ISP Location in DNS Queries

3.1. Client

Common clients have little power to defense passive monitoring, expecially in the plain-text traffic.¶

ECS's client subnet leakage has rise some user privacy concerns.¶

3.2. Recursive Resolver

Recursive resolver must deal with ECS's cache problem, such as low cache hitrate, rise response time, redundant cache size, etc.¶

Mukund Sivaraman described some scenarios in [ClientSubnet-Bis].¶

ECS is precise because it is based on client subnet. But IPv6 addresses will boom, we can foresee it to increase more burden on global recursive resolvers.¶

3.3. GeoIP-enabled Authoritative Server

Tranditional recursive resolver's IP can on behalf of many client subnets because they are network topological close. But this scenario has been varied by public recursive resolver. ECS push client subnets to authoritative server, wants to solve the "public recursive resolver's IP is network topological far from client subnet" problem.¶

Therefore, ECS rises GeoIP-enabled authoritative server's dependence on IP2Geo database quality, because authoritative server should guess geolocation for huge amounts of client subnet. Every GeoIP-enabled authoritative server must operate IP2Geo database carefully and catch up with network topology change. The work is inevitable, but ECS aggravate this, because the number of client subnets is far greater than the number of recursive resolvers. GeoIP-enabled authoritative server needs a more precise IP2Geo database, updates it more frequent than before, to catch up with the huge client subnet network topology, but not the recursive resolver's IP network topology. Every GeoIP-enabled authoritative server should cost more on IP2Geo database.¶

4.1. The EIL EDNS0 option

The EIL is an EDNS0 option to include the < COUNTRY, AREA, ISP > isp location of client in DNS messages.¶

It is 16 octets which is structured as follows:¶

                +0 (MSB)                            +1 (LSB)
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   0: |                         OPTION-CODE                           |
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   2: |                         OPTION-LENGTH                         |
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   4: |                         COUNTRY                               |
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   6: |                         AREA                                  |
      |                                                               |
      |                                                               |
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
  12: |                         ISP                                   |
      |                                                               |
      +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+

      Total: 16 octets.

• OPTION-CODE, 2 octets, defined in [RFC6891]. EDNS option code should be assigned by the IANA.¶

• OPTION-LENGTH, 2 octets, defined in [RFC6891], contains the length of the payload (everything after OPTION-LENGTH) in octets.¶

• COUNTRY, 2 octets, uppercase, defined in [ISO3166], indicates the country information of the client's IP. For example, China's COUNTRY is CN.¶

• AREA, 6 octets, uppercase, defined in [ISO3166] country subdivision code, indicates the area information of the client's IP. For example, The AREA of Fujian Province in China is 35.¶

• ISP, 4 octets, uppercase, indicates the ISP information of the client's IP, using shortcut names. ISP shortcut names are unique within the context of the COUNTRY. For example, the shortcut name of China Telecommunications Corporation is TEL, the shortcut name of China United Network Communications is UNI, the shortcut name of China Mobile is MOB, etc.¶

All fields are in network byte order ("big-endian", per [RFC1700], Data Notation).¶

The aim to use shortcut names in the ISP field is to limit the data size of EIL, decrease the DDoS risk.¶

The null value 0x20 signifies that the field is unknown. If all fields in EIL are set to null value, it means that client doesn't want to use EIL.¶

Authoritative servers can send EIL response with the * value 0x2A in AREA field or ISP field (not COUNTRY field), which signifies that the field is wildcard match. For example, < CN, *, TEL > indicates "all area in China, Telecom ISP", < CN, *, * > indicates "all area in China".¶

5.1. Originating the Option

The EIL can be initialized by public recursive resolver, ISP recursive resolver, or local forwarding resolver.¶

Examples are given in Appendix B.¶

5.2. Generating a Response

5.3. Handling EIL Responses and Caching

If an intermediate nameserver had sent a query with EIL, and receives a NOERROR response without EIL option, it SHOULD treat this answer as suitable for all clients.¶

Other handling considerations are similar with [RFC7871], SECTION 7.3.¶

In the cache, all resource records in the answer section MUST be tied to the isp location specified in the response. The answer section is valid for all areas which the EIL option covered. For example, an EIL option < CN, 35, TEL > covers all 9 cities in Fujian province of China Telecommunications ISP.¶

Same with ECS, the additional and authority sections are excluded.¶

Enabling support for EIL in an intermediate nameserver will increase the size of the cache, and prevent "client subnet leak" privacy concern of ECS.¶

5.4. Deploy

Receive EIL query:
    Search in EIL cache.
    If cache is matched, return EIL response.
    Otherwise,
        Send EIL query.

