F5 DNS Cloud Service Frequently Asked Questions

Q: How does F5 DNS Cloud Services differ from Cisco Umbrella?

Actually, the two services are complementary to each other.

Cisco Umbrella is a recursive cloud DNS solution—meaning clients on your network use it to resolve various domains on the internet. It protects users by inspecting their DNS queries. If it receives a query for a known bad FQDN/domain, it resolves the query to a server which hosts a blocking response page.

Alternatively, F5 DNS Cloud Service is an authoritative cloud DNS Solution—meaning clients on the internet use it to resolve your company’s domains. DNS Cloud Service provides inherent DNS redundancy, built-in DNS-targeted DDoS protection, automatic failover, and more, and it’s all built on a global anycast network to provide highly available and responsive DNS in any location.

Q: How would I perform DNS queries for the zone I am configuring in F5 Cloud Services? Are the name servers documented publicly?

Yes. You can query against the anycast addresses that are returned when you create a new zone, and you can find them in the details of a zone as shown below in the user interface:
_images/DNS-Name-Servers.png

If you are using the API, the name servers are returned upon creation a new zone. You can see an example of this in the API Guidelines

Q: Are there any size limits for DNS Cloud Service?

DNS Cloud Service has a standard limit of 10,000 resource record sets per hosted zone; however, users can contact Support to request the limit be increased to 20,000.

Q: Does DNS Cloud Service support DNSSEC ?

Yes, DNS Cloud Service supports Domain Name System Security Extensions (DNSSEC) as a secondary DNS. The zone transfer includes all of the DNSSEC related records and allows DNS Cloud Service to respond for them as the primary would.

Q: Does the DNS Cloud Service stop responding after the SOA record Expire time passes?

No, the DNS Cloud Service will continue to respond to the zone indefinitely until it is explicitly removed from the service. The SOA (Start of Authority) record contains a number of parameters for a zone. Secondary authoritative DNS servers use the parameters in this record to determine how often to refresh the zone file, how often to retry in the event of failure, and the Expire field which specifies the upper limit on the time interval that can elapse before the zone is no longer authoritative. Some secondary services stop responding once the expire limit passes, and others like DNS Cloud Service respond with the last known good answer. For more information, the SOA and it’s parameters are defined in RFC 1035

Q: Who should I contact for help regarding F5 Cloud Services?

Send e-mail to: PM-F5aaS@f5.com