Generating a negative answer to a domain name system query that indicates resource records as existing for the domain name regardless of whether those resource records actually exist for the domain name
A DNS server receives, from a client device, a DNS query for a resource record type at a domain name. The DNS server determines that the resource record type does not exist at the domain name and generates an answer that indicates that the queried resource record type does not exist at the domain name and also indicates that a plurality of other resource record types exist at the domain name regardless of whether those plurality of other resource record types actually exist at the domain name. The DNS server transmits the generated answer to the client device.
1. A method in a Domain Name System (DNS) server, comprising:
receiving, from a client device, a DNS query for a resource record type at a domain name;
determining that the resource record type does not exist at the domain name;
generating a negative answer that includes a NextSECure (NSEC) record that indicates that the queried resource record type does not exist at the domain name and also indicates that a plurality of other resource record types exist at the domain name regardless of whether those plurality of other resource record types actually exist at the domain name, wherein at least some of the plurality of other resource record types do not exist at the domain name; and
transmitting the generated negative answer to the client device.
2. The method of claim 1 , wherein the NSEC record includes a type bit maps field, and wherein generating the NSEC record includes setting a bit in the type bit maps field for each of the plurality of other resource record types and not for the queried resource record type.
3. The method of claim 1 , wherein prior to generating the negative answer, determining that the domain name exists.
4. The method of claim 1 , wherein the plurality of other resource record types includes each resource record type, with an exception of the queried resource record type.
5. The method of claim 1 , wherein the DNS server is a proxy DNS server and receives the DNS query as a result of a name server of an origin DNS server for the domain name being changed to point to the proxy DNS server.
6. An apparatus comprising:
a Domain Name System (DNS) server including a set of one or more processors and a set of one or more non-transitory machine-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
receive, from a client device, a DNS query for a resource record type at a domain name;
determine that the resource record type does not exist at the domain name;
generate a negative answer that includes a NextSECure (NSEC) record that indicates that the queried resource record type does not exist at the domain name and also indicates that a plurality of other resource record types exist at the domain name regardless of whether those plurality of other resource record types actually exist at the domain name, wherein at least some of the plurality of other resource record types do not exist at the domain name; and
transmit the generated negative answer to the client device.
7. The apparatus of claim 6 , wherein the NSEC record includes a type bit maps field, and wherein generation of the NSEC record includes the set of processors to set a bit in the type bit maps field for each of the plurality of other resource record types and not for the queried resource record type.
8. The apparatus of claim 6 , wherein the non-transitory machine-readable storage mediums further stores instructions that when executed by the set of processors, cause the set of processors to determine that the domain name exists prior to generation of the negative answer.
9. The apparatus of claim 6 , wherein the plurality of other resource record types includes each resource record type, with an exception of the queried resource record type.
10. The apparatus of claim 6 , wherein the DNS server is a proxy DNS server, and wherein the DNS query is to be received as a result of a name server of an origin DNS server for the domain name being changed to point to the proxy DNS server.
11. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a Domain Name System (DNS) server, will cause said processor to perform operations comprising:
receiving, from a client device, a DNS query for a resource record type at a domain name;
determining that the resource record type does not exist at the domain name;
generating a negative answer that includes a NextSECure (NSEC) record that indicates that the queried resource record type does not exist at the domain name and also indicates that a plurality of other resource record types exist at the domain name regardless of whether those plurality of other resource record types actually exist at the domain name, wherein at least some of the plurality of other resource record types do not exist at the domain name; and
transmitting the generated negative answer to the client device.
12. The non-transitory machine-readable storage medium of claim 11 , wherein the NSEC record includes a type bit maps field, and wherein generating the NSEC record includes setting a bit in the type bit maps field for each of the plurality of other resource record types and not for the queried resource record type.
13. The non-transitory machine-readable storage medium of claim 11 , wherein the non-transitory machine-readable storage mediums further stores instructions that when executed by the processor, cause the processor to perform the following operation: prior to generating the negative answer, determining that the domain name exists.
14. The non-transitory machine-readable storage medium of claim 11 , wherein the plurality of other resource record types includes each resource record type, with an exception of the queried resource record type.
15. The non-transitory machine-readable storage medium of claim 11 , wherein the DNS server is a proxy DNS server and receives the DNS query as a result of a name server of an origin DNS server for the domain name being changed to point to the proxy DNS server.