Strengthening integrity assurances for DNS data
One or more DNS services are provided that are configured to not only tolerate some commonly observed DNSSEC misconfigurations (while still providing DNSSEC's security guarantees), but also provide a more intelligent DNS resolution process informed by DNSSEC.
1. A computer-implemented method of resolving a Domain Name System (DNS) query for a domain name record, the method comprising:
enabling a capability offered by a resolver to be determined by a relying party, wherein the capability relates to a predetermined set of domains;
obtaining the DNS query at the resolver;
determining, by the resolver, whether the DNS query is for a domain within the predetermined set of domains; and
resolving the DNS query using a first recursion process when the DNS query is for the domain within the predetermined set of domains.
2. The computer-implemented method of claim 1 , further comprising: resolving the DNS query using a second recursion process when the DNS query is not for a domain within the predetermined set of domains.
3. The computer-implemented method of claim 1 , wherein the first recursion process comprises a high-fidelity recursion process comprising:
providing the DNS query to an authoritative name server;
receiving an answer to the DNS query from the authoritative name server;
sending a witness query to a witness;
receiving a response to the witness query from the witness; and
validating the answer to the DNS query from the authoritative name server based on the response to the witness query from the witness.
4. The computer-implemented method of claim 3 , wherein the high-fidelity recursion process further comprises at least one of:
discovering the witness,
negotiating a capability of the witness, or
validating the witness by evidence-based validation or by discovering a provenance of the witness.
5. The computer-implemented method of claim 3 , wherein the witness comprises at least one of:
a recursive resolver,
a non-recursive resolver,
a non-resolver witness,
a stub resolver, or
an authoritative name server.
6. The computer-implemented method of claim 2 , further comprising: determining whether to provide the first recursion process or the second recursion process, wherein the determining comprises consulting a stored policy.
7. The computer-implemented method of claim 3 , the witness comprising a plurality of witnesses, wherein the high-fidelity recursion process further comprises selecting one or more of the plurality of witnesses based on a specific purpose, wherein at least one of the plurality of witnesses is configured for the specific purpose.
8. The computer-implemented method of claim 1 , wherein the predetermined set of domains is configurable by a user.
9. The computer-implemented method of claim 1 , wherein the predetermined set of domains comprises a zone of related domains.
10. A computer-implemented method of resolving a Domain Name System (DNS) query for a domain name record, the method comprising,
determining, by a relying party, a capability offered by a resolver, wherein the capability relates to an association between the resolver and a predetermined set of domains;
determining, by a hardware processor of the relying party, whether the DNS query is for a domain within the predetermined set of domains; and
sending the DNS query to the resolver when the DNS query is for the domain within the predetermined set of domains, wherein the DNS query is resolved using a first recursion process.
11. The computer-implemented method of claim 10 , wherein the DNS query is resolved using a second recursion process when the DNS query is not for a domain within the predetermined set of domains.
12. The computer-implemented method of claim 10 , wherein the first recursion process comprises a high-fidelity recursion process comprising:
providing the DNS query to an authoritative name server;
receiving an answer to the DNS query from the authoritative name server;
sending a witness query to a witness;
receiving a response to the witness query from the witness; and
validating the answer to the DNS query from the authoritative name server based on the response to the witness query from the witness.
13. The computer-implemented method of claim 12 , wherein the high-fidelity recursion process further comprises at least one of:
discovering the witness,
negotiating a capability of the witness, or
validating the witness by evidence-based validation or by discovering a provenance of the witness.
14. The computer-implemented method of claim 12 , wherein the witness comprises at least one of:
a recursive resolver,
a non-recursive resolver,
a non-resolver witness,
a stub resolver, or
an authoritative name server.
15. The computer-implemented method of claim 11 , further comprising: determining whether to provide the first recursion process or the second recursion process, wherein the determining comprises consulting a stored policy.
16. The computer-implemented method of claim 12 , the witness comprising a plurality of witnesses, wherein the high-fidelity recursion process further comprises selecting one or more of the plurality of witnesses based on a specific purpose, wherein at least one of the plurality of witnesses is configured for the specific purpose.
17. The computer-implemented method of claim 10 , wherein the predetermined set of domains is configurable by a user.
18. The computer-implemented method of claim 10 , wherein the predetermined set of domains comprises a zone of related domains.
19. A computer-implemented method of resolving a Domain Name System (DNS) query for a domain name record, the method comprising,
determining, by a relying party, a first capability offered by a first resolver, wherein the first capability relates to a first association between the first resolver and a first predetermined set of domains;
determining, by the relying party, a second capability offered by a second resolver, wherein the second capability relates to a second association between the second resolver and a second predetermined set of domains;
determining, by a hardware processor of the relying party, whether the DNS query is for a domain within the first predetermined set of domains;
sending the DNS query to the first resolver when the DNS query is for the domain within the first predetermined set of domains, wherein the first resolver resolves the DNS query using a first recursion process of the first resolver;
determining, by the hardware processor of the relying party, whether the DNS query is for a domain within the second predetermined set of domains, when the DNS query is not for the domain within the first predetermined set of domains; and
sending the DNS query to the second resolver when the DNS query is for the domain within the second predetermined set of domains, wherein the second resolver resolves the DNS query using a first recursion process of the second resolver.
20. The computer-implemented method of claim 19 , wherein the DNS query is resolved by a second recursion process when the DNS query is not for a domain within the first predetermined set of domains or the second predetermined set of domains.
21. The computer-implemented method of claim 19 , wherein the first recursion process of the first resolver and the first recursion process of the second resolver comprises a high-fidelity recursion process comprising:
providing the DNS query to an authoritative name server;
receiving an answer to the DNS query from the authoritative name server;
sending a witness query to a witness;
receiving a response to the witness query from the witness; and
validating the answer to the DNS query from the authoritative name server based on the response to the witness query from the witness.
22. The computer-implemented method of claim 21 , wherein the high-fidelity recursion process further comprises at least one of:
discovering the witness,
negotiating capabilities of the witness, or
validating the witness by evidence-based validation or by discovering a provenance of the witness.
23. The computer-implemented method of claim 21 , wherein the witness comprises at least one of:
a recursive resolver,
a non-recursive resolver,
a non-resolver witness,
a stub resolver, or
an authoritative name server.
24. The computer-implemented method of claim 20 , further comprising: determining whether to provide the first recursion process or the second recursion process by consulting a stored policy.
25. The computer-implemented method of claim 21 , the witness comprising a plurality of witnesses, wherein the high-fidelity recursion process further comprises selecting one or more of the plurality of witnesses based on a specific purpose, wherein at least one of the plurality of witnesses is configured for the specific purpose.
26. The computer-implemented method of claim 19 , wherein the first predetermined set of domains and the second predetermined set of domains are configurable by a user.
27. The computer-implemented method of claim 19 , wherein the first predetermined set of domains comprises a first zone of related domains, wherein the second predetermined set of domains comprises a second zone of related domains.