You don’t understand DNS like you think you do

Summary of You don’t understand DNS like you think you do

by The Stack Overflow Podcast

29m•June 19, 2026
Listen to Episode

Overview of The Stack Overflow Podcast

This episode is a deep dive into DNS, BIND, and the often underappreciated security role DNS plays in modern internet infrastructure. Host Ryan Donovan talks with Cricket Liu, Chief Evangelist at Infoblox and a longtime DNS expert, about how DNS works at enterprise scale, why it’s so critical yet so misunderstood, how Anycast and load balancing keep the internet resilient, and what’s changing with encrypted and protective DNS.

Key Topics Discussed

How DNS works in enterprises

  • Large organizations run the same core DNS architecture as the public internet:
    • Recursive DNS servers that look up answers.
    • Authoritative DNS servers that publish zone data.
  • Many enterprises use split-horizon / split-namespace DNS, where internal users see different records than the public internet.
  • Internal DNS commonly resolves:
    • desktops and servers
    • application endpoints
    • internal services and infrastructure

Why DNS is so fundamental

  • DNS happens before nearly every non-trivial internet transaction.
  • It remains surprisingly poorly understood, even though it’s foundational.
  • Cricket notes that DNS has fewer true specialists than it used to, despite its centrality.

Why DNS isn’t just “a list of IP addresses”

  • The original approach was a simple host table.
  • The internet’s scale required:
    • hierarchical namespaces
    • delegation
    • distributed management
  • DNS evolved into a system for mapping names to IPs and other data, not just a static lookup file.

BIND and DNS Implementations

What BIND is

  • BIND is a DNS server implementation, not the DNS protocol itself.
  • DNS is defined through RFCs; BIND is one of the earliest and most influential implementations.
  • The name stands for Berkeley Internet Name Domain.

Why BIND still matters

  • BIND has been heavily rewritten over time:
    • BIND 4 in the 1980s
    • BIND 8 in the 1990s
    • BIND 9 in the 2000s and beyond
  • It remains widely used, even though many DNS server implementations now exist, including:
    • Microsoft DNS
    • Unbound
    • NSD

How DNS has changed over time

  • Newer versions had to account for:
    • multi-threading / multi-processing
    • improved security and auditability
    • new DNS features like dynamic updates
    • DNSSEC
    • newer record types supporting modern web behavior

Infrastructure Patterns That Keep DNS Scalable

Load balancing and virtual IPs

  • A single IP address can represent:
    • a load balancer
    • a cluster of load balancers
    • a backend pool of servers
  • Layer 3 load balancing does not require DNS lookups; it simply routes traffic to one of several known IPs.
  • Common balancing strategies mentioned:
    • round robin
    • least-loaded selection
    • configurable algorithms

Anycast in DNS

  • Anycast allows many servers around the world to share the same IP address.
  • Routing sends a query to the “closest” reachable instance.
  • Benefits:
    • global distribution
    • scale
    • resilience
    • simpler public-facing addressing
  • Examples cited:
    • Google Public DNS: 8.8.8.8
    • Cloudflare DNS: 1.1.1.1 and 1.0.0.1

DNS Security Risks and Threats

Historical vulnerabilities

  • DNS has long been vulnerable to:
    • implementation flaws
    • buffer overflows
    • denial-of-service attacks
  • A notable early example was the Lion worm, which spread using a DNS server buffer overflow.

Large-scale DDoS attacks

  • The 2016 attack on Dyn showed how damaging a DNS outage can be.
  • Dyn’s infrastructure was robust, but it was overwhelmed by the Mirai botnet, made up largely of compromised IoT devices.
  • This highlighted how DNS outages can make “the internet” seem down, even when the broader internet is still functioning.

Lame delegations and domain hijacking

  • A lame delegation occurs when a domain points to DNS servers that no longer respond properly.
  • Attackers can exploit this by taking over or re-registering the DNS infrastructure for that domain.
  • This can lead to:
    • brand impersonation
    • traffic hijacking
    • reputational damage
    • phishing and fraud opportunities

Encrypted DNS and Privacy

Why encryption matters

  • Traditional DNS client-to-resolver traffic has often been unencrypted.
  • Risks include:
    • snooping: seeing which sites or services a user queries
    • spoofing: injecting fake responses and redirecting users
  • Encryption helps protect:
    • privacy
    • integrity
    • authenticity of DNS responses

Major encrypted DNS protocols

  • DoT — DNS over TLS
  • DoH — DNS over HTTPS
  • DoQ — DNS over QUIC

Tradeoffs

  • Encryption adds overhead to:
    • DNS clients / stub resolvers
    • recursive DNS servers
  • Despite the cost, encrypted DNS is increasingly important for modern security and privacy expectations.

Protective DNS and Threat Prevention

What protective DNS does

  • Protective DNS systems can refuse to resolve known malicious domains.
  • Instead of returning a real IP, they may return a “safe failure” or block response.
  • This helps prevent users from reaching:
    • malware sites
    • phishing pages
    • suspicious infrastructure

How the intelligence is built

  • DNS servers can consume reputation feeds via mechanisms like:
    • RPZ — Response Policy Zones
  • Threat intelligence may come from:
    • spam and phishing analysis
    • passive DNS data
    • machine learning models
  • Infoblox uses this kind of approach to generate large-scale threat-blocking DNS feeds.

Standards support

  • Cricket highlights NIST SP 800-81r3 as an important recent document because it now covers:
    • encrypted DNS
    • protective DNS deployment guidance

IPv6 and NAT

Why IPv6 matters

  • IPv6 solves the practical exhaustion of IPv4 addresses.
  • It provides a vastly larger address space and reduces reliance on workarounds.

Why NAT is “nasty”

  • Network Address Translation (NAT) adds complexity:
    • harder troubleshooting
    • hidden address translation across network boundaries
    • state/memory overhead
    • potential failure points
  • NAT is often necessary, but it’s not elegant and is best minimized when possible.

Notable Takeaways

  • DNS is one of the internet’s most essential systems, but also one of the least understood.
  • Modern DNS is much more than name-to-IP lookup:
    • it supports delegation, resilience, load balancing, and security policy.
  • Security is now a first-class DNS concern, especially with:
    • encrypted DNS
    • protective DNS
    • domain takeover prevention
  • Anycast is a major reason DNS can scale globally and survive massive traffic spikes or attacks.

Practical Implications

For engineers and operators

  • Make sure DNS infrastructure is:
    • redundant
    • geographically distributed
    • monitored
    • capable of failing over cleanly
  • Avoid depending on a single control plane that becomes unreachable when DNS is impaired.
  • Consider adopting:
    • encrypted DNS
    • RPZ-based protective DNS
    • IPv6 readiness

For security teams

  • Treat DNS as a security surface, not just a utility.
  • Monitor for:
    • lame delegations
    • hijacked zones
    • malicious domains
    • DNS-based reconnaissance and exfiltration
  • Use threat-intelligence-backed DNS policy where appropriate.

Closing Notes

  • The episode closes with the standard Stack Overflow shout-out and show contact details.
  • Cricket Liu recommends Infoblox as a place to learn more about DNS and protective DNS technologies.