The new project ISP DNS Stack increases the security of the Internet in the Czech Republic

The new service is intended for use primarily by major Internet service providers, which in turn offer it to large numbers of customers and heavily utilize the DNS traffic.

The availability of Internet services in the Czech Republic, which may be disrupted in the event of massive attacks on the key domain name system (DNS), is to be ensured by a new service of the CZ.NIC association, the Czech national domain administrator. The service is intended for use primarily by major Internet service providers, which in turn offer it to large numbers of customers and heavily utilize the DNS traffic. The first companies to join this activity of the CZ.NIC association are Seznam.cz and Vodafone.

The main advantage of the introduction of the so-called ISP DNS stack is full availability of services in the .CZ domain in case of an attack against DNS servers of the CZ.NIC Association. Customers of the companies with ISP DNS stack will not be affected by such an attack and Internet services in the .CZ domain will remain fully accessible to them. Another benefit is the increase of query throughput and the response speed in the network of a provider with the ISP DNS stack.

“For Seznam.cz as a provider of content, information and entertainment, a well-functioning Internet infrastructure is vital. DNS is an indispensable part of this infrastructure, and very much so, as we know from history,” said Vlastimil Pečínka, technical director of the company Seznam.cz, and added: “We have recently invested in enhancement of the DNS services used in both our data centers. The offer to host the DNS stack made by the CZ.NIC Association takes this investment to the next level. In addition, I very much appreciate the efforts of the CZ.NIC Association in searching for more ways to help services and users on the Internet. I am very glad that I can actively support these efforts.”

“Cooperation with NIC.CZ is part of our long-term strategy of building reliable data services. The ISP DNS stack service means that a copy of the DNS server for the .CZ domain is stored directly in the Vodafone network. This enables us to ensure the correct functioning of the DNS for Czech domains even in case of attacks on servers of CZ.NIC,” explains Milan Zíka, technical director of Vodafone.

The ISP DNS stack service is provided exclusively by the CZ.NIC Association. The Czech national domain administrator takes part in the functioning of the operating system and all the services. Participating organizations purchase the necessary hardware, install it in datacenters and ensure the operation within their network.

“The DNS system is crucial for the functioning of the Internet and the dependent services. In case that the system is attacked or fails, the Internet would become virtually unusable for most people. I greatly appreciate the approach of the companies Seznam.cz and Vodafone, which demonstrates primarily to its customers that for them, the availability of the Internet in any situation is crucial,” said Ondřej Filip, CEO of the CZ.NIC Association. “We launched the first DNS nodes in the networks of Seznam.cz and Vodafone in August. We hope that in the near future, other important organizations will follow. We want to focus primarily on companies with significant Internet traffic and the organizations involved in the FENIX security project.”

Operation of the DNS system in the Czech national domain

The continuous operation of the DNS system in the .CZ domain is ensured by a system of authoritative DNS servers, the so-called DNS anycast. It is a set of name servers that, in order to ensure high availability, are established and being operated from three locations in the Czech Republic and another eight in Europe, North and South Americas and Asia. As part of the strategy for increasing the security of operation of the Czech national domain, the CZ.NIC Association is currently extending the DNS anycast to include more nodes located in the networks of Internet service providers, especially in networks of access providers. These DNS instances route the selected anycast prefix from DNS anycasts of the CZ.NIC Association only to a specific provider’s network.

Everyone wins

The main advantage of running such a DNS instance from the perspective of the Internet service provider is, above all, full DNS availability, even in the event of an attack on a public DNS anycast. A user of the network using the ISP DNS stack is not in any way affected by such an attack and the DNS service is fully available to them. The anycast design leads to a higher network throughput and faster query responses for the users of the network of the service provider with the installed ISP DNS stack.

The advantage for the CZ.NIC Association is that if an attack on the DNS is performed from the internal network of the Internet service provider, the attack will be terminated on this DNS instance. The attack’s impact would not spread, which means that the public authoritative DNS servers would not be affected. This enables the Internet service provider to immediately respond and deal with the attack.