You don’t understand DNS like you think you do

**Ryan Donovan** (0:07)
Hello, everyone, and welcome to The Stack Overflow Podcast, a place to talk all things software and technology. I am your host, Ryan Donovan. And today we are talking about DNS and BIND and the security implications of DNS.
And my guest for that today is Cricket Liu, who's the chief evangelist at Infoblox. So welcome to the show, Cricket.

**Cricket Liu** (0:28)
Yeah, thanks, Ryan, it's nice to be here.

**Ryan Donovan** (0:30)
So before we get into DNS and all that, can you tell us a little bit about how you got into software and technology?

**Cricket Liu** (0:37)
Well, I majored in computer science in college way back when, back when I think my freshman and sophomore year, my computer science courses were taught on Vaxen. That will serve, I think, to Arben Davy, maybe.

**Ryan Donovan** (0:51)
Yeah, yeah.

**Cricket Liu** (0:53)
I'd always sort of been involved in tech. The first job I took, actually, I worked there for two summers even before I graduated, was with Hewlett Packard. And back then, HP was a great place to kind of learn the ropes, learn how to do something useful, because I don't think I was useful to anybody right after I graduated. But I worked for the department that ran the HP Internet, then the world's largest private TCP IP-based network, mostly because there were larger computer manufacturers, but they had proprietary networks, right? IBM had SNA, DEC had DECnet. HP really didn't have their own proprietary networking technology, so they mostly went with TCP IP. And that was where I kind of learned the ropes.
I ran hp.com for, gosh, about four and a half or five years or so.

**Ryan Donovan** (1:40)
I think what most people think about DNS, they think about resolving the URL of your website. But like you said, you got started on the internal network. There's a lot of DNS work that goes on there, routing internally. How does DNS work within a sort of, let's call it a captive network?

**Cricket Liu** (2:00)
You have the same kind of infrastructure within a large enterprise network that you have out on the internet. You have recursive DNS servers, you have authoritative DNS servers. The authoritative DNS servers are there to advertise internal zone data. Most large enterprises have what we call split namespaces. So they have a different version of, say, infoblox.com, that they show the inside, than they show the outside world. The outside world sees the website, the mail servers, the DNS servers and things like that. Inside, you would see desktop machines, servers, information about applications that might be running and stuff like that.
And of course, any large enterprise also has to have those recursive DNS servers, which are the ones that do all that heavy lifting of communicating with perhaps several authoritative DNS servers to find an answer. And some of those are looking up internal stuff, and maybe they just talk to internal authoritative DNS servers. Sometimes they're looking up stuff out on the internet, and they might have to communicate with an external or internet-based author. They might have to communicate with what we call a forwarder, which is kind of like a DNS proxy server, if you will, that assumes that responsibility on behalf of the internal DNS server.

**Ryan Donovan** (3:13)
So we've seen the occasional cloud outages or infrastructure outages, and a lot of times DNS comes up as the culprit. Why is DNS sort of complicated, and why is it the thing that takes down large parts of the internet architecture?

**Cricket Liu** (3:29)
Well, DNS is simultaneously very, very fundamental in that it basically precedes every non-trivial transaction that occurs over the internet.
But it's also not particularly well understood. And I've now spent almost four decades, I guess, doing DNS. And it's still not really broadly understood. You'd have a hard time finding somebody who's really an expert in DNS, which I guess means that my career has been something of a failure because worse, I've been trying to educate people about DNS for those nearly 40 years.

**Ryan Donovan** (4:05)
Well, you might be the expert they're looking for.

**Cricket Liu** (4:08)
I was supposed to train other people, I guess. It didn't go so well. But yeah, it's just not really well understood, despite the fact that it's this fundamental technology. I think people have, for example, a better handle on routing, on routing protocols like BGP and OSPF and other more exotic things.
People understand e-mail. There are certainly lots of folks who are experts in electronic mail. We probably used to have more DNS experts, but today there are fewer and fewer of us dinosaurs out there, I guess.