Request routing processing
Generally described, the present disclosure is directed to managing request routing functionality corresponding to resource requests for one or more resources associated with a content provider. The processing of the DNS requests by the service provider can include the selective filtering of DNS queries associated with a DNS query-based attack. A service provider can assign DNS servers corresponding to a distributed set of network addresses, or portions of network addresses, such that DNS queries exceeding a threshold, such as in DNS query-based attacks, can be filtered in a manner that can mitigate performance impact on for the content provider or service provider.
1. A computer-implemented method for managing DNS queries comprising:
determining, by a service provider, that DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider; and
causing, by the service provider, filtering of a portion of the DNS queries, wherein the filtering of the portion of the DNS queries is based on selection of a portion of assigned network addresses for a DNS server authoritative for the identified domain, wherein the assigned network addresses for a DNS server authoritative for the identified domain are selected from a divisible range of available service provider network addresses corresponding to a plurality of network address zones.
2. The computer-implemented method as recited in claim 1 further comprising determining not to filter a different portion of the DNS queries.
3. The computer-implemented method as recited in claim 2 , wherein determining not to filter a different portion of the DNS queries is based on selection of different assigned network addresses for the DNS server authoritative for the identified domain.
4. The computer-implemented method as recited in claim 1 , wherein causing the filtering of a portion of the DNS queries is further based on a percentage of DNS queries allowed to be processed.
5. The computer-implemented method as recited in claim 1 , wherein each network address zone is defined according to a division of available network addresses for service provider DNS servers.
6. The computer-implemented method as recited in claim 1 further comprising:
obtaining, by the service provider, one or more additional DNS queries, the additional DNS queries corresponding to the identifiable domain;
associate the one or more additional DNS queries with the determined DNS queries exceeding the threshold number of DNS queries that can be processed by the service provider; and
determine not to filter the one or more additional DNS queries.
7. The computer-implemented method as recited in claim 6 , wherein the one or more additional DNS queries correspond to a different assigned network address.
8. A system comprising:
a DNS query processor, at a service provider, coupled to memory and operative to:
determine that DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider; and cause filtering of a portion of the DNS queries, wherein the filtering of the portion of the DNS queries is based on selection of a portion of assigned network addresses for a DNS server authoritative for the identified domain, wherein the assigned network addresses for a DNS server authoritative for the identified domain are selected from a divisible range of available service provider network addresses corresponding to a plurality of network address zones.
9. The system as recited in claim 8 , wherein the DNS query processor is further operative to determine not to filter a different portion of the DNS queries.
10. The system as recited in claim 9 , wherein determining not to filter a different portion of the DNS queries is based on selection of different assigned network addresses for the DNS server authoritative for the identified domain.