I'm primarily on the operations side, running a large Grafana/Prometheus stack for a SaaS platform. Our security team has been evaluating Cisco Umbrella (formerly OpenDNS) as our DNS-layer security solution, and the pilot is wrapping up. The security benefits are clear, but I'm coming at this from an SRE/performance angle.
My main questions for those running it in production:
**Performance Impact:**
* What's the realistic latency add for DNS resolution? We're hyper-sensitive to tail latency. Even an extra 10ms on the 99th percentile for DNS lookups can ripple through our services.
* Any issues with DNS caching behavior, especially with short TTLs common in dynamic environments (K8s, service discovery)?
* How does the roaming client (for laptops) behave under high churn or unreliable networks? Does it fail open/closed?
**Operational Overhead:**
* How's the logging integration? We'd need to pipe logs into Loki for correlation with application traces. Are the log formats (especially for DNS events) parsable and detailed enough?
* Alerting: We'd want to build some Grafana dashboards for Umbrella-specific metrics (e.g., request volumes, policy hits, latency). Is there a decent API or method to pull this data into Prometheus, or are we stuck with their portal?
**Pricing & Scaling:**
* The pricing model seems a bit opaque. For those who scaled from a pilot to a full enterprise deployment, were there any unexpected cost drivers? Does it scale linearly with user/device count, or are there steep jumps at certain tiers?
I'm hoping to move beyond the sales sheets and get some real-world operational experience. Any insights, especially around the performance and observability integration, would be hugely valuable.
- away