This past month Amazon sent me an early Christmas present, their very own content deliver network (CDN). Adding to their already robust line of “cloud” offerings, Amazon Cloudfront brings edge server routing to the mix. I have been using Amazon S3 for static content delivery since my most recent hello world. Cloudfront takes the highly scalable and redundant S3 and puts it closer to the end user, thus distributing throughput and reducing latency.

When it comes to web development, one of my driving forces is performance. I love seeking out and shaving milliseconds off page loads and network requests. One of the best ways to do this is to put the content as close to the source as possible. Content Delivery Networks do just that. If my viewers are in Asia, I don’t want my server in New York and vise versa. With a CDN data is cached at several geographically optimized locations as needed. When a request comes in, it is routed to the nearest location.

The quickest route to the Jungle

A good tool to analyze network routing, latency and a bunch of other stuff is pingplotter. They have a free version and pro version. The free version works great for my purposes. Internet Control Message Protocol (ICMP) Pings are a lightweight and predictable way to provide insight on latency and network conditions. Here is a comparison of my routes between Amazon Cloudfront and my standard web server.

As you can see, with Cloudfront I scream right to Amazons Newark, NJ server as apposed to going through McClean, VA, then ATL, and finally to my server in Dallas, TX.

How Cloudfront performs in the CDN storm

Pingplotter works great to determine *your* route and latency.

Just-ping.com provides a great way to test your host/cdn from many geographic locations at once.

Disclaimer: The below analysis was put together to illustrate a general concept. Accuracy and real world conditions will vary.

.	Geographic Location	Single Web Server	Amazon Cloudfront	Akamai	LimeLight

. Florida, U.S.A. 34.4 29.4 36.5 36.9 . Chicago, U.S.A. 34.5 6.6 19 1.3 . San Francisco, U.S.A. 43.6 2.2 3.6 2 . New York, U.S.A. 43.9 5 8.9 6.6 . Santa Clara, U.S.A. 47.1 3.9 2.8 6.9 . Vancouver, Canada 73 52 4.5 95.6 . Austin1, U.S.A. 102.4 38.1 5.2 76.3 . Austin, U.S.A. 102.7 38.1 5.3 76.4 . London, United Kingdom 108 13.2 1.8 1.6 . Amsterdam3, Netherlands 114.3 19.9 0.7 7.4 . Amsterdam2, Netherlands 115.8 20.6 1.5 8.1 . Amsterdam, Netherlands 118.6 0.9 0.5 0.7 . Lille, France 120.3 12.9 14.2 110.9 . Munchen, Germany 129.1 7.6 10.2 7.7 . Zurich, Switzerland 130.8 10.6 2.8 25.7 . Cologne, Germany 131.8 9 5 20.4 . Groningen, Netherlands 133 4.3 5.7 4.3 . Copenhagen, Denmark 137.9 15.6 4.1 25.3 . Antwerp, Belgium 139.7 5.5 4.2 4.4 . Stockholm, Sweden 142 32.7 5 23.6

. Madrid, Spain 142.4 45.2 2.5 25.1 . Paris, France 149.9 8.3 17.5 1.4 . Cagliari, Italy 165.5 30.1 29.5 30.4 . Auckland, New Zealand 173.7 159.8 1.1 161.4 . Krakow, Poland 174.1 31 8.8 43.6 . Haifa, Israel 177.9 78.1 0.5 64.5 . Porto Alegre, Brazil 179.1 149.9 30.2 169.9 . Nagano, Japan 185.8 4.8 13.1 4.7 . Sydney, Australia 204.8 159.2 3.3 166.2 . Hong Kong, China 206.8 2.3 2.2 65.6 . Melbourne, Australia 207.6 177.9 1.7 166.6 . Singapore, Singapore 238.7 137.1 13.3 3.5 . Shanghai, China 249.1 153.5 308.3 87 . Mumbai, India 280.3 259.1 1.6 263.5 . Johannesburg, South Africa 304.8 293.2 19.3 274.7 . Average (miliseconds) 144.1 57.65 16.98 59.15

Setting up and configuring Amazon Cloudfront

Setup was super easy with the latest S3 Organizer Firefox Add-on. You can also complete the setup with a Curl Script.

