. 20 IN A


Google Public DNS

;www.malaysiaairlines.com. IN A

www.malaysiaairlines.com. 12312 IN CNAME www.malaysiaairlines.com.edgesuite.net.
www.malaysiaairlines.com.edgesuite.net. 12318 IN CNAME a1456.b.akamai.net.
a1456.b.akamai.net. 10 IN A
a1456.b.akamai.net. 10 IN A


BSNL’s DNS resolver

;www.malaysiaairlines.com. IN A

www.malaysiaairlines.com. 20410 IN CNAME www.malaysiaairlines.com.edgesuite.net.
www.malaysiaairlines.com.edgesuite.net. 20410 IN CNAME a1456.b.akamai.net.
a1456.b.akamai.net. 20 IN A
a1456.b.akamai.net. 20 IN A


Notice different IP’s coming when asked from different DNS resolvers.¬†

OpenDNS passes me which is announced by Singtel in Singapore.
Google passes me which is announced by Tmnet in Malaysia.
BSNL’s DNS resolver passes me ¬† announced by BSNL-NIB itself is within India (yay!) ūüôā

This results in latency of 300ms for¬†www.malaysiaairlines.com when using OpenDNS & Google while 60ms when using ISP’s default resolver.¬†


How and why this is happening?

The answer lies on underlying DNS layer which is doing this magic. In all cases¬†www.malaysiaairlines.com. is a cname (alias record) to¬†www.malaysiaairlines.com.edgesuite.net. ¬†Further¬†www.malaysiaairlines.com.edgesuite.net. is a cname to¬†a1456.b.akamai.net. Real magic comes here – “b.akamai.net.” itself is a DNS zone. Let’s look at this zone from all 3 DNS resolvers:


anurag@laptop:/$ dig b.akamai.net. ns +short @

anurag@laptop:/$ dig b.akamai.net. ns +short @

anurag@laptop:/$ dig b.akamai.net. ns +short @


All identical names. Let’s pick one randomly and analyse:



anurag@laptop:/$ dig n0b.akamai.net a @ +short

anurag@laptop:/$ dig n0b.akamai.net a @ +short

anurag@laptop:/$ dig n0b.akamai.net a @ +short


All different IPs!
At this stage everything seems very confusing.


Let’s revise what we have till now

www.malaysiaairlines.com. is CNAME to www.malaysiaairlines.com.edgesuite.net. and¬†www.malaysiaairlines.com.edgesuite.net. is cname to¬†a1456.b.akamai.net.¬†Now a1456.b.akamai.net. is a absolute hostname under DNS zone “b.akamai.net” which is giving different IPs when checked from different DNS resolvers. b.akamai.net DNS zones has several DNS servers and I randomly pick one of them¬†n0b.akamai.net. We see¬†n0b.akamai.net itself gives different A records and thus I am going back to parent zone which is akamai.net to further find how this is happening.


Let’s see DNS servers of akamai.net:

To avoid further confusion due to interesting DNS lookups, let’s use whois record of akamai.net domain to see what authoritative DNS servers it is using rather then a DNS query:

anurag@laptop:~$ whois akamai.net

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: AKAMAI.NET
Registrar: TUCOWS.COM CO.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Name Server: NS2-193.AKAMAITECH.NET
Name Server: NS3-193.AKAMAITECH.NET
Name Server: NS4-193.AKAMAITECH.NET
Name Server: NS5-193.AKAMAITECH.NET
Name Server: NS6-193.AKAMAITECH.NET
Name Server: NS7-193.AKAMAITECH.NET
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 18-jun-2012
Creation Date: 03-mar-1999
Expiration Date: 03-mar-2022

>>> Last update of whois database: Sun, 28 Oct 2012 16:56:03 UTC <<<


Now again let’s pick one randomly –¬†NS1-1.AKAMAITECH.NET¬†and see what it tells us for hostname “n0b.akamai.net”¬†


anurag@laptop:~$ dig @NS1-1.AKAMAITECH.NET n0b.akamai.net +short



Wow! Akamai’s DNS setup can make a boring Sunday evening very interesting. ūüėČ


Now since¬†NS1-1.AKAMAITECH.NET. itself is on a different domain name (and so different DNS zone), let’s do bit more effort to get to the core of it.¬†NS1-1.AKAMAITECH.NET. is simply an A record on DNS servers of¬†AKAMAITECH.NET. zone.


