Fortifying DNS Resilience and Performance with Hybrid Architecture

This architecture enables organizations to use F5 Distributed Cloud Services for authoritative DNS during normal operations. If needed, they can switch to on-premises DNS services, ensuring they maintain control over their DNS infrastructure.

In the F5 hybrid DNS architecture, Distributed Cloud DNS functions as both the authoritative and secondary DNS, leveraging SaaS-based capacity and capabilities such as:   

• Layers of security: Get dynamic security with automatic failover that prevents DDoS attacks or manipulation of domain responses with built-in protection.   
• Automatic capacity scaling: Deploy and support applications anywhere. This DNS solution is built on a global data plane that eases deployment and management, plus scales automatically to meet high-volume demand.  
• Maintain high availability: Built on a global anycast network, it provides highly available and responsive DNS via points of presence across global markets.  
• Fast deployment and delivery: Configure and provision in minutes, with one set of APIs. 

In unforeseen situations where SaaS-based DNS services are unavailable, organizations can automatically activate on-premises BIG-IP DNS to ensure uninterrupted DNS traffic. BIG-IP DNS provides robust features like:  

• 100 million RPS performance: BIG-IP DNS uses the DNS Express service and Rapid Response Mode to hyperscale authoritative DNS up to 100 million query responses per second (RPS), ensuring that users connect to the best site. The F5 DNS Express service improves standard DNS functions by offloading DNS responses and scaling from hundreds of thousands to more than 50 million RPS.  
• DNS Firewall/DDoS: Can be combined with BIG-IP Advanced Firewall Manager (AFM) to provide extensive security, including shielding DNS from volumetric DDoS attacks such as UDP floods or amplification DDoS attacks.  
• DNSSEC: Protects local domain name servers from cache poisoning and man-in-the-middle attacks with real-time domain name system security extensions (DNSSEC).  
• Cache consolidation: Reduces latency and response time by up to 80%.  
• Failover that ensures availability: Failover entire data centers or individual applications and servers to ensure users have uninterrupted access to the apps they need.

This architecture addresses the need for continuous DNS services to keep digital businesses online while leveraging cloud benefits. It ensures that organizations maintain control and avoid being stranded if cloud services go offline.