NS1's geo-filters are geographic-specific filters within the NS1 Filter Chain that allow you to geotarget or geofence DNS traffic.
-
Geofencing filters eliminate answers (i.e., endpoints) that do not match the country or geographic region of the requester.
-
Geotargeting filters rearrange answers based on the proximity of the endpoint to the source IP address of the requester.
The resolver's location typically determines how the authoritative name server (ANS) directs traffic. However, if the resolver supports the EDNS client subnet (ECS) extension, NS1 can steer traffic according to the client’s geolocation. Typically, geo-filters connect clients to endpoints closest to them or steer them toward specific data centers.
Geo-filters process each DNS query by referencing the geographic location of the resolver or the client compared to the geographic metadata associated with each answer. The source IP address is matched against NS1’s geolocation database. Typically, these filters are used in conjunction with other filters to create a list based on the proximity of the resolver or client and then to filter traffic further as desired. For example, in addition to directing traffic to closer endpoints, you may want to balance the load or avoid overloaded endpoints.
Note
NS1 works to ensure that data in the GeoIP database is accurate and up-to-date. If you experience issues due to inaccurate GeoIP data, contact NS1 customer support.
You can filter based on origin resolver or client subnet if ECS information is provided. The additional IP address information provided through ECS can help NS1 better direct traffic. ECS is enabled by default. Refer to About the EDNS client (ECS) extension to learn more.
Note
NS1 does not recommend disabling ECS on a resource record. Refer to the ECS article to learn more about why you should ensure that this capability is enabled.
Geo-filters are based on three types of metadata:
-
Country: Filters based on country and country subdivision metadata. See ISO 3166-2 subdivision codes for more information.
-
Region: Applies to broad geographies, similar to cloud provider regions.
Note
Despite the naming, US regions include all regions in North America. For example, US-WEST consists of some Canadian provinces in addition to the western United States.
-
Latlong: Filters based on latitude and longitude.
With geotargeting filters, NS1 attempts to return the geographically closest response. Geotargeting filters are flexible. NS1 directs traffic to the closest endpoints instead of filtering it out. It creates a prioritized list without ruling out any answers. Geofencing filters, on the other hand, are explicit. The answers and endpoints that do not match the specified configuration are filtered out.
You should not use both types in the same Filter Chain. Using a geofencing filter and a geotargeting filter that both use the same geotype metadata (like region or country) will cause unexpected results.
Note
Use cases where both geotargeting filters and geofencing filters are required are not as common, but they are possible. You can use both types of filters in your Filter Chain, but you should use different geographic metadata for each filter type. For example, you can use a Geofence Country filter and a Geotarget Region filter in the same Filter Chain. Typically, these use cases involve using answer groups or other more complex approaches.
Use geotargeting filters to steer traffic based on the client or resolver’s proximity to a geographic midpoint. The geographic midpoint is the latitude and longitude that represents the midpoint of the location for the answer. In other words, if you specify that an answer is in the US-West region, then the geographic center of the western United States is used. On the other hand, if you specify that an answer is in the state of New York, then the latitude and longitude of the exact middle of NY are used. When you use geotargeting filters, you ensure clients almost always reach the nearest data center based on the location of their resolver or the location of their own IP address if ECS is supported and enabled on the Filter Chain.
This filter sorts answers by the distance of the source IP address to the requested endpoint based on the country, subdivision, US state, or Canadian province. NS1 compares the most granular location in the answer metadata fields to a GeoIP database to determine the location of the requester based on one of the following:
-
Source IP of the request if EDNS Client Subnet (ECS) is supported and activated by the recursive resolver, or
-
Source IP of the recursive resolver if ECS is not enabled.
Individual answers for every country, subdivision, state, and province aren’t required. If a requester is in a location for which there is no answer with matching metadata, it is given the closest existing answer based on geographical distance. For example, assume you have two answers: One with JP, HK (Japan and Hong Kong) and another with US, CA (United States and Canada). A user in Taiwan is directed to the JP, HK endpoint since Taiwan is closer to Hong Kong.
You can use this filter with another one like Select First N to send the user to the closest answer. If you have multiple answers in the same location, consider using Shuffle to pick one of the closest answers randomly.
This filter sorts answers by the distance of the source IP address to the requested endpoint using the georegion metadata field and the GeoIP database.
You don’t need to assign individual answers for every region. If a requester is in a region without a regional answer, the closest existing regional answer is given. For example, assume that you have two answers: One that assigns the US-EAST metadata value and one that assigns the ASIAPAC metadata value. If a requester is in US-CENTRAL, they receive the US-EAST answer.
You can use this filter with another one like Select First N to send the user to the closest answer. If you have multiple answers in the same location, consider using Shuffle to pick one of the closest answers randomly.
This filter uses latitude and longitude coordinates to sort answers based on the distance to the requester's IP address. It examines the latitude and longitude metadata fields to get the location of each answer. Then NS1 uses the GeoIP database to determine the requester's location to determine which answer is closest.
You can use this filter with another one like Select First N to send the user to the closest answer. If you have multiple answers in the same location, consider using Shuffle to pick one of the closest answers randomly.
Consider the following best practices when configuring your geotargeting filters:
-
Use only one piece of metadata: The location of the endpoint. Ideally, you should have a one-to-one mapping of answers to the geographic locations that you’re targeting. For example, suppose you have endpoints in California, New York, Texas, and Illinois. You specify those answers in the answer list, then assign the appropriate US states to those endpoints and no other metadata. If you require more than one piece of metadata, understand that the geographic midpoints of each will be considered, which could lead to unexpected results. Geofencing may serve your needs better.
