Study by SIDN Labs and UT shows Dutch government DNS infrastructure is sound
Researchers recommend central secondary anycast
The Dutch government's DNS infrastructure is generally sound, according to a study by SIDN Labs and the University of Twente (UT) for the National Cyber Security Centre (NCSC). The researchers nevertheless recommended a number of improvements, such as setting up a central secondary anycast system to optimise availability. The resilience of the Dutch government's DNS infrastructure was also assessed, and found to be comparable with the Swedish, Swiss and US government set-ups.
Identifying possible improvements
The NCSC commissioned the research because it wanted to learn more about current best practices for DNS availability. The Centre was also interested to hear whether the current set-up could be improved. SIDN Labs and UT were chosen to undertake the study because of their track records and expertise in the field of DNS, DNS infrastructures and associated security and stability testing [RFC 9199]. Logius was also involved to compile accurate lists of government domain names.
Diversification and continuous monitoring important
The researchers from SIDN Labs and UT concluded that the Dutch government's DNS infrastructure is generally sound. Their main recommendation was that the government should use a number of internal and/or external DNS service providers, rather than relying on one. Establishment of a central secondary anycast infrastructure was also proposed. Finally, the research team advised periodic scanning of the government's DNS set-up. That would help exclude minor configuration errors, a number of which were detected by the study. The exclusion of minor problems – references to non-existent servers and instances of primary and secondary servers being on the same network, for example – is desirable because they can impair performance or diminish redundancy. Periodic scanning would promote early detection and correction, the researchers reasoned.
Comparison
On the basis of their first scan findings, the SIDN Labs-UT team compared the resilience of the Dutch government's DNS infrastructure with the Swedish, Swiss and US government systems. Their conclusion was that all 4 countries were broadly on a par. The peer-reviewed results of the comparative study [PDF] were recently presented at a major academic symposium, the 18th International Conference on Network and Service Management (CNSM2022). In May, the study is also due to be presented at RIPE 86 in Rotterdam, a gathering for internet service providers, network operators and other stakeholders from all over the world. The NCSC has also published a (Dutch) press release about the research.