Receive ECS query:
    Search in ECS cache.
    If cache is matched, return ECS response.
    Otherwise,
        Send ECS query.

Receive plain DNS query without EDNS option:
    Search in ECS cache.
    If cache is matched, return ECS response.
    Otherwise,
        Guess the isp location information of the client's IP,
        Search in EIL cache.
        If cache is matched, return EIL response.
        Otherwise,
            Send EIL query.
            If authoritative server supports EIL, return EIL response.
            Otherwise,
                Send ECS query.
                If authoritative server supports ECS, return ECS response.
                Otherwise,
                    Send plain DNS query.


Receive plain DNS query with not-ECS/not-EIL option:
    Search in not-EDNS cache.
    If cache is matched, return response.
    Otherwise,
        Send plain DNS query.

Receive ECS query, improve user privacy with EIL:
    Guess the isp location information of the client's IP,
    Search in EIL cache.
    If cache is matched, return EIL response RR with origin ECS option.
    Otherwise,
         Send EIL query.

5.5. Why not use AS number to build EIL

AS number is not an ideal object to balance between response accuracy and user privacy, for example:¶

• User privacy: AS24151 can directly guide to China Internet Network Infomation Center, it is not good for user privacy.¶

• Response accurancy: AS4134 contains a huge amount of IP prefixes whose geolocation covers from South China to North China, AS number can not afford the response accuracy consideration.¶

Maybe < COUNTRY-CODE, AREA-CODE, ISP, AS-NUMBER > is a considerable trade-off choice.¶

6.1. Client

EIL is transparent to client.¶

EIL is to help mitigate client subnet leakage on the resolution path, improve user privacy.¶

6.2. Recursive Resolver

ECS sends the query with client subnet, which means that recursive resolvers have to send a new query to authoritative servers with client_subnet_b, even it has known the response about network topological close client_subnet_a. In fact, thousands of subnets visit only a few servers, there are many redundacy queries, the recursive's cache hitrate is low.¶

Because of ECS's low cache hitrate, recursive resolvers's ECS tailored response latency will be longer, the average of response time will rise with the redundacy queries rate from recursive resolvers to authoritative servers.¶

Recursive resolver's ECS cache size grows up with the number of client subnets, see also [EIL-Qshine] and [EIL-PST].¶

To sum it up, above problems all rise with the client subnet amount, especially when IPv6 addresses boom. Extend the subnet range in the ECS response may be mitigating, but not work for wide range client subnets. Recursive can make some guess optimization, if it has known response for client_subnet_a, then guess to return the same response for toplogical close client_subnet_b without send the redundancy query.¶

Therefore, if the ECS revision wants to make more effective client subnets aggregation for recursive resolver, then EIL can be an considerable choice. EIL wants to summary network toplogical close client subnets into < COUNTRY, AREA, ISP > for GeoIP-enabled authoritative server. With EIL response cache, recursive resolvers can directly response for many ECS client subnets queries, which will rise cache hitrate and reduce response latency. The cache size of EIL is related to the row count in the < COUNTRY, AREA, ISP > isp location whitelist. Therefore, under IPv6 environment, the cache size of EIL will be much smaller than ECS.¶

Note that, the EIL's IP2Geo mapping work will make recursive resolver to more computational cost.¶

6.3. GeoIP-enabled Authoritative Server

Client subnet is the best factor if the company has good network topology monitor ability, offen is for big company. However, for many authoritative servers that only deployed GeoDNS, the accuracy limitation is commonly because of the IP2Geo database quality, and the small ISPs change to another next-hop big ISP suddenly.¶

