Abstract: Some embodiments provide a two-tier DNS (Domain Name System) service for processing DNS requests. In some embodiments, the two-tier DNS service deploys first and second tiers of service machines, with the second-tier having several groups of service machines each of which is configured to resolve DNS requests for a different set of domain names than the other second-tier group(s). Each service machine in the first-tier is configured to identify the second-tier group responsible for each particular DNS request that the service machine receives for each particular domain name, and to forward the particular DNS request to the second-tier group that it identifies for the particular DNS request. The first-tier DNS service in some embodiments has only one group of service machines. Each first or second service machine group in some embodiments can have one or more service machines, and can be scaled up or down to add or remove service machines to the group (e.g., through an active/active layer 3 scaleout with BGP).

Abstract: A processing system isolates at a physically or logically separate memory region of a processing unit boot code that is received from an external boot source for programming a boot memory of the processing unit until after the boot code is validated to protect against buffer overruns that could compromise the processing system. The processing unit includes a secure buffer region of memory that is physically or logically isolated from the remainder of the processing unit for receiving boot code from an external boot source such as a personal computer (PC) such that any buffer overruns at the secure buffer simply overwrite data stored at the secure buffer, and do not affect data or instructions that are executing at the processing unit.