Anycast DNS means the same nameserver IP address is announced over BGP from many data centres at once. Each query is routed to the topologically closest site. That cuts latency and spreads DDoS traffic across many locations instead of piling it onto one server, although an individual site can still be overwhelmed locally.
There are only 13 root server names, a.root-servers.net through m.root-servers.net. Behind them sit well over a thousand machines on every inhabited continent. That only works because each of those addresses lives in many places at once.
What is anycast DNS?
With ordinary unicast routing, one IP address belongs to one machine. Packets from Sydney and from Manchester travel to the same box, however far away it is.
With anycast, several sites announce the same IP prefix via BGP, the protocol networks use to exchange routes. Each router picks whichever path looks shortest from where it sits. A query from Manchester might be answered in London, one from Sydney in Sydney, yet both were sent to the identical address.
RFC 4786, “Operation of Anycast Services”, documents the operational practice. DNS is a natural fit: most queries are a single UDP packet in each direction, with no long-lived session to keep stable.
Anycast vs unicast DNS
| Unicast nameserver | Anycast nameserver | |
|---|---|---|
| Sites per IP | one | many |
| Global latency | depends on distance to the single site | usually low, a nearby site answers |
| Losing a data centre | the IP is gone | routing shifts to other sites |
| DDoS traffic | lands entirely on one site | splits across sites near the sources |
| Operations | simple | BGP, own address space, upstream coordination |
| Typical users | self-hosted servers, small hosts | root servers, TLD registries, large DNS providers, CDNs |
Why anycast blunts DDoS attacks
Botnets are scattered across the globe. Against a unicast server, every packet converges on one point and the load adds up there. Against anycast, each bot’s traffic goes to whichever site is nearest to it. A 100 Gbit/s flood spread across 30 sites delivers only a fraction of that to each.
That is arithmetic, not magic. Total capacity still has to exceed the attack, and the spread is rarely even. If a large share of the attacking devices sit in one region, the site serving that region takes most of the hit.
Two side effects help further:
- Damage stays local. If one site saturates, mainly users routed to it notice. Everyone else carries on.
- Sites can step back. An overloaded node can withdraw its BGP announcement so neighbouring sites absorb its traffic. That is an operator decision, not something that happens by default.
The attack patterns aimed at nameservers are described in DNS DDoS attacks.
Where anycast falls short
Anycast gets sold as a cure-all. It has limits worth knowing:
- One provider is still one provider. A bad config push or software bug hits every site at once. Anycast handles load, not mistakes. Pair it with an independent secondary DNS provider.
- Nearest is not geographic. It means topologically closest, which depends on your ISP’s peering. A query from Dublin can land in Amsterdam or further away.
- Debugging gets harder. Two engineers in different cities query the same IP and hit different servers. If one node is serving stale data, only some users see it.
- It does not protect your web server. Anycast nameservers keep name resolution alive. If the attack targets your origin IP, you need protection there too, typically from a CDN. See Cloudflare DDoS protection for one example.
How to check whether your nameservers use anycast
There is no definitive outside test, but you can collect strong hints.
1. Ask which instance answered. Many anycast operators expose the answering node through NSID or a CHAOS-class query. This only works if the operator has enabled it.
dig @k.root-servers.net . SOA +nsid
dig @k.root-servers.net hostname.bind CH TXT +shortAgainst a root server you will see a line beginning ; NSID: in the OPT PSEUDOSECTION, identifying the site that replied. Run the same command from a machine in another country and the identifier changes. That is anycast doing its job.
2. Compare latency from several continents. If your nameserver answers in 10 to 20 ms from Europe, North America and Asia alike, it is almost certainly anycast. A single server in Virginia cannot answer Singapore that fast.
dig @ns1.example.com example.com SOA | grep "Query time"3. Traceroute from different vantage points. Paths that end in different data centres for the same destination IP are a strong indicator.
4. Read the documentation. Providers who run anycast say so. If the docs are silent, assume they do not.
Using anycast DNS for your own domain
You do not need your own network. The usual route:
- Pick a DNS provider that documents an anycast network. Many CDNs and dedicated DNS services do.
- Create the zone there and copy every record. Then compare each record between old and new provider with
dig. - Lower TTLs on records you control a day ahead so the switch takes effect faster.
- Change the nameservers at your registrar. ICANN-accredited registrars pass the change to the registry, and propagation follows the parent zone’s NS TTL.
- Optionally keep a second provider as a secondary so you never depend on one network.
Step 4 is smoother with a registrar where changing nameservers is a single form. If your zone is signed, you also want a registrar that handles DNSSEC properly, because the DS record must match the new provider’s keys or validating resolvers will reject your domain.
How much anycast is enough?
A rule of thumb: more sites beat bigger sites, as long as each one has decent connectivity. For a company website, one anycast DNS provider plus one independent secondary is plenty. Running your own anycast, with an AS number and upstream contracts, makes sense for hosting companies, registries and very large platforms, not for a shop or a SaaS with one product.
To put a number on what an outage would cost you without that redundancy, use the calculation in the cost of a DDoS attack. A second DNS provider is often cheaper than a single hour offline.
Before comparing DNS providers, check what your domains cost to keep. The betadomain price list shows fixed yearly prices, for example €14.99 for a .com, with renewals at the same rate.
Found your domain? You can check and register it directly at compare domain prices – yearly price from €2.99.
FAQ
Is anycast the same as a load balancer?
No. A load balancer spreads requests across servers behind one address in one place. Anycast does the spreading at the routing layer, between sites, with no central device. Large DNS providers usually combine both: anycast between data centres and load balancing inside each one.
Does TCP work over anycast?
For DNS, generally yes. DNS-over-TCP sessions last milliseconds, and a route change in the middle of one is rare. Long-lived connections are more fragile, which is why anycast is most common for DNS and CDN edges, where connections are short.
Do I need anycast DNS for a small website?
You would not run it yourself; you would use it. Many managed DNS providers and CDNs run anycast networks as standard, often at no extra charge. The useful question is whether your current nameservers already do, which the provider's documentation or a dig +nsid test will usually reveal.
Does anycast replace a secondary DNS provider?
No. Anycast protects against overload and the loss of individual sites. It does not protect against the whole provider having an outage or pushing a bad configuration. A second provider on a separate network covers that case.