For the GeoIP-enabled authoritative server, the response accurancy depends on the IP geolocation database quality. If authoritative server can not find approximate isp location of ECS's client subnet, they can not return best tailored response.¶

Even though GeoIP-enabled authoritative servers know about the precise isp location of ECS's client subnet, they may not know about the latest toplogical path change of the isp to update the tailored response in time. In the case of "small ISP -> big ISP (change frequency) -> ... -> website", both small ISP's client ip/resolver ip is not good factor for GeoDNS. Big companies work hard to catch up with the client ip's connect topology change, and adjust their authoritative servers' tailored response, but smaller companies only deploy IP2Geo may not afford.¶

EIL wants to give downstream a chance to tell authoritative server its best path quickly and proactively, help to rise the response accuracy, avoid cross-isp visit, save IP transit cost for Data Provider. EIL directly provide sufficient information for the GeoIP-enabled authoritative server. Compared to ECS, EIL can reduce GeoIP-enabled authoritative server's dependence on the IP geolocation database quality.¶

7.1. DNSSEC

EIL is not signed.¶

7.2. Privacy

The biggest privacy concern on ECS is that client subnet information is personally identifiable. The more domains publish their zones on a third-party authoritative server, the more end user privacy information can be gathered by the authoritative server according to the ECS queries.¶

EIL is to improve user privacy which is inspired by ECS, prevented leaks in the client subnet information.¶

Like ECS, EIL will leak the global zonefile configurations of the authoritative servers more easily than normal case.¶

7.3. Target Censorship

DNS traffic is plain text by default. It is easily to be blocked or poisoned by internet target censorship. To bypass the censorship, it is better to encrypt the DNS traffic or use some proxy tunnel.¶

EIL's isp location information covers bigger area than ECS's client subnet information. Therefore, compared to ECS in plain text condition, EIL is weaker at blocking record attack, but stronger at targeted DNS poisoning attack.¶

7.4. DDoS

To migrate the DDoS problem:¶

• If an Authority Server receives a DNS query with unknown data in EIL option, it SHOULD return the default response whose EIL option with null value.¶

• Nameservers OPTIONAL only implement EIL when the query is from a TCP connection.¶

More migration techniques described in [RFC7871], Section 11.3.¶

10.1. BIND

As described in [BIND-GeoIP], BIND 9.10 is able to use data from MaxMind GeoIP databases to achieve restrictions based on the (presumed) geographic location of that address. The ACL itself is still address-based, but the GeoIP-based specification mechanisms can easily populate an ACL with addresses in a certain geographic location.¶

acl "example" {
  geoip country US;
  geoip region CA;
  geoip city "Redwood City"; /* names, etc., must be quoted if they contain spaces */
};

10.2. PowerDNS

As described in [PowerDNS-GeoIP], PowerDNS supports many geolocation placeholders, such as %co = 3-letter country, %cn = continent, %re = region, %ci = city.¶

domains:
- domain: geo.example.com
  ttl: 30
  records:
    geo.example.com:
      - soa: ns1.example.com hostmaster.example.com 2014090125 7200 3600 1209600 3600
      - ns:
           content: ns1.example.com
           ttl: 600
      - ns: ns2.example.com
      - mx: 10 mx.example.com
    fin.eu.service.geo.example.com:
      - a: 192.0.2.2
      - txt: hello world
      - aaaa: 2001:DB8::12:34DE:3
    # this will result first record being handed out 30% of time
    swe.eu.service.geo.example.com:
      - a:
           content: 192.0.2.3
           weight: 50
      - a: 192.0.2.4
  services:
    # syntax 1
    service.geo.example.com: '%co.%cn.service.geo.example.com'
    # syntax 2
    service.geo.example.com: [ '%co.%cn.service.geo.example.com',
                                        '%cn.service.geo.example.com']
    # alternative syntax
  services:
    service.geo.example.com:
      default: [ '%co.%cn.service.geo.example.com', '%cn.service.geo.example.com' ]
      10.0.0.0/8: 'internal.service.geo.example.com'

