Systems and methods for protection of authoritative name servers
In a network, Domain Name Service (DNS) queries may be handled by one or more resolvers and one or more authoritative name servers. If a DNS distributed denial of service attack is launched against the network, it may degrade the performance of the authoritative name servers. As such, systems and methods for protection of authoritative name servers are provided.
1 . A method, comprising:
receiving a first domain name service (DNS) query for a first domain;
determining that the first domain is within a first group of domains, each domain of the first group being a sub-domain of a second domain;
determining that the first domain does not exist;
in response to determining that the first domain does not exist, transitioning a first DNS resolver to a partially disabled state, for the first group;
receiving, in the partially disabled state, a second DNS query, for a third domain;
determining that the third domain is within the first group; and
treating, based on determining that the third domain is in within the first group, the third domain as unavailable in responding to the second DNS query,
wherein the first group is one of a set of groups of domains, the set of groups encompassing all sub-domains of the second domain, the set of groups including at least five groups and no more than 1000 groups.
2 . The method of claim 1 , wherein the second domain is a second-level domain.
3 . The method of claim 1 , further comprising, in response to determining that the first domain does not exist, incrementing a counter associated with the first group, wherein the transitioning to a partially disabled state is further in response to determining that the counter has exceeded a threshold.
4 . The method of claim 3 , further comprising:
receiving a third DNS query for a fourth domain;
determining that the fourth domain is within the first group of domains;
determining that the fourth domain does exist; and
in response to determining that the fourth domain does exist, decrementing the counter.
5 . The method of claim 3 , further comprising:
determining that the counter has fallen below a second threshold, and
in response to determining that the counter has fallen below the second threshold, transitioning to a normal state.
6 . The method of claim 1 , further comprising:
determining that a first amount of time has elapsed since the transitioning to the partially disabled state; and
in response to determining that a first amount of time has elapsed since the transitioning to the partially disabled state, transitioning to a normal state.
7 . The method of claim 1 , further comprising, in response to determining that the first domain does not exist, updating a cache of valid domains.
8 . The method of claim 7 , wherein the updating of the cache of valid domains comprises requesting, by the first DNS resolver, from a second DNS resolver, a list of valid domains in the first group and a list of corresponding IP addresses.
9 . The method of claim 1 , wherein the determining that the first domain does not exist comprises determining, by the first DNS resolver, that the first domain is in a list, cached in the first DNS resolver, of domains that do not exist.
10 . The method of claim 1 , wherein the determining that the first domain does not exist comprises:
forwarding the first DNS query to an authoritative name server; and
receiving, from the authoritative name server, an NXDOMAIN response code;
wherein treating the third domain as unavailable comprises returning a failure code in response to the second DNS query without forwarding the first DNS query to the authoritative name server.
11 . The method of claim 1 , wherein treating the third domain as nonexistent comprises returning a response to the second DNS query indicating that an Internet Protocol address for the third domain is not available.
12 . The method of claim 1 , further comprising receiving, in the partially disabled state, a third DNS query, for the third domain;
determining that the third DNS query meets a criterion for an exception to processing subject to the partially disabled state; and
forwarding the first DNS query to an authoritative name server.
13 . A system, comprising:
a processing circuit; and
one or more memories, operatively connected to the processing circuit and storing instructions that, when executed by the processing circuit, cause the system to perform a method, the method comprising:
receiving a first domain name service (DNS) query for a first domain;
determining that the first domain is within a first group of domains, each domain of the first group being a sub-domain of a second domain;
determining that the first domain does not exist;
in response to determining that the first domain does not exist, transitioning a first DNS resolver to a partially disabled state, for the first group;
receiving, in the partially disabled state, a second DNS query, for a third domain;
determining that the third domain is within the first group; and
treating, based on determining that the third domain is in within the first group, the third domain as unavailable in responding to the second DNS query,
wherein the first group is one of a set of groups of domains, the set of groups encompassing all sub-domains of the second domain, the set of groups including at least five groups and no more than 1000 groups.
14 . The system of claim 13 , wherein the second domain is a second-level domain.
15 . The system of claim 13 , further comprising, in response to determining that the first domain does not exist, incrementing a counter associated with the first group, wherein the transitioning to a partially disabled state is further in response to determining that the counter has exceeded a threshold.
16 . The system of claim 15 , further comprising:
receiving a third DNS query for a fourth domain;
determining that the fourth domain is within the first group of domains;
determining that the fourth domain does exist; and
in response to determining that the fourth domain does exist, decrementing the counter.
17 . The system of claim 15 , further comprising:
determining that the counter has fallen below a second threshold, and
in response to determining that the counter has fallen below the second threshold, transitioning to a normal state.
18 . The method of claim 13 , further comprising:
determining that a first amount of time has elapsed since the transitioning to the partially disabled state; and
in response to determining that a first amount of time has elapsed since the transitioning to the partially disabled state, transitioning to a normal state.
19 . A system, comprising:
a domain name service (DNS) resolver, and
an authoritative name server,
the DNS resolver being configured to:
receive a first DNS query for a first domain;
determine that the first domain is within a first group of domains, each domain of the first group being a sub-domain of a second domain;
determine that the first domain does not exist;
in response to determining that the first domain does not exist, transition to a partially disabled state, for the first group;
receive, in the partially disabled state, a second DNS query, for a third domain;
determine that the third domain is within the first group; and
treat, based on determining that the third domain is in within the first group, the third domain as unavailable in responding to the second DNS query,
wherein the first group is one of a set of groups of domains, the set of groups encompassing all sub-domains of the second domain, the set of groups including at least five groups and no more than 1000 groups.