Lab notes

Measurements, written up

What we measure on our own anycast network (AS218833) and on public anycast DNS services, with method, numbers and the charts to check them. RSS.

• 2026-09-28

  Public resolvers can leave from almost anywhere. Their queries come from a few places.

  An egress map of a public resolver shows where the resolver can ask from. It does not show where it asks from. We measured both on our own lab and they are far apart.

• 2026-09-27

  Which nameserver do resolvers pick, and how fast do they move

  78 zones, delegated to one unicast server and to 34 anycast nodes at the same time. For 24 hours we counted where the resolvers sent their queries, and in a separate test how long they take to follow a change.

• 2026-09-26

  Drains three and four: this time with real traffic

  Withdrawn in one second, nothing left on the drained node, and 159 of 165 source prefixes back home with their first query.

• 2026-09-25

  Atlas tells you where a network goes. It does not tell you how much traffic arrives.

  We checked one against the other on our own lab: the catchment that RIPE Atlas probes report for each node, next to the resolver traffic the same nodes actually answered.

• 2026-09-20

  Two drains, two days apart: 85 and 88 % of the probes came back, and the same ten never did

  We drained one site of our own anycast network twice, 52 hours apart, and watched 100 RIPE Atlas probes. 17 of 20 IPv4 and 52 of 59 IPv6 cohort probes were back within 82 seconds of the restore, and then nothing moved for five hours and 58 minutes. The ten entries that never came back are the same ten as after the first drain, in the opposite direction.

• 2026-09-20

  How German sectors delegate: cities, universities, banks and the .de top 1,000

  The German inventory, read wide: the 100 largest cities, 93 universities, 80 banks and savings banks, and the 1,000 most popular .de domains, 1,276 zones with plain DNS queries. One operator behind 72 % of the universities, 3.8 % of the bank zones signed, ten operators behind 58 % of the .de top 1,000.

• 2026-09-19

  Who changed their ccTLD nameservers this year: 78 of 309, ten operator swaps, read from the root zone

  947 copies of the root zone from 1 September 2025 to 16 September 2026, diffed for all 309 ccTLDs: who appeared in the delegations, who disappeared, which changes were only new names on old addresses, and why the IANA "last updated" date is not the change. Public record, no probes.

• 2026-09-18

  Who checks the anycast vendors of Europe's ccTLDs? Nobody. So we did.

  31 country-code TLDs and .eu measured from RIPE Atlas probes inside each country, 26 and .eu with enough probes at home. Which of a registry's nameserver operators actually answers at home: the registry's own servers and the commercial anycast operators within about 10 ms, the registry-to-registry secondaries 18 to 41 ms away.

• 2026-09-17

  How Europe delegates: 853 zones, 76 % outsourced, and DNSSEC depends on the registry

  The German inventory, repeated for Austria, Switzerland, France, the UK, the Netherlands and the EU institutions: stock indices, governments, regions, broadcasters, banks and grid operators, read with plain DNS queries. Who runs the nameservers in each country, how concentrated it is, and why the Dutch list is signed and the other six are not.

• 2026-09-13

  Prepending one anycast site: the first prepend does the work, the third does nothing

  Our own /24 and /48 at 33 sites. We prepended Miami once, twice, three times, then withdrew it, then put it back, the same 1,000 RIPE Atlas probes watching every step. One prepend moved 40 of 49 probes, the third moved none, and the rest of the world did not notice.

• 2026-09-13

  What the delegation costs: 139 German zones, 146 ms in one country, 21 ms on anycast

  The same 139 zones as in "How Germany delegates", measured from 1,000 RIPE Atlas probes weighted by population. What a nameserver setup in one country costs a resolver in Asia, South America or Sydney, per group and per provider.

• 2026-09-13

  Who answers for apple.com: half Apple, half Packet Clearing House

  Two nameservers on Apple's own anycast, two at PCH, the same four for icloud.com. 30 sites against 124, measured from 1,000 RIPE Atlas probes: Africa and the Middle East are PCH, South America is Apple, and a resolver gets the best of both.

• 2026-09-12

  How the TLDs delegate: 1,438 zones, two operators on half of them, 87 without DNSSEC

  Every top-level domain in the root, read with plain DNS queries: who runs the nameservers, how concentrated it is, where DNSSEC and IPv6 are missing, and why country codes look healthier than the new generics.

• 2026-09-11

  How Germany delegates: 139 zones, 76 % outsourced, 60 % in one country

  DAX-40, federal government, the states, public broadcasters, banks and grid operators: who runs their nameservers, how many stand in one country and one network, and how few are signed.

• 2026-09-06

  1 to 33 anycast sites at one cloud provider: a staircase, not a curve

  One prefix, six stages, the same 1,000 RIPE Atlas probes at every step. What each site buys, what none of them buy, and the site that made a continent slower.

• 2026-08-28

  AS218833: from ASN assignment to two-site anycast in one afternoon

  Timeline and field notes: RIPE assigns the ASN at 14:37, the first announcement hits the DFZ at 16:27, the second site turns it into anycast at 17:19.