Speaker
Description
DNS operators instrument the DNS layer closely — query volume, latency, resolution failures, DNSSEC validation — but the routing layer underneath is usually a blind spot. Anycast DNS services, root servers, and authoritative infrastructure all depend on BGP announcing the right origin AS over a legitimate path, and when that breaks, DNS-layer signals often stay healthy right up until they don't.
This talk looks at why that gap matters through three real incidents: the June 2024 outage of Cloudflare's 1.1.1.1 resolver, caused by an origin hijack and a separate route leak within the same hour; the 2018 hijack of Amazon Route 53 DNS infrastructure that led to $150,000 in stolen cryptocurrency; and a 2023 hijack attempt against A-root that was nearly invisible because of anycast's own self-healing behavior. Each incident needed a different validation mechanism to catch — RPKI Route Origin Validation (ROV) for origin hijacks, ASPA path validation for the route leak that ROV can't see — which is the core argument of the talk: DNS operators running their own ASNs and anycast networks need both, not one or the other.
We'll walk through how ROV and ASPA each work, what failure mode each one catches, and then run a live demo: replaying a hijack and a route leak against an anycast-style DNS topology in Containerlab, showing what DNS-layer monitoring alone would see (nothing, or misleading latency) against real-time ROV+ASPA validation catching both. The demo runs on RAVEN, an open-source, single-binary, BSD-3-Clause tool that ingests BGP via BMP and validates it against a standard RPKI/RTR feed — no external measurement infrastructure required. We'll close with what's realistic for a DNS operator to deploy today.
| Talk duration | 20 Minutes (+5 for Q&A) |
|---|
