Last Sunday’s Super Bowl was, again, the biggest night in sports. The January 26th airing of The Grammys is the biggest night in music. If you polled every person on the planet, I’d argue a majority would say they like music or sports or both. Literally, millions and millions of people tune in to these two events.
But guess what? I’ve looked at the numbers and from a Domain Name System (DNS) query perspective, these events – as huge as they are – have less volume than a typical Monday morning.
Let’s go inside the numbers.
Let me begin with a slight clarification about our managed DNS service and the DNS in general. Dyn offers a collection of authoritative DNS services, meaning we hold “the bits of truth” on a collection of geographically distributed name servers. When you visit a website on your mobile phone or laptop, you are actually querying a recursive DNS server.
Recursive DNS servers query authoritative name servers and maintain a cache of responses with a goal to speed things up or act as a caching layer.
The process goes like this: if you want to look up a website, your computer queries a recursive DNS server (either one set by default by your ISP or another option like Google Public DNS). The question it is asking: “where can I find twitter.com?” Now let’s make a crazy assumption that no one else using this recursive has visited Twitter since the expiration of the zones Time To Live (TTL), which is basically the amount of time that website can live in cache.
The recursive will then work from right to left “twitter.com. ” starting at the root or “.”
Recursive Nameserver: Hey “.” where can I find the servers responsible for “com.”?
Root: Oh you’re looking for “com.” ask the “com. (Top-Level Domain) TLD Nameserver”.
Recursive Nameserver: Hey “com.” Where can I find the servers responsible for “twitter.com.”?
TLD Nameserver: My NS records indicate that Dyn would be the person to ask.
Recursive Nameserver: Hey Dyn, where can I find twitter.com?
Dyn Nameserver: Hello! twitter.com is at 22.214.171.124, Have a great day!
Here’s an example to make that explanation a little more clear. On Monday morning when you go to the office and everyone is checking their Twitter feed, once the recursive DNS server you share has retrieved the records for twitter.com, it can serve the cached response instead of issuing another query and waiting for a response.
So even if 20 people are looking up twitter.com at one time, from an authoritative DNS standpoint, it seems like it is only one.
Now this basic explanation glosses over the fact that when the authoritative name server passes details to the recursive, they also supply detail on how long that data should be considered valid for (the Time To Live value for the record). The recursive layer takes quite a bit of load off of the authoritative servers because you could have an ISP seeing 10x twitter.com requests but that server is only going to make one request every 60 seconds.
This also means that it is important to get the answer to that recursive quickly via an anycast network (which we have) and nodes placed in strategic locations.
But What About The Super Bowl?
Now back to this notion of DNS traffic related to world events. Let’s start with what is expected. There are certain customer profiles that see double or triple the traffic they normally do during the Super Bowl.
Mainly, these are Content Delivery Networks (CDNs) and media companies that are doing business for/with companies that are doing customer outreach during the event. The reason for this spike is pretty straightforward.
Ads drive traffic to the web, so chances are there are people who wouldn’t normally visit these sites visiting them. As a result, there are more cache misses on/for recursive DNS resolvers, which mean more authoritative DNS queries.
Also for large events and/or media campaigns, companies may choose to use shorter TTLs. A shorter TTL means the item is valid in the recursive cache for a shorter period of time, increasing the number of recursive queries made to authoritative DNS servers.
Then why would these events have less Authoritative DNS queries than a typical Monday morning?
The answer comes down to the specific nature of those events. The websites that are impacted are an incredibly small portion of overall Internet traffic. The sites people are looking at during those events are very focused and specific.
The Influence Of Work
Think about the grand scope of the Internet. We normally see the highest DNS query volumes Monday – Thursday, with a decline on Friday and a drop off for the weekend Saturday and Sunday.
If you start to think about how you drive query volume, it starts to make more sense. In your personal time, your Internet usage may be very focused (Twitter, YouTube, Gmail, WorldStarHipHop.com …or is that just me?) where as during the workweek, your use case varies.
Not only are you keeping tabs on your world, but, you are using the Internet to fulfill your job responsibilities. This means you are searching for a diverse set of Internet destinations, which means the probability that someone has requested the record you need within its TTL decreases. This, in turn, increases the amount of traffic we see on our platform since Dyn provides service to numerous customers in a wide variety of industries from media outlets to social media platforms to sports teams.
So while major cultural events like the Super Bowl and the Grammys have huge impacts on sites that play a specific role in them, you’re better off waiting for Monday morning for every other website. Hopefully, that helps get rid of your case of the Mondays.