Madhav Kobal's Blog

This blog will be dedicated to Linux, Open Source and Technology news, affairs, how-tos and virtually EVERYTHING in these domains.

Google Wants to Take Over DNS, Too

Posted by madhavkobal on 04/12/2009

Google now wants to be your browser’s phone book, launching a DNS service Thursday in hopes that users will let the ad and search giant take over yet another part of their net experience.

Browsers ask Domain Name System (DNS) servers to translate URLs like into the web addresses where the servers are (e.g., That lets browsers retrieve pages and e-mail clients address e-mails to the right place. Most people simply use the DNS server provided by their ISP, and don’t even know the service exists.

But in recent years, DNS has become competitive with OpenDNS and Neustar offering free and premium services.

OpenDNS in particular has thrived by making their lookups faster, smarter and safer than those from most ISPs, which have little interest in investing in DNS.

But now Google says it’s going to offer its own DNS, which it says will be faster and more secure (See Webmonkey’s Google DNS post to learn the how-to and the whys). While the project isn’t open source, Google says it plans to share what it learns in order to speed up the web around the world. It also says it plans to limit the data it keeps and not show any ads.

Why Google Public DNS?

As web pages become more complex and include more resources from multiple origin domains, clients need to perform multiple DNS lookups to render a single page. The average Internet user performs hundreds of DNS lookups each day, slowing down his or her browsing experience. As the web continues to grow, greater load is placed on existing DNS infrastructure.

Since Google’s search engine already crawls the web on a daily basis and in the process resolves and caches DNS information, we wanted to leverage our technology to experiment with new ways of addressing some of the existing DNS challenges around performance and security. We are offering the service to the public in the hope of achieving the following aims:

  • Provide end users with an alternative to their current DNS service. Google Public DNS takes some new approaches that we believe offer more valid results, increased security, and, in most cases, better performance.
  • Help reduce the load on ISPs’ DNS servers. By taking advantage of our global data-center and caching infrastructure, we can directly serve large numbers of user requests without having to query other DNS resolvers.
  • Help make the web faster and more secure. We are launching this experimental service to test some new ways to approach DNS-related challenges. We hope to share what we learn with developers of DNS resolvers and the broader web community and get their feedback.

Google Public DNS: what it is and isn’t

Google Public DNS is a recursive DNS resolver, similar to other publicly available services. We think it provides many benefits, including improved security, fast performance, and more valid results. See below for an overview of the technical enhancements we’ve implemented.

Google Public DNS is not, however, any of the following:

  • A top-level domain (TLD) name service. Google is not an operator of top-level domain servers (generic or country-code), such as Verisign.
  • A DNS hosting or failover service. Google Public DNS is not a third-party DNS application service provider, such as DynDNS, that hosts authoritative records for other domains.
  • An authoritative name service. Google Public DNS servers are not authoritative for any domain. Google maintains a set of other nameservers that are authoritative for domains it has registered, hosted at ns[1-4]
  • A malware-blocking service. Google Public DNS does not perform blocking or filtering of any kind.

Overview of benefits and enhancements

Google Public DNS implements a number of security, performance, and compliance improvements. We provide a brief overview of those enhancements below. If you’re a developer or deployer of DNS software, we hope you’ll also read the technical information pages on this site for more information on these features. Ultimately, our hope is to share our insights and inspire the community to adopt some of these features in all DNS resolvers. The changes are grouped into 3 categories:

  • Performance. Many DNS service providers are not sufficiently provisioned to be able to support high-volume input/output and caching, and adequately balance load among their servers. In addition to load-balancing user traffic to ensure shared caching, Google Public DNS implements “smart” caching to increase the speed of responses. Google Public DNS independently resolves domain names and keeps the resolutions in the cache until their time-to-live (TTL) expires, at which point they are automatically refreshed. The cycle of caching and refreshing is performed offline, asynchronously with user requests, so that responses are almost always available directly from cache. For more information, see the page on performance benefits.
  • Security. DNS is vulnerable to various kinds of spoofing attacks that can “poison” a nameserver’s cache and route its users to malicious sites. The prevalence of DNS exploits means that providers have to frequently apply server updates and patches. In addition, open DNS resolvers are vulnerable to being used to launch denial-of-service (DoS) attacks on other systems. To defend against such attacks, Google has implemented several recommended solutions to help guarantee the authenticity of the responses it receives from other nameservers, and to ensure our servers are not used for launching DoS attacks. These include adding entropy to requests, rate-limiting client traffic, and more. For more information, see the page on security benefits.
  • Correct results. Google Public DNS does its best to return the right answer to every query every time, in accordance with the DNS standards. Sometimes, in the case of a query for a mistyped or non-existent domain name, the right answer means no answer, or an error message stating the domain name could not be resolved. Google Public DNS never blocks, filters, or redirects users, unlike some open resolvers and ISPs.

Please refer configuring Google DNS.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: