Why a New DNS Server?
Upon seeing this book, the first question that might occur to you is, Why does the world need another DNS server? There are, after all, lots of implementations of DNS servers to choose from. For starters, theres BIND, for Berkeley Internet Name Domain, the granddaddy of DNS servers. BIND has been around in some incarnation since the 1980s and supports just about every DNS standard written. Theres Microsofts DNS Server, which is widely used in Active Directory environments. NSD from NLnet Labs and Knot are excellent authoritative DNS servers, and Unbound, also from NLnet Labs, is a fast, lean recursive DNS server. So what does CoreDNS offer that these others dont?
To begin with, CoreDNS is written in Go, and Go is a memory-safe programming language. Why is that important? Well, if youve ever run a BIND-based DNS infrastructure and had to upgrade 100 DNS servers ASAP because of a buffer overrun, you know. A healthy proportion of vulnerabilities in DNS servers of all stripes (at least those written in C and C++) stem from buffer overflows or overruns and dangling pointers. Written in memory-safe Go, CoreDNS isnt subject to these.
Programs written in Go can also support concurrency, or parallel execution. This can be useful in wringing more performance out of multiprocessing or multitasking systems. BINDs performance somewhat notoriously doesnt scale well on multiprocessor systems, whereas CoreDNSs performance scales nicely the more processors it has to work with.
Improving performance can be important because Go tends to run somewhat more slowly than C or C++, partly thanks to the overhead imposed by its many features. In most cases, however, this isnt an issue: Whats important is that CoreDNS performs well enough to handle the workload you offer it, and in the vast majority of cases, it does, Go or no Go.
Probably the most significant capability CoreDNS offers, though, is its ability to communicate with container infrastructure and orchestration systems such as etcd and Kubernetes.
Who Needs CoreDNS?
The short answer: basically anyone running Kubernetes, and most folks running containerized applications.
The function CoreDNS fulfills in a containerized environment is that of a service directory, which we talk about in detail in this book. A service directory helps containers determine the IP address or IP addresses where the containers that offer a particular service are running. For example, a container might look up a domain name that represents the database service for a specified application in order to retrieve some data. The service directory function is critical because, in the world of containers and microservices, applications are usually decomposed into many small services (hence, microservices!), and each service might be offered by several containers, each running at a different IP address.
But CoreDNSs utility isnt limited to containerized environments. CoreDNSs plug-ins support advanced DNS functionality that even the big boys like BIND dont support. You can rewrite queries and responses on the fly, for example. You can automatically load zone data from GitHub or Amazon Route 53. And because CoreDNS itself is small and usually runs in a container, its suitable for use in scenarios in which a big DNS server such as BIND would not be.
Who This Book Is For
This book is aimed at the following audiences:
- Administrators of containerized environments that need DNS-based service discovery, particularly when those environments are managed by Kubernetes.
- DNS administrators looking for a small, flexible DNS server that can run in a container.
- DNS administrators looking for a DNS server that
- Integrates with Route 53
- Supports flexible rewriting of queries and responses