Resilient domain name service (DNS) resolution when an authoritative name server is unavailable
In one embodiment, a resolution resiliency application performs robust domain name system (DNS) resolution. In operation, the resolution resiliency application determines that an authoritative name server that is responsible for a domain name specified in a DNS query is unavailable. In response to determining that the authoritative name server is unavailable, the resolution resiliency application performs operation(s) that modify one or more DNS records stored in a cache based on one or more resiliency policies associated with the authoritative name server. The resolution resiliency application then generates a DNS response to the DNS query based on a DNS record stored in the modified cache. Notably, unlike conventional techniques that may generate inaccurate DNS responses based on stale DNS records, the disclosed techniques increase the likelihood of providing clients with DNS responses that accurately provide requested information.
1. A computer-implemented method for performing domain name system (DNS) resolution, the method comprising:
determining that a first authoritative name server that is responsible for a domain name specified in a first DNS query is unavailable;
in response to determining that the first authoritative name server is unavailable:
determining that a first DNS record stored in a first cache has an expired time-to-live (TTL),
obtaining a copying policy associated with the first authoritative name server, wherein the copying policy specifies a second cache from which a given DNS record can be copied to the first cache, and
copying, to the first cache and from the second cache, a second DNS record that has a valid TTL; and
generating a first DNS response to the first DNS query based on the second DNS record.
2. The computer-implemented method of claim 1 , wherein:
the first authoritative name server is associated with a first zone,
the second authoritative name server is associated with a second zone, and
the second zone is a parent of the first zone.
3. The computer-implemented method of claim 1 , further comprising:
transmitting, to the second authoritative name server, an inquiry to request a TTL extension policy; and
receiving, from the second authoritative name server, the TTL extension policy.
4. The computer-implemented method of claim 3 , further comprising:
determining that the TTL extension policy permits extending the first DNS record, and
performing an addition operation between the expired TTL and the duration to generate an extended TTL that is associated with the second DNS record.
5. The computer-implemented method of claim 1 , wherein the first DNS record comprises an address record, a text record, a service record, or a name server record.
6. The computer-implemented method of claim 1 , wherein the first authoritative name server is determined to be unavailable when:
a time out occurs when the first DNS query is transmitted to the first authoritative name server, or
a negative response indicating a server error is received after the first DNS query is transmitted to the first authoritative name server.
7. The computer-implemented method of claim 1 , further comprising:
determining that a TTL extension policy permits extending the first DNS record;
determining a second duration based on the TTL extension policy; and
performing an addition operation between the expired TTL and the second duration to generate an extended TTL that is associated with the second DNS record.
8. One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:
determining that a first authoritative name server that is responsible for a domain name specified in a first DNS query is unavailable;
in response to determining that the first authoritative name server is unavailable:
determining that a first DNS record stored in a first cache has an expired time-to-live (TTL),
obtaining a copying policy associated with the first authoritative name server, wherein the copying policy specifies a second cache from which a given DNS record can be copied to the first cache, and
copying, to the first cache and from the second cache, a second DNS record that has a valid TTL; and
generating a first DNS response to the first DNS query based on the second DNS record.
9. The one or more non-transitory computer-readable storage media of claim 8 , further comprising:
transmitting, to the second authoritative name server, an inquiry to request a TTL extension policy; and
receiving, from the second authoritative name server, the TTL extension policy.
10. The one or more non-transitory computer-readable storage media of claim 8 , wherein the first DNS record comprises an address record, a text record, a service record, or a name server record.
11. The one or more non-transitory computer-readable storage media of claim 8 , wherein generating the first DNS response comprises:
determining that the first DNS record enables the domain name to be translated into an Internet Protocol (IP) address;
determining that the expired TTL associated with the first DNS record indicates that the first DNS record is stale; and
specifying a DNS return code that indicates a server error.
12. The one or more non-transitory computer-readable storage media of claim 8 , wherein determining that the first authoritative name server is unavailable comprises evaluating a status record that is attached to a previously-received DNS response.
13. The one or more non-transitory computer-readable storage media of claim 8 , further comprising:
obtaining, by a resiliency orchestrator, the first DNS record from a zone transfer that includes the first DNS record; and
storing the first DNS record in the first cache.
14. The one or more non-transitory computer-readable storage media of claim 13 , wherein the resiliency orchestrator comprises a shadow master.
15. A system comprising:
a memory storing a resolution resiliency application; and
a processor that is coupled to the memory and executes the resolution resiliency application by:
determining that a first authoritative name server that is responsible for a domain name specified in a first DNS query is unavailable;
in response to determining that the first authoritative name server is unavailable:
determining that a first DNS record stored in a first cache has an expired time-to-live (TTL),
obtaining a copying policy associated with the first authoritative name server, wherein the copying policy specifies a second cache from which a given DNS record can be copied to the first cache, and
copying, to the first cache and from the second cache, a second DNS record that has a valid TTL; and
generating a first DNS response to the first DNS query based on the second DNS record.
16. The system of claim 15 , wherein the first DNS record comprises an address record, a text record, a service record, or a name server record.
17. The system of claim 15 , wherein the first cache is associated with a first recursive resolver and the second cache is associated with a second recursive resolver.