Beni Keller
By day I wrestle penguins and the occasional networking device — that is, I'm a lead Linux engineer for the Administration of the Canton of Zug, on a team building a new network that prioritizes IPv6-only services wherever possible. My current focus is DNS, radius and DDI.
Outside of work, everything I run is on a flavour of BSD. When I'm not at a computer, you'll find me outdoors: climbing mountains, ski touring, cycling, unicycling or operating a shortwave amateur radio station on a mountain top.
Session
When your DNS resolvers and internal authoritative name servers go down, everything goes down. We needed a setup where failover is automatic and consisted of several layers of redundancy - so we turned to BGP.
This talk walks through our current production architecture, where Unbound serves as the resolver and ExaBGP orchestrates route withdrawals for fast failover. I'll share what we've learned setting this up and outline our plans to extend it further: possibly replacing ExaBGP with OpenBGPD for a more flexible BGP integration, and introducing multi-vendor DNS software to eliminate single-point-of-failure risk at the application layer in the case of a software bug.
Along the way, I'll dig into the specific challenges we faced in parts of our network that are IPv6-only - in particular, getting DNS64 to work in a complex internal DNS landscape.