search

dnshealth / dns-health

5 stars 3 forks source link

Network diversity: Ignore anycast? #29

Open kasgel opened 4 years ago

kasgel commented 4 years ago

Apparently many big providers use anycast on their nameserver IP addresses. This means that even though the IPs are all in the same ASN block, they are broadcasted from hundreds of locations all around the world.

This is not urgent, but we'd need some way to pass the check if anycast is being used. This will require some BGP querying, most likely.

kasgel commented 4 years ago

Example

/main.py --domain google.com --ns ns1.google.com ns2.google.com ns3.google.com ns4.google.com
[✓] PASS Unique Nameservers
[✓] PASS Valid hostnames
[✓] PASS Nameserver reachability TCP&UDP
[✓] PASS answer authoritatively
[X] FAIL Network diversity
[✓] PASS Consistency between glue and authoritative data
[✓] PASS Consistency between delegation and zone
[✓] PASS Consistency between authoritative nameservers
[✓] PASS PASS - Glue records found, non-EDNS0 UDP DNS packet support verified
[✓] PASS Prohibited Networks
[✓] PASS Check nameservers not recursive
[✓] PASS Same source address as destination address

As said, this is an edge case that we can fix later.