Analysing ccTLD anycast

In June, I attended NPNOG 11 in Nepal. In the evening, I discussed ccTLD infrastructure with some friends. We compared how some regional economies host their ccTLD themselves, while others outsource to larger ccTLD operators.

I get the sense that hosting a ccTLD today is challenging, not because of the technical stack, but due to Distributed Denial-of-Service (DDoS) concerns, and the only way to handle large-scale DDoS effectively is to:

• Over-provision the bandwidth
• Spread the attack surface using anycast

To reliably host a ccTLD in 2025, one would need at least eight to ten global locations near major data sources to mitigate attacks. Something like Ashburn, Dallas, Palo Alto, Frankfurt, Amsterdam, Singapore, Hong Kong, and so on. While we were having the discussion, I wanted to check how many ccTLDs are actually anycasted and if my guess was correct. Seems like I was partially correct…

Understanding anycast

Anycast basically means having more than one node and using the same address. It is assumed / expected that Border Gateway Protocol (BGP) will take us to the nearest announcement. But in reality, BGP path selection is influenced by neighbor relationships. Slides 26 to 33 of my INNOG presentation cover this in detail.

Essentially, network operators have the highest localpref on routes they learn from customers, the second highest on routes from peers, and the lowest on routes from upstreams. Therefore, using anycast with a mix of upstreams generally doesn’t work well.

To address this, anycast is typically deployed with the same set of global upstream ISPs everywhere, through heavy use of BGP action communities, or with a mix of global and local nodes. Even so, there can still be cases where some networks reach a nearby node while others are directed to a distant anycast node.

To deal with this specific part, I tested multiple providers within a given location. Anycast cannot be reliably evaluated by simply inspecting the routing table. In theory, location communities can give some indication, but it’s much easier to determine through latency measurements or traceroutes from different locations.

So I made a script to look up IPv4 and IPv6 latency to all ccTLD nameservers from the following providers/locations:

1. Contabo — New York and Düsseldorf
2. Hetzner — Falkenstein, Ashburn, and Singapore
3. Vultr — Amsterdam, Los Angeles, and Singapore

These nodes are located in major cities where peering and interconnection occur. Measuring latency from them to ccTLD authoritative nameservers helps reveal whether those servers are anycasted. Determining the exact number of anycast nodes is difficult and requires far more distributed measurements, but it’s reasonable to assume that if an IP is anycasted across the US, EU, and Asia, it should be reachable within 80ms (typically 40 to 50ms) from those regions. If I see low latency from one provider and high latency from another, I take that as evidence of an anycast node’s presence, with the difference due to suboptimal routing (which I’m not measuring here).

Result of ccTLD anycast check

Table 1 reflects the results. I have categorized them into three simple categories:

1. All NS anycasted: All nameservers for the given ccTLD are anycasted and reachable with low latency.
2. At least one NS using anycast: In this case, some nameservers consistently show low latency from the US, EU, and Singapore, while others show high latency. Typically, this reflects a mix of non-anycasted in-house servers and anycasted servers operated by commercial or non-profit providers.
3. None of the NS uses anycast: All nameservers show latency above 80ms when tested from the US, EU, and Singapore (usually lower latency in regions closer to the ccTLD’s origin economy).

Table 1 — ccTLD nameservers catergorized by anycast usage.

Conclusion

I was partially correct (and partially incorrect). Most ccTLDs do not use anycast on all their nameservers, but at least one nameserver typically does. According to this list, 11 ccTLDs have full anycast, 9 have no anycast, and the remaining 219 have partial anycast, with some nameservers anycasted and others not. Some ccTLDs were skipped because all their nameservers have ICMP disabled. In hindsight, I should have measured DNS latency in addition to ICMP latency.

The raw latency checks are posted here.

Anurag Bhatia is a Network Researcher for Hurricane Electric (AS6939), working closely with BGP routing, IXPs, DNS, IPv6, anycast, and other related aspects of the Internet core.

Originally posted on Anurag’s blog.

Rate this article

---

The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.