Edgium / DNS Firewall
DNS Firewall for providers: zones stay on your server, DDoS attacks stay at the edge
Your authoritative DNS stays with you, with all your customers' zones exactly as they are. Edgium answers in front of it, on an anycast network with points in Brazil and abroad, and lets through only real queries. It suits internet providers, hosting companies and businesses that run their own DNS.
A virtual DNS in front of yours
The addresses of your nameservers are announced by the Edgium network. A legitimate query is passed to your server, and the answer goes back to whoever asked. With more than one server, Edgium spreads the queries across them, like a DNS load balancer. An attack query stops at the first network point it meets.
- legitimate query
- pass-through to your server and answer
- answer delivered
- attack blocked at the firewall
Swipe sideways to see the whole animation.
Which DNS attacks it protects against
The DDoS attacks that take down provider DNS most often are not big. They are queries that no cache holds and that make the server work on every single one.
Random subdomain
Thousands of names that do not exist, such as x7k2q.customer.com, meant to exhaust the authoritative server. The firewall recognizes the pattern and limits it.
NXDOMAIN floods
A separate limit for nonexistent-domain responses, apart from normal traffic, so the attack does not take down the users who ask correctly.
Empty and malformed queries
Packets with no valid question stop at the edge and never reach your server.
ANY queries blocked
The ANY query, used to amplify attacks, is refused. Your DNS stops being a weapon against third parties.
Custom per-second limits (rate limit)
Total queries, NXDOMAIN responses and SERVFAIL responses, each with a limit tuned to the normal traffic of your network.
SYN flood blocked
Fake TCP connections, opened only to keep the server busy, stop at the edge and do not reach your DNS.
Block rules by source
Networks or addresses that only send attacks can be blocked for good, at every point of the network at the same time.
Servers out of sight
The real IPs of your servers stop being the target. Attackers find the Edgium network, spread out and built for this.
Prefer that Edgium answers on its own, with a copy of the zones? That is the DNS Slave: your server becomes the hidden master and never shows up on the internet.
What changes for the provider and for subscribers
For the provider
- No zone changes: no migrating domain by domain. Your zones and today's tools stay the same.
- Fewer sleepless nights: the attack that used to take down DNS and flood support stays at the edge.
- Less hardware on the front line: the authoritative server handles only real queries.
- A selling point: protected DNS to offer to the business customers who host with you.
For subscribers and the provider's customers
- Customers' sites and email keep answering even during an attack on DNS.
- Faster answers, coming from the network point closest to whoever asked.
- Nothing to configure: for the people using it, the nameserver is the same as always.
Use examples
Common situations and how Edgium handles each one.
Internet provider (ISP) and hosting
DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge.
See the full exampleCompanies with their own ERP, database and email
ERP and email reachable from outside, with the company's server hidden behind the edge.
See the full exampleQuestions about the DNS Firewall
Do I need to change the zones or my customers' domains?
No. Your zones stay on your server, exactly as they are. Only the addresses of your nameservers start answering from the Edgium network.
What is the difference between the DNS Firewall and the DNS Slave?
With the DNS Firewall, every legitimate query is passed to your server, which keeps answering. With the DNS Slave, Edgium receives a copy of the zone and answers on its own, without asking your server.
What is a random subdomain attack?
It is a flood of queries for names that do not exist, such as x7k2q.customer.com, which no cache holds and which takes the authoritative server down. The DNS Firewall recognizes the pattern and limits it at the edge.
Can the limits be adjusted?
Yes. Queries per second, NXDOMAIN responses and error responses each have their own limits, tuned to the normal traffic of your network.
Can I test the DNS Firewall before signing up?
Yes. Talk to us: Edgium arranges a test with you without stopping the service, and you watch queries pass through the edge before moving all your nameservers.
Has your DNS been attacked before?
Talk to Edgium: tell us how many zones and queries the provider has, and we arrange a test with you without stopping the service.