DNS & Content Delivery Networks

Modern CDNs (Cloudflare Workers, Lambda@Edge) run computation at edge nodes — you can cache personalized responses, A/B test at the edge, rewrite URLs, add security headers, even query edge databases (Cloudflare D1, KV). For truly dynamic content, CDNs still help by: (1) terminating TLS close to users (~100ms RTT saved), (2) keeping persistent keep-alive connections to origin (avoiding a TCP handshake per request), (3) absorbing DDoS before it hits origin.

Pull CDN: the edge fetches from origin on first miss, caches per TTL. Zero configuration, works for any traffic pattern, but the first user to request new content gets origin latency. Best for high-traffic sites where the cache-fill cost is amortized. Push CDN: you proactively upload content to CDN nodes. Full control, no origin hits — but you must manage what's on the CDN. Best for predictable content (software downloads, game patches) and low-traffic sites where pull would rarely hit cache anyway.

With Route 53 failover routing: set a health check on the primary endpoint. If the primary fails the health check, Route 53 automatically returns the secondary IP instead. With a low TTL (60s), most clients see the new IP within a minute. The TTL must be short enough for fast failover — but that means more queries: a classic trade-off. For critical services, combine latency + failover routing: normally go to the nearest healthy region, fail over to the next-nearest if that region dies.

DNS resolution converts a domain name (e.g., www.example.com) into an IP address through these steps:

1. User Query — The user types a domain into a browser.

2. Browser Cache Check — The browser checks its local cache for a stored IP.

3. OS Cache Check — If not in the browser cache, the OS DNS resolver is queried.

4. Local DNS Resolver — If the OS doesn't have it, the query goes to the ISP-provided resolver.

5. Root DNS Servers — If uncached, the resolver queries one of the 13 root DNS servers.

6. TLD Server Query — The root server directs to the TLD server (e.g., .com, .org).

7. Authoritative DNS Server — The TLD server provides the authoritative DNS server's address.

8. IP Address Retrieval — The authoritative server responds with the correct IP.

9. Response Caching — The resolver caches the result for future queries.

10. Website Access — The browser connects to the web server using the IP.

Recursive DNS Server: Acts as an intermediary between the user and other DNS servers. It performs the full DNS lookup process on behalf of the client. Typically provided by ISPs or third-party DNS providers (e.g., Google Public DNS 8.8.8.8, Cloudflare 1.1.1.1).

Authoritative DNS Server: Stores actual DNS records (A, CNAME, MX, etc.) for a domain. It provides the final, definitive answer in the DNS resolution process and is managed by domain owners or hosting providers.

In short: recursive servers fetch data, while authoritative servers store and provide the definitive DNS records.

DNS caching reduces lookup latency by storing previously retrieved DNS results. Benefits:

Reducing latency — Eliminates repeated queries for frequently accessed websites.

Lower DNS server load — Fewer queries reach upstream DNS servers.

Better user experience — Websites load faster when queries resolve locally.

Caching occurs at three levels: Browser Cache (stores responses for recently visited sites), OS Cache (maintains a local DNS cache for frequently accessed domains), and Recursive Resolver Cache (ISP resolvers cache responses to serve many users efficiently).

TTL (Time-To-Live) is a setting in DNS records that defines how long a record is valid before it must be refreshed.

Short TTL (e.g., 60 seconds) — Ensures frequent updates but increases query load on DNS servers.

Long TTL (e.g., 24 hours) — Reduces query frequency but delays propagation of changes (e.g., IP migrations).

TTL balances performance and accuracy. Always reduce TTL well before planned IP migrations, then restore it afterward.

DNS-based load balancing distributes traffic across multiple servers by returning different IP addresses for the same domain:

Round-Robin DNS — Each DNS query gets a different server IP in a rotating order.

Geolocation-based Routing — Directs users to the closest data center to minimize latency.

Failover DNS — If a server fails, the DNS resolver removes it from the list and redirects traffic to healthy servers.

Anycast DNS — Uses the same IP address across multiple locations, routing requests to the nearest server.

This approach improves reliability, availability, and performance in large-scale applications.

DNS Spoofing / Cache Poisoning — Attackers inject false DNS records, redirecting users to malicious websites. Mitigation: Use DNSSEC to verify DNS records.

DDoS Attacks on DNS Servers — Attackers overload DNS servers with traffic, making domains unreachable. Mitigation: Rate limiting, Anycast DNS, and load balancing.

Man-in-the-Middle Attacks — Intercept DNS queries to manipulate responses. Mitigation: Use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT).

NXDOMAIN Attack — Floods DNS resolvers with queries for non-existent domains. Mitigation: Deploy response rate limiting (RRL) and DNS firewalls.

A Content Delivery Network (CDN) is a distributed network of servers that deliver content to users efficiently. The primary goal is to reduce latency by caching content at multiple geographically distributed edge servers (PoPs — Points of Presence).

How it works: (1) A user requests content. (2) The request is routed to the nearest CDN edge server based on geographic location, network latency, and server load. (3) If cached (Cache Hit), content is served instantly. (4) If not cached (Cache Miss), the edge fetches from the origin server, stores it, then serves it.

Without a CDN, content is served directly from the origin server, leading to:

High latency due to geographic distance between user and server.

Overloaded origin servers, causing slower responses and downtime.

Bandwidth constraints leading to slow page loads and higher costs.

Security risks including DDoS attacks and malicious traffic.

CDNs solve these by distributing traffic across edge locations, caching frequently accessed content, and protecting against cyber threats.

Reduced Latency — Faster content delivery by serving from the closest PoP.

Lower Bandwidth Costs — Caching reduces requests to the origin, minimizing data transfer costs.

Increased Availability & Load Balancing — Distributes traffic across multiple servers, preventing overload.

Enhanced Security — Protects against DDoS attacks, traffic filtering, and SSL/TLS encryption at the edge.

Origin Server: The central server that hosts the original content. It is responsible for serving content when a cache miss occurs.

Edge Server (PoP): A geographically distributed server that caches content closer to users to reduce latency.

Analogy: The origin server is like a main warehouse, while edge servers are local distribution centers that store frequently accessed goods.

A PoP (Point of Presence) is a CDN data center that contains edge servers to store and serve cached content to users. The more PoPs a CDN has, the faster and more reliable the content delivery.

CDNs use various routing strategies to direct user requests to the optimal edge server:

Geo-Based Routing — Users are directed to the closest PoP.

Latency-Based Routing — Requests go to the PoP with the lowest network latency.

Load-Aware Routing — Traffic is balanced across multiple PoPs to prevent overload.

Cache Hit: The requested content is found in the CDN cache and served immediately — fast and cheap.

Cache Miss: The content is not in the cache, so it is fetched from the origin server, stored at the edge, and then served to the user. Slower on first request, but cached for subsequent users.

Manual Purge — Manually removes outdated content from CDN caches immediately.

Stale-While-Revalidate — Serves stale content while fetching fresh content in the background.

Versioning — Appends version numbers (e.g., image_v2.png) to URLs to force cache updates without purging.

Cache invalidation is critical to ensure users receive updated content without waiting for TTL to expire.

CDNs distribute traffic across multiple PoPs using round-robin balancing, latency-based routing, and geo-based routing. If a CDN PoP fails, the CDN automatically reroutes traffic to the next best PoP, ensuring uninterrupted service.

Gzip & Brotli Compression — Reduces file size for transmission.

Minification of CSS/JS — Removes unnecessary characters (whitespace, comments) to reduce file size.

Image Optimization — Converts images to modern formats like WebP and AVIF for better compression.

Rate Limiting — Blocks excessive requests from a single source.

Traffic Filtering — Identifies and drops malicious requests before they reach the origin.

Anycast Routing — Distributes attack traffic across multiple PoPs to absorb the impact, preventing any single location from being overwhelmed.

SSL/TLS offloading means the CDN handles encryption/decryption at the edge, reducing the computational burden on the origin server. Benefits include: reduced origin CPU load, faster response times, and centralized certificate management at the edge.

A multi-CDN strategy uses multiple CDN providers simultaneously for better redundancy, performance, and failover handling. If one CDN provider experiences an outage or poor performance in a region, traffic is automatically routed to an alternate CDN. This is used by large platforms like Netflix and Cloudflare to guarantee uptime.

Segmented Caching — Store different video chunks (segments) at different PoPs based on popularity.

Adaptive Bitrate Streaming — Adjusts video quality dynamically based on the user's available bandwidth.

Load Balancing — Distributes viewers across multiple edge servers to prevent overload.

Multi-CDN — Use multiple CDN providers for geographic coverage and failover.

Example: Netflix uses its Open Connect CDN with custom edge servers placed inside ISP networks to minimize last-mile latency.