| Encryption | The Dynamic DNS service provider encrypts all communications between client and server, including initial Internet name registration request and subsequent periodic dynamic update requests.
Why is this important?
This is essential to prevent "man-in-the-middle" attacks from revealing the unique registration key or subscriber ID assigned by the service provider and compromising the user's account.
An attacker could use the registration key to make account and configuration changes such that the IP address associated with the Internet Name of a user points to the attacker's computer instead, allowing the attacker to monitor and capture authentication information sent by the end user (who is assuming he/she is connecting with his/her own computer) and thereby completely compromising the end user's PC. |
| Redundant DNS Servers | The Dynamic DNS service provider operates more than the minimum two DNS servers required for operation as stipulated by ICANN (the Internet Corporation for Assigned Numbers and Names).
Why is this important?
A Dynamic DNS name server is a very different kind of name server that must answer a comparatively much larger volume of name queries for a particular Internet Name due to the volatile nature of the IP address associated with it.
As a user's IP address can change at any time, the maximum time that other name servers on the Internet are allowed to cache a given Internet Name's IP address must be short -in the order of one minute- to ensure that name servers do not continue to cache a given user's old IP address for extended periods of time.
This has the effect, however, of significantly increasing the number of name queries a dynamic DNS server must be able to answer.
When a server hardware or software failure occurs in a minimal two DNS server configuration, all of the DNS query load is transferred to the one remaining server, significantly loading it, increasing name server response times or even causing a denial of service.
|
| Redundant Network | The Dynamic DNS service provider operates its DNS servers from more than one Internet backbone connection.
Why is this important?
This is important for two main reasons:
The Internet is a continuously changing and growing entity whose routes to various servers can change almost on a daily basis depending on new peering arrangements made by the major Internet backbone providers (Sprint, MCI, AT&T, Quest, etc.).
This means that for the duration of the propagation of these new routes, a user may be temporarily unable to communicate with a given server until these new routes have propagated and stabilized.
This may isolate a given Dynamic DNS service provider from that user temporarily unless an alternate route to the service provider is available.
Effects of Internet connectivity problems local to the Dynamic DNS service provider (which may be hardware, local-loop or further upstream) are minimized.
A Dynamic DNS service provider who operates DNS servers on redundant networks ensures maximum availability of the Dynamic DNS service to the end-user.
|
| Distributed Registration Servers | The Dynamic DNS service provider operates distributed dynamic registration and update servers on different networks.
Why is this important?
Dynamic update requests are sent periodically by the client software to designated update servers to ensure that the Internet Name is always synchronized to the current dynamic IP address of the client.
Allowing the client to utilize multiple dynamic update servers simultaneously ensures that the client's IP address is always tracked regardless of the availability of a particular update server.
The majority of Dynamic DNS service providers utilize a single server to receive periodic dynamic update requests from these clients, preventing changes in IP address from registering if this primary server became unavailable or unreachable.
A Dynamic DNS service provider who operates multiple dynamic update servers ensures maximum service availability of the Dynamic DNS service to the end-user. |
| Industry Standard DNS Server | The Dynamic DNS service provider utilizes industry standard and proven name server software to offer the Dynamic DNS services.
Why is this important?
The industry standard DNS server software is provided by the Berkeley Internet Name Daemon (BIND) distribution which has been in active development since the early 1980's and is in use on a large majority of DNS servers on the Internet as well as the root name servers operated by ICANN.
The open-source nature of this software ensures that the collective mind of tens of thousands of developers and professionals scrutinize every line of code, ensuring the early detection of security vulnerabilities and quick release of subsequent patches.
Dynamic DNS service providers who have developed their own DNS server software are providing only temporary "security through obscurity" and are at a much greater risk for exploits that affect service reliability and availability.
|
| Automatic Offline Detection | The Dynamic DNS service provider automatically detects when a client has stopped sending dynamic updates and flags the client as offline.
Why is this important?
This ensures that in the event of Internet connection problems, the IP address associated with the Internet Name of the user is changed to point to a web page that indicates that the user is currently offline. This also ensures that the Internet Name is no longer pointing to the last IP address of that user which may subsequently be assigned to another user at the same ISP. |
| HTTP based update protocol | The Dynamic DNS service provider utilizes the industry standard HTTP (hypertext transfer protocol) requests to receive updates from dynamic DNS clients.
Why is this important?
The use of the HTTP protocol ensures that update packets reach the Dynamic DNS service provider even when the client software is operated behind a company firewall and proxy server.
Dynamic DNS service providers that use proprietary protocols require the customer to configure Network Address Translation (NAT) or configure a SOCKS server in order to operate the client software behind a corporate firewall. |
