(net308) consolidating dns data in the cloud with amazon route 53

© 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

Lee Zen, AWS Edge Services

October 2015

NET308

Consolidating DNS Data in the Cloud with Amazon Route 53

Agenda

• Why should I do this? Why is now the right time?

• Cost

• Simplicity

• Single view

• API management

• Basic DNS use cases

• Advanced private DNS

example.com

Third-party monitoring

System monitoring

Internal DNS

Public DNS

Route 53 public zones

Route 53 private zones

Route 53 health checks

example.com

Basic DNS use cases

Bulk transfer domains

1. Export DNS to Route 53

2. Delegate to Route 53

3. Transfer domains to Route 53

Order matters for availability!

Export DNS

Highly dependent on your existing DNS provider.

Two examples:

• GoDaddy

• “DNS Zone File” tab with an “Export (UNIX)” format

• BIND

• Typically in /var/named/chroot/var/named

• Use cli53 to import

• https://github.com/barnybug/cli53

Export DNS

# assuming we have files in the format [domain].zone, we can do this:

#!/bin/sh

for zonefile in *.zone; do

domain=$(basename "$zonefile" .zone)

cli53 create ${domain} --comment 'bulk'

cli53 import ${domain} --file ${zonefile}

done

Delegate to Route 53

• This step is registrar dependent.

• Namecheap example:

• https://api.namecheap.com/xml.response?ApiUser=<example>&ApiKey=<key>&UserName=<user>&Command=namecheap.domains.dns.setCustom&ClientIp=192.168.1.109&SLD=domain&TLD=com&NameServers= ns-425.awsdns-53.com,ns-793.awsdns-35.net,ns-1049.awsdns-03.org,ns-1692.awsdns-19.co.uk

Delegate to Route 53

• Check that you’re actually delegated (dig +trace)$ dig +trace awsarchitectureblog.com

…

. 505108 IN NS k.root-servers.net.

…

com. 172800 IN NS

…

awsarchitectureblog.com. 172800 IN NS ns-425.awsdns-53.com.

awsarchitectureblog.com.172800 IN NS ns-793.awsdns-35.net.

awsarchitectureblog.com. 172800 IN NS ns-1049.awsdns-03.org.

awsarchitectureblog.com. 172800 IN NS ns-1692.awsdns-19.co.uk.

• Wait for TTLs to expire

Transfer domains

• Also registrar dependent, but you will want to unlock your domains and obtain authorization codes.

• Namecheap example:• Unlock:

https://api.namecheap.com/xml.response?ApiUser=<example>&ApiKey=<key>&UserName=<user>&Command=namecheap.domains.setRegistrarLock&ClientIp=192.168.1.109&DomainName=example.com&LockAction=unlock

• Obtain authorization codes (depends on the registrar; GoDaddy has a bulk download option)

Transfer domains

#/usr/bin/ruby

require 'csv'

require 'aws-sdk-core'

route53domains = Aws::Route53Domains::Client.new(region: 'us-east-1')

CSV.foreach("authcodes.csv") do |row|

route53domains.transfer_domain(...

end

Third-party monitoring

System monitoring

Internal DNS


example.com

Take advantage of AWS integration

• ALIAS

• Health checks and DNS failover

• Calculated health checks

• Latency measurements

Internal DNS



example.com

Set up private DNS

$ cli53 import example.integ --file example.integ.zone


Route 53 private zones


example.com

Advanced private DNS

Using in-VPC resolver

• What we can’t do with the gateway+2 (e.g. 10.0.0.2)

• Private DNS combines the resolver and authority – this

means you can’t treat it as an authoritative server

• Delegation back via NS records doesn’t work

On-premises to cloud

Resolver

Route 53

Authority

+2 Resolver

Q

1

2

34

5

6

On-premises to cloud

Resolver

Route 53

Authority

+2 Resolver

Q

1

2

45

7

8

Forwarder

3

6

Setup unbound as the forwarder

$ sudo apt-get install unbound

/etc/unbound/unbound.conf:

server:

...

interface: 0.0.0.0

interface: ::0

access-control: 0.0.0.0/0 allow

...

$ sudo unbound-control reload

Setup unbound as the forwarder

forward-zone:

name: "."

forward-addr: 10.0.0.2

AWS Directory Service as the forwarder

• Fully managed on your behalf

• If you want to utilize Active Directory in your VPC, you

also get to take advantage of that as well

Set up Active Directory

Example

$ cat /etc/resolv.conf

; generated by /sbin/dhclient-script

search ad.cloud.zen

nameserver 10.0.1.114

nameserver 10.0.2.135

Example

Example

$ dig TXT example.cloud.zen

;; QUESTION SECTION:

;example.cloud.zen. IN TXT

;; ANSWER SECTION:

example.cloud.zen. 60 IN TXT "hello world"

;; Query time: 4 msec

;; SERVER: 10.0.1.114#53(10.0.1.114)

Active Directory and Route 53 Private DNS

• Manage all non-AD names in Private DNS (because it

will fall through)

• API endpoint in Route 53

• Zones can cross regions with private DNS

Resolver

Route 53

Authority

+2 Resolver

Q

1

2

45

7

8

Forwarder

3

6

BIND configuration

options {

...

forwarders { 10.0.1.114; 10.0.2.135; };

forward only; # depending on your configuration

};

zone ”cloud.zen" {

type forward;

forwarders { 10.0.1.114; 10.0.2.135; };

};

Unbound configuration

forward-zone:

name: "."

forward-addr: 10.0.1.114forward-addr: 10.0.2.135

forward-zone:

name: ”cloud.zen"



Flatten your zones instead of subdelegating

Resolver

cloud.zen

+2 Resolver

Q

Forwarder

sub.cloud.zen

On-premises contains data not in private DNS

• Loop the query through on-premises

• Copy the data into private DNS

• Setup conditional forwarding in Active Directory

Queries from on-premises will see the data

Resolver

Route 53

Authority

+2 Resolver

Q

1

2

45

7

8

Forwarder

3

6

Loop the query through on-premises for VPC

Resolver

Route 53

Authority

+2 Resolver

Q

1

2

45

7

8

Forwarder

3

6

Copy the data into private DNS

https://code.google.com/p/route53d/

• or cli53 or

[hostedzone]

#

# Enumerate the zone IDs for each hosted zone, e.g.:

# [hostedzone]

# foo.com = Z123

# baz.org = Z456

https://code.google.com/p/route53d/

Copy the data into private DNS

Resolver

Route 53

Authority

+2 Resolver

Q

123

Forwarder

4

Summary

• Consolidating your DNS infrastructure in the cloud is

easy and simplifies management

• There are a number of ways to combine private DNS

with an on-premises or existing DNS solution

• We’re aware of the limitations of the gateway+2 and are

working toward resolving those limitations

Remember to complete

your evaluations!

Thank you!

(net308) consolidating dns data in the cloud with amazon route 53

Technology