-
Be as granular as possible when you use the country geotargeting filter. For example, choose a subdivision over an entire country when possible. If your filters aren’t granular enough, your results may seem counterintuitive. For example, clients in a large geographic country or region could receive a response intended for a different country or region.
When you use a geofencing filter, only clients or resolvers that match the geographic metadata get the designated response. If the geolocation does not match the metadata of an answer, the client or resolver will not receive that answer. Answers without geolocation metadata remain available for clients or resolvers outside of the geofence you define.
Requests are evaluated against an IP database to help you steer and restrict clients. You can use geofencing filters to use in-country CDNs or restrict user data within a specific country.
This filter eliminates answers in which the country, subdivision, state, or province metadata does not match the requester’s location. If the requester’s location does not match the metadata of any answers, all answers without a country, subdivision, state, or province are returned. If no such answer exists, then a NO ERROR, NO ANSWER status will be returned, and the answer data will be blank.
NS1 compares the most granular location in the answer metadata fields to a GeoIP database to determine the location of the requester based on one of the following:
-
Source IP of the request if EDNS Client Subnet (ECS) is supported and activated by the recursive resolver, or
-
Source IP of the recursive resolver if ECS is not enabled.
If the requester's location does not match an answer in the list, that answer is eliminated from the list of possibilities. You should set up a fallback endpoint without any location metadata set to direct traffic from IPs that do not transmit location or that do not match the geofenced location.
If you select Remove answers that don’t match location metadata if any match, answers are removed only if at least one answer contains location metadata that matches the requester’s location. If no answers meet this requirement, answers with no location are returned.
This filter eliminates answers from different geographical regions than the requester. Answers without a georegion value set are not eliminated unless you select the Remove answers without georegion on match option.
This filter examines the georegion value of answers to determine which geographical regions are allowed, then compares it to a GeoIP database to determine the region of the requester to determine if there is a match. The answer will not be returned if the georegions do not match.
If you do not select the Remove answers without georegion on match option, answers without a georegion are not eliminated. For example, assume you have two answers: One with its georegion value set to US-EAST, EUROPE , and another without a georegion value. Requesters in US-EAST will receive both answers, while a requester in ASIAPAC will receive only the second answer. If you want a requester in US-EAST to receive only the first answer, select Remove answers without georegion on match.
Consider the following when using geo-fencing filters:
-
Some IP addresses do not have geo-location metadata attached to them. You should include a fallback answer with no geolocation metadata attached that provides a response for these IP addresses.
-
Commonly, geographic filters respond with an endpoint that is only intended for one region. This behavior can provide a form of content protection, but end users can easily circumvent this design. If you want to keep unwanted users away from your content, use other methods in conjunction with geofencing and different methods later in the user journey.
-
Setup
You have endpoints in the following locations: San Francisco, New York City, Budapest, London, and Singapore. Assume you’ve already set up monitoring for each of your endpoints.
-
Desired Outcome
You want clients to be directed to the nearest endpoint to ensure that the connection between the client and your servers remains speedy.
-
Solution
You create a Filter Chain with filters in the following order: Up, Geotarget Country, Select First N. You add the country metadata of each of the endpoints to the answers in the list, then specify that only the first answer should be returned.
Before setting up the Filter Chain, we should add the endpoints as answers for this record. From there, we can add the country metadata for these endpoints.
Note
In some cases, you may find it more useful to set subdivision-level or latitude and longitude-level metadata for your endpoints instead of country-level. In cases where you must direct traffic among several endpoints in adjacent countries or multiple endpoints in a single US state, you should opt for a more granular approach.
The following screenshot shows how we have set up our Filter Chain and metadata based on the setup outlined previously:
To set up this Filter Chain and geotarget based on latitude and longitude:
-
Create endpoint answers for each of the servers.
-
Include Up, Geotarget Country, and Select First N in the Filter Chain.
-
Specify that only 1 answer should be kept for the Select First N filter.
-
Assign country or subdivision metadata to each endpoint, then save the record. To add this metadata, click the Geotarget Country filter to populate answers with the tags, then click the subdivisions tag to add the corresponding subdivisions.
When a query is sent to the Filter Chain, filters are evaluated from top to bottom. Each filter uses the configured parameters to decide which endpoint clients should use, depending on their location. After all of the filters have sorted the available answers, the final endpoint is returned to the client as the best solution.
-
The Up filter determines whether an endpoint is available.
-
The Geotarget Country filter finds the endpoint closest to the client or resolver.
-
The Select First N filter eliminates all but the number of answers that you specify.
-
Setup
You have two endpoints: A Chinese content delivery network (CDN) and a CDN that you use for the rest of the world.
-
Desired Outcome
You want to direct users in China to a Chinese CDN while the rest of the world is directed to another CDN.
-
Solution
You assign the CN country metadata to the Chinese CDN. Then you create a Filter Chain in the following order: Up, Geofence Country, and Select First N.
The following screenshot shows the Filter Chain and answer list setup for this scenario:
To set up this Filter Chain and set up a geofence for China vs. the rest of the world:
-
Create answers for the Chinese CDN and the CDN you use for the rest of the world.
-
Assign country metadata to each of the CDNs.
-
Geofence by country by creating a Filter Chain in the following order: Up, Geofence Country, Select First N.
-
Specify that only 1 answer should be kept by clicking the Select First N filter in the Filter Chain and typing 1 in the number of answers field.
When a query is sent to the Filter Chain, each filter uses the configured parameters to decide which endpoint clients should use, depending on their location. After all filters have sorted the available answers, the final endpoint is returned to the client as the best solution.
-
The Up filter determines whether an endpoint is available.
-
The Geofence Country filter eliminates answers in which the country, subdivision, state, or province metadata does not match the requester’s location.
-
The Select First N filter eliminates all but the number of answers that you specify.