10.3. Amazon

As described in [Amazon-GeoIP], Amazon Route 53 lets you choose the resources that serve your traffic based on the geographic location of your users, meaning the location that DNS queries originate from. It allows you to route some queries for a continent to one resource and to route queries for selected countries on that continent to a different resource.¶

When a browser or other viewer uses a DNS resolver that does support edns-client-subnet, the DNS resolver sends Amazon Route 53 a truncated version of the client's IP address. Amazon Route 53 determines the location of the user based on the truncated IP address rather than the source IP address of the DNS resolver; this typically provides a more accurate estimate of the client's location. Amazon Route 53 then responds to geolocation queries with the DNS record for the client's location.¶

10.4. DYN

As described in [DYN-GeoIP], Dyn provides the ability to control DNS responses on a granular/customized geographical rule set. Part of the rulesets will be the identification of the global regions, countries, or states and provinces that use a specific DNS server group. DYN uses the ECS information for the geolocation lookup. Once a geolocation is found and a response is selected, it will provide a DNS response back to the source IP address.¶

10.5. gdnsd

As described in [gdnsd-GeoIP], gdnsd uses MaxMind's GeoIP binary databases to map address and CNAME results based on geography and monitored service availability. gdnsd supports geolocation codes, such as continent, country, region/subdivision, city.¶

10.6. Windows Server

As described in [WindowsServer-GeoIP], Windows server can be configured DNS Policy to respond to DNS client queries based on the geographical location of both the client and the resource to which the client is attempting to connect, providing the client with the IP address of the closest resource.¶

11.1. P-Model

Stub DNS
-> local forwarding resolver (61.48.7.2)
-> Public Forwarding Resolver(AliDNS, 223.5.5.5)
-> Public recursive resolver(AliDNS, 202.108.250.231)
-> authoritative server

Public Forwarding Resolver 223.5.5.5 could enable EIL and generate the EIL OPT data < CN, 11, UNI > based on 61.48.7.2.¶

P-Model will not leak client subnet to authoritative server.¶

11.2. I-Model

Stub DNS
-> local forwarding resolver
-> ISP Forwarding Resolver(202.106.196.115)
-> ISP recursive resolver(61.135.23.92)
-> authoritative server

ISP recursive resolver 61.135.23.92 could enable EIL and generate the EIL OPT data < CN, 11, UNI > based on 61.135.23.92.¶

If authoritative server doesn't know much about 61.135.23.92, EIL will be helpful.¶

ISP recursive resolver generates static EIL query, simply manages response cache as tranditionl non-ECS/non-EIL scenario.¶

EIL helps ISP recursive resolver to give upstream an explicit correct isp location information.¶

11.3. L-Model

Stub DNS
-> Local Fowarding Resolver(58.60.109.234)
-> ...
-> authoritative server

Local Fowarding Resolver 58.60.109.234 could enable EIL and generate the option data is < CN, 44, TEL > based on 58.60.109.234.¶

L-Model can give the most precisely isp location information for DNS resolution.¶

12.1. Public Recursive Resolver with non-ECS Authoritative Server

If authoritative server doesn't support ECS, the clients that use public recursive resolver(such as 8.8.8.8) may receive disaster latency IP.¶

In this scenario, we must pray that public recursive resolver's IP is network topological close to client's IP.¶

12.2. IP2Geo Database Quality

If authoritative server's IP2Geo database misidentify client IP's information, then the client may be assigned to some high letency cross-isp IP address.¶

With EIL, public recursive resolver and ISP recursive resolver can help to give more precise information for GeoIP-enabled authoritative servers.¶

12.3. Unstable ISP Network Topology

Some small ISPs may change their upstreams frequently. authoritative servers offen can not catch up the variation in time.¶

EIL gives downstream a chance to proactively tell authoritative servers the latest best topological close response itself wants now. Downstream can assure itself has got explicit tailored response with EIL.¶

For example, 218.247.200.100's isp location information is < China, Beijing, PengBoShi >. In I-Model, PengBoShi's resolver can send EIL < CN, 11, TEL > to authoritative servers, indicates that the best topological close response forclient 218.247.200.100 is from China Beijing Telecom.¶