Skip to main content
Coplango
Request a BGP and peering review

Case study

DNS filtering at about 63,000 queries a second

An ISP needed to block malware domains and apply required blocklists on its resolvers, and see what was being queried, without slowing subscribers down.

Summary

  1. The problem

    The ISP had to block malware and phishing domains and apply blocklists it was required to enforce, on resolvers that answer every subscriber’s queries, and it had no view of what was being queried or blocked.

  2. What we did

    Built a platform around Knot Resolver: a policy module that checks each query against threat and category lists held in memory-mapped databases, list sync with incremental zone updates, query logs streamed through a message queue into a column store, and a web console for policies, lists and analytics. Deployed on an anycast pair of resolvers.

  3. Outcome

    In production on two anycast resolvers at about 63,000 queries per second, with a 79% cache hit rate and blocking and query logging on both.

In more detail

How Nameward handles a DNS queryA subscriber’s query reaches your resolver, which checks the name against local threat and category lists. Allowed names are answered as usual; blocked names get the response your policy defines. Every query and decision goes to the query log.SubscribersResolverAnsweredBlockedQuery log
  • Allowed queries
  • Blocked queries
  • Stopped by your policy

Fast enough to forget about

Filtering on the resolver only works if subscribers never notice it. The lists live in memory-mapped databases next to each resolver process, so a lookup is a local read, and list updates arrive as incremental changes rather than full reloads.

Seeing what happens

Every query can be logged from the resolver’s dnstap stream, through a message queue, into a column store where it stays searchable. The console’s analytics and the anomaly detection both read from there.

This platform is now a Coplango product: see Nameward.

Start with the review.

Configs and two weeks of flow data are enough for us to tell you what we’d change first.

Request a BGP and peering review