system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Is it possible to take down all DNS servers? What would happen to the Internet?

You might be aware of today's massive DDOS attack on Dyn DNS. Several websites are no longer accessible at the moment.

Aren't websites domains supposed to be referenced by several of those servers?

Is it somehow possible to take down all the DNS servers accross the world? Either with remote (DDOS, ...) or local (shutdown, ...) attacks.

If so, or hypothetically, what would happen? Possible to rebuild everything, ...?
gpt
To take down the DNS you'd probably want to focus on disrupting the DNS root servers. These servers basically keep track of Top Level Domain name servers which keep track of .com/.org/.biz/.mil/.gov/.edu/ etc TLDs. There have been many such attacks with varying degrees of success but so far no one has taken the entire DNS down for any meaningful amount of time. A fellow by the name of Dan Kaminsky uncovered a (if exploited) fatal security exploit in 2008 but luckily for everyone he chose to notify the authorities instead of use the exploit for malicious purposes. For his efforts he was given one of the 14 "keys" to the DNS system. In the event of a failure 7 of the 14 keyholders must meet at a secret pre-determined place in order to reboot the DNS.

The technique Dan Kaminsky discovered exploited a flaw in the way DNS servers decide which servers they can trust and which ones they can't. Basically he found he could trick a DNS server into believing that he was also a "trustable" DNS server and that domain name lookup tables he provided were therefore also legit. Of course if you can feed incorrect information to DNS server which it will blindly accept you can destroy its lookup tables in what is known as cache poisoning. If those tables become corrupted the server becomes effectively useless at providing correct information and its tables will need to be rebuilt.

Other methods such as DDoS are much more crude and work by simply overwhelming the system with bogus requests so that it doesn't have time to respond to legitimate requests, effectively grinding everything to a halt. These kinds of attacks are usually limited to smaller parts of the DNS because they simply don;t have the "firepower' to be able to knock out the whole thing. Additionally, the DNS is designed in such a way that the attack would have to completely saturate the system for more that 24 hours before it could actually start to mess things up. Usually in that amount of time you can either deploy some counter measures or find other ways to filter out the malicious traffic.

Recently efforts have been made to make the DNS much more distributed and therefore much harder to completely take offline. There have been many security enhancements but there will almost definitely always been some means of exploiting other existing vulnerabilities if you have the time and resources to do so. It's a very very very robust and secure system but like any computer system, it is not 100% bulletproof.