Collecting passive DNS traffic to generate a virtual authoritative DNS server

1. A method, comprising:

capturing domain name system (DNS) data;

receiving a trigger notification, the trigger notification indicating a zone associated with an authoritative DNS server is compromised;

determining whether a recursive DNS resolver has valid cached information associated with the zone; and

when it is determined the recursive DNS resolver does not have valid cached information associated with the zone:

causing the recursive DNS resolver to retrieve last known valid information associated with the zone from an observer system, the last known valid information being captured from the DNS data;

generating a virtual zone using the last known valid information; and

causing the recursive DNS resolver to host the virtual zone.

2. The method of claim 1 , wherein the authoritative DNS server is associated with a first entity and the recursive DNS resolver is associated with a second entity.

3. The method of claim 1 , wherein the domain name system data is passively captured by the observer system.

4. The method of claim 1 , further comprising deconstructing the virtual zone when the trigger notification is resolved.

5. The method of claim 1 , wherein the cached information is an internet protocol (IP) address associated with the authoritative DNS server.

6. The method of claim 1 , further comprising causing the virtual zone to provide a last known valid internet protocol (IP) address associated with the authoritative DNS server.

7. The method of claim 1 , further comprising causing the virtual zone to provide public key data information to a requesting device.

8. The method of claim 1 , further comprising enabling the recursive DNS resolver to provide private key data information to a requesting device.

9. A method, comprising:

passively capturing domain name system (DNS) data;

detecting a trigger event associated with an authoritative DNS server;

in response to detecting the trigger event, determining whether a recursive DNS resolver has valid cached information associated with the authoritative DNS server; and

when it is determined the recursive DNS resolver does not have valid cached information associated with a zone:

causing the recursive DNS resolver to retrieve last known valid information associated with the zone from an observer system, the last known valid information being associated with the passively captured DNS data; and

causing the recursive DNS resolver to use the passively captured DNS data to provide an answer to a query received from a remote computing device.

10. The method of claim 9 , further comprising storing the passively captured DNS data at the observer system.

11. The method of claim 9 , wherein detecting the trigger event comprises detecting a change in an address record associated with the authoritative DNS server.

12. The method of claim 9 , wherein detecting the trigger event comprises receiving a notification from an entity associated with the authoritative DNS server.

13. The method of claim 9 , wherein detecting the trigger event comprises determining that an internet protocol (IP) address associated with an answer to a received query is identified in a database of known IP address threats.

14. The method of claim 9 , wherein the passively captured DNS data is associated with a geographic area.

15. The method of claim 9 , further comprising generating a virtual authoritative DNS server using the passively captured DNS data.

16. The method of claim 15 , further comprising causing the recursive DNS resolver to host the virtual authoritative DNS server.

17. A system, comprising:

a recursive domain name system (DNS) resolver; and

an observer system implemented in a physical computing device using one or more hardware components that:

captures DNS data as DNS data is passed between the recursive DNS resolver and an authoritative DNS server; and

causes the recursive DNS resolver to host a generated virtual zone that includes last known valid zone information of a zone associated with the authoritative DNS server, the generated virtual zone being associated with the zone.

18. The system of claim 17 , wherein the last known valid zone information includes an internet protocol (IP) address.

19. The system of claim 17 , wherein the observer system detects a trigger event that causes the recursive DNS resolver to host the generated virtual zone.

20. The system of claim 19 , wherein the trigger event is automatically detected based, at least in part, on the captured DNS data.