“A study conducted by IDC determined that only 41% of small companies and 35% of large organizations monitor Internet DNS response times.”

“DNS failures account for as much as 29% of system downtime costing companies millions of dollars.”

The Domain Name System (DNS) is arguably the single most important part of the internet. Just think: If websites only had a numerical lookup… our Rolodex’s would be massively confusing. Why don’t webmasters/hosts treat DNS with the same priority? DNS servers carry such a high importance. Without them, no internet. They are often the target of massive Distributed Denial of Service (DDOS) attacks. Are your DNS records configured properly and secure?

DNS Performance & Security Enhancements

Most of the Internet is run on Berkeley Internet Name Domain (BIND) based servers. There have been a lot of failed attempts to create a BIND alternative (GnuDIP, MooDNS, Dents, OakDNS, CustomDNS and dproxy). A couple of active projects are PowerDNS, NSD, djdns and MaraDNS. All boast better security and performance improvements in different environments. If you are hosting your own DNS, you owe it to yourself/network to review your options.

Another performance and security innovation that is becoming increasing popular across many stateless services on the internet is IP anycast networks. It is a network addressing and routing scheme where data is routed to the nearest or best destination. It helps provide higher availability and load balancing. Many of the TLD servers name servers are already running on anycast networks. In fact these servers survived the massive DDOS attack last year. UtraDNS, Netriplex and DNS Made Easy are among the few providers to deliver DNS over an anycast network. I imagine many more fill follow suit.

Minimizing down-time with TTL

Most of us have been effected by DNS outages. There is not much you can do when a record gets out of whack or a server goes down. You can flush your local cache, maybe even try to resolve against a different server, but the only real cure is time. That is because each DNS record has a setting called Time to Live (TTL). This is how long the record should persist. Once this time expires, a new record is fetched. Also, if the servers aren’t available, you don’t get a record.

A good rule of thumb when setting your TTL is to use your average visitor time. For example, if the average visitor spends five minutes on your site (check your analytics), you should set your TTL to 300 (in seconds). The idea is; in the event of a failover, it has the least impact on visitors and doesn’t require a performance hit for numerous DNS lookups. Some DNS providers won’t allow a TTL setting this low. A lower TTL mean more DNS queries and ultimately more expense.

Should I outsource my DNS?

A lot of network architects will actually advise webmasters to host their own DNS records. The route/latency will be the same as HTTP traffic, thus making lookup time approximately the same as a web requests. It also reduces the risk of outages caused solely by DNS. If they are hosted on the same subnet, routing glitches are minimized. If they are on the same server as your website, it will even further reduce the risk of DNS only outages.

However, if you don’t have the time/experience to monitor, review logs and maintain your DNS servers, outsourcing is a great option. But beware, all DNS networks/servers are not created equally. If you are hosting your records with a budget registrar, chances are you are at risk. They are often the target of DDOS attacks, endure lengthy outages/maintenance and have congested networks. Security by obscurity; in the last two years I have had clients with DNS outages lasting greater than 6 hours at two of the major registrars.

The Cadillac of DNS currently is NeuStar’s UltraDNS. They have a globally redundant/optimized network with proprietary DNS software powered by Oracle replication. However, they charge by the query, so if you have a busy site, it will get expensive in a hurry. Another high-end service is Netriplex. For small to mid size company’s the only way to afford either of these services is to increase unfortunately to your TTL.

The best budget priced service with high-end features/support I have found so far is DNS Made Easy. They have a great feature-set, excellent and knowledgeable staff all at a great price.

Search Engine Optimization (SEO)

There have been reports of falling Search Engine Results Placements (SERPs) taking drastic drops soon after a DNS change. Changing just the IP address has not caused any notable problems. It is domain contact and name server changes that have have caused the speculation. Many claim it resets the sites Google “trust points”. There are many influences on SERPs and SEO is always a moving target, so take this warning with a grain for salt. But I thought it was worth mentioning.

For More Information

DNS Wiki – http://en.wikipedia.org/wiki/Domain_name_system
DNS Forum – http://member.dnsstuff.com/forums/
Web-based DNS Tools – http://www.dnstools.com/
DNS Surveys – http://www.seoconsultants.com/tools/dns/surveys/