Let’s look at that zone now:

anurag@laptop:/$ dig AKAMAITECH.NET ns +short


Again, let’s pick –¬†zh.AKAMAITECH.NET. and query for¬†NS1-1.AKAMAITECH.NET.

anurag@laptop:/$ dig NS1-1.AKAMAITECH.NET. @zh.AKAMAITECH.NET.  +short

Finally some¬†consistent¬†result (YAY!). So is server with IP¬† playing game? Remember in 2nd last step this server was giving different IPs for hostname¬†NS1-1.AKAMAITECH.NET. I SMELL ANYCASTING! ūüôā

Let’s do a traceroute to¬† from my location (BSNL Haryana), Airtel Delhi node & my Europe server (where this blog is hosted!):



traceroute to (, 30 hops max, 60 byte packets
1 ( [AS1] 0.644 ms 1.022 ms 1.150 ms
2 ( [AS9829] 19.467 ms 20.335 ms 21.824 ms
3 ( [AS9829] 27.180 ms 29.092 ms 30.510 ms
4 ( [AS18101] 61.354 ms 63.244 ms 64.209 ms
5 ( [AS18101] 68.160 ms 68.907 ms 69.847 ms
6 ( [AS18101] 72.336 ms 54.497 ms 54.633 ms
7 ( [AS9498/AS7617] 80.766 ms 82.390 ms 83.732 ms
8 AES-Static- ( [AS24560/AS9498] 87.199 ms 88.580 ms 90.314 ms
9 * * *
10 * * *


Europe server

traceroute to (, 30 hops max, 60 byte packets
1 gw.giga-dns.com ( [AS51167] 0.639 ms 0.637 ms 0.623 ms
2 host-93-104-204-33.customer.m-online.net ( [AS8767] 0.600 ms 0.592 ms 0.585 ms
3 xe-1-1-0.rt-decix-2.m-online.net ( [AS8767] 7.784 ms 7.740 ms 7.727 ms
4 xe-1-1-0.rt-decix-2.m-online.net ( [AS8767] 7.464 ms 7.461 ms 7.452 ms
5 decix-fra6.netarch.akamai.com ( [AS6695] 8.434 ms 8.916 ms 8.407 ms
6 * * *
7 * * *
8 * * *


Here we go! Surely anycasting. is coming from prefix announced by Akamai AS21342 announced at different locations.



Let’s go in forward mode now:

Akamai CDN provider has a interesting DNS setup with mix of anycasting DNS servers where “edge servers” carry different A record for a given hostname. E.g at core Akamai has set of anycasted DNS servers like¬†zh.AKAMAITECH.NET which hold A record for another set of DNS servers like¬†NS1-1.AKAMAITECH.NET. which act as DNS server for akamai.net domain name. Next, these DNS servers hold different values for another set of DNS servers like¬†n0b.akamai.net which are hold the delegation for a subzone like¬†b.akamai.net which holds the hostname like¬†a1456.b.akamai.net¬†to which hostnames like www.malaysiaairlines.com.edgesuite.net. point to! ūüôā¬†


Why Akamai is having such complex setup?

My strong guess here is that multiple zones and cross dependency here is simply to spread load and avoid single point failure. The important thing here is that at core of DNS Akamai uses anycasting but for serving content from these web servers there’s no anycasting. E.g I am getting IP¬†¬†for Akamai’s client site why is a unicated IP from BSNL¬† prefix announcement. Akamai is NOT using anycasting on edge distribution and my strong guess for that is that it’s way too easy for Akamai to manage things in current rather then putting caching servers on anycasting IPs. E.g if in current situation Akamai node on BSNL is choked up, they can simply distribute traffic by modifying DNS server to pass A record to BSNL 1 out of 4 times and rest of time pass the IP of caching node on Airtel. In case of anycasting that is not possible. It will simply follow short AS/hop path and distribution of load partially is not possible. Again that’s my guess. ūüôā

Time for me to change DNS resolver in my router now!