Anycast at the root
Anycast allows the same root server IP address to be announced from multiple locations worldwide, so that resolvers reach a nearby instance rather than a distant one.
The big picture
When a resolver queries a root server address, anycast routing delivers the query to the topologically nearest instance rather than a single fixed location.
root IP address
nearest path
answers query
sent back
Introduction
Each of the 13 root server identities (A through M) has a fixed IPv4 address and, in most cases, a fixed IPv6 address. In the original design these addresses mapped to a single machine in a single location. Today the same addresses are served from many places around the world using anycast.
Anycast is the networking technique that makes the modern root server system resilient, low-latency, and scalable without changing the set of root server identifiers that resolvers are configured to query.
How anycast works
In unicast networking, an IP address belongs to one host. Anycast breaks that rule: the same IP prefix is announced via BGP from multiple independent locations. When a resolver sends a packet to that address, the Internet's routing fabric delivers it to the topologically closest announcing site.
- Each anycast site runs an identical root server instance and announces the same IP prefix into BGP.
- Routers along the path select the site with the shortest AS path or best local policy match.
- The resolver does not know or care which physical site it reached. The response is the same everywhere because the root zone data is identical.
- If a site goes offline, BGP withdrawals cause traffic to shift to the next nearest site automatically.
Global vs local sites
Root server operators distinguish between two categories of anycast deployment:
- Global sites accept traffic from any network on the Internet. They announce the root server prefix with no scope restrictions, so they may serve resolvers far away if routing favors them.
- Local sites restrict their BGP announcements to a specific set of peering partners or an Internet Exchange Point (IXP). They serve only the networks they peer with directly.
Local sites are typically smaller, less expensive to deploy, and placed strategically in regions where resolver traffic would otherwise travel long distances to reach a global site. They improve response times for the local community without affecting the global routing table.
An operator might maintain a handful of global sites with full transit and dozens or hundreds of local sites hosted at IXPs worldwide.
Benefits of anycast
Anycast addresses several operational challenges that a unicast root server system could not handle at Internet scale:
- Resilience. The failure of one site does not take down a root identity. Traffic is rerouted to surviving sites through normal BGP convergence.
- Latency. Resolvers reach a nearby instance rather than crossing continents. This is especially important for regions that previously had no local root server presence.
- Load distribution. Query volume is spread across many sites. No single machine or location needs to handle the full load for a root identity.
- DDoS absorption. Distributed sites can collectively absorb volumetric attacks. Traffic naturally spreads across instances, making it harder for an attacker to overwhelm the entire identity.
Anycast and the 13 identities
The 13-identity design predates wide deployment of anycast at the root. When the root server system was established, each letter corresponded to a single machine. Anycast decoupled the identity from the infrastructure.
- The number of operational instances has grown from 13 to over 2,000 without adding a 14th root server identifier.
- Each operator independently decides how many instances to deploy and where to place them.
- Some identities have a handful of sites; others have several hundred.
- The resolver's priming response still contains only 13 NS records and their addresses, keeping the protocol interaction unchanged.
Anycast is the mechanism that reconciles the legacy 13-identifier design with the demands of a modern, global Internet. It allows the root to scale horizontally while preserving backward compatibility with every recursive resolver ever built.
Further reading
RFC 4786 documents the general principles of operating anycast services, including considerations for DNS. RFC 7094 discusses architectural considerations for IP anycast. The root-servers.org site publishes per-identity instance counts and location data.