Resilient domain name service (DNS) resolution when an authoritative name server is degraded

Patent metadata

Field	Value
Publication number	US-11025482-B2
Application number	US-201815881596-A
Country	US
Kind code	B2
Filing date	Jan 26, 2018
Priority date	Jun 26, 2017
Publication date	Jun 1, 2021
Grant date	Jun 1, 2021

Abstract

In one embodiment, a resolution resiliency application modifies domain name service (DNS) resolution. In operation, the resolution resiliency application determines that an authoritative name server has begun recovering from a degraded state or receives a flush list update from the authoritative name server. In response, the resolution resiliency application performs operation(s) that modify a query rate and/or a cache. The query rate specifies a frequency associated with DNS queries transmitted to the first authoritative name server. The cache stores DNS record(s) received from the first authoritative name server. Finally, the resolution resiliency application generates a DNS response to a DNS query based on the modified query rate and/or the modified cache.

First claim

What is claimed is:

1. A computer-implemented method for modifying domain name service (DNS) resolution, the method comprising:
determining, by a resolution resiliency application included with a recursive resolver and based on a status record received from a first authoritative name server or a second authoritative name server, that the first authoritative name server is in a degraded state;
setting a first rate limit on a query rate, wherein the query rate specifies a frequency associated with the recursive resolver transmitting DNS queries to the first authoritative name server;
determining, by the resolution resiliency application, that the first authoritative name server has begun recovering from a degraded state by detecting:
(i) an increase in a quantity of positive DNS responses received from the first authoritative name server from a first quantity detected while the first authoritative name server is in the degraded state, or
(ii) an increase in a response rate of positive DNS responses received from the first authoritative name server from a first response rate detected while the first authoritative name server is in the degraded state; and

in response, removing, by the resolution resiliency application, the first rate limit on the query rate.

2. The computer-implemented method of claim 1 , further comprising, subsequent to removing the first rate limit, setting a flush time equal to a current time.

3. The computer-implemented method of claim 1 , further comprising setting second rate limit on the query rate, wherein the second rate limit is higher than the first rate limit.

4. The computer-implemented method of claim 3 , wherein the second rate limit is based on an elapsed time between a current time and an initial recovery time associated with the degraded state.

5. The computer-implemented method of claim 3 , further comprising:
after removing the first rate limit, receiving a DNS query;
determining that a cache does not include a DNS record associated with the DNS query;
determining that the second rate limit allows the DNS query to be transmitted to the first authoritative name server; and
transmitting the DNS query to the first authoritative name server, wherein the first authoritative name server provides the DNS response.

6. The computer-implemented method of claim 3 , wherein generating the DNS response comprises:
after removing the first rate limit, receiving a DNS query;
determining that a cache does not include a DNS record associated with the DNS query;
determining that the second rate limit prohibits the DNS query from being transmitted to the first authoritative name server; and
transmitting the DNS query to the second authoritative name server, wherein the second authoritative name server provides the DNS response.

7. The computer-implemented method of claim 3 , wherein the second rate limit is an unlimited rate.

8. The computer-implemented method of claim 1 , wherein removing the first rate limit on the query rate comprises modifying the first rate limit from a first rate to a second rate, wherein the second rate is higher than the first rate.

9. The computer-implemented method of claim 8 , wherein the second rate is an unlimited rate.

10. One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:
determining, by a resolution resiliency application included with a recursive resolver and based on a status record received from a first authoritative name server or a second authoritative name server, that the first authoritative name server is in a degraded state;
setting a first rate limit on a query rate, wherein the query rate specifies a frequency associated with the recursive resolver transmitting DNS queries to the first authoritative name server;
determining, by the resolution resiliency application, that the first authoritative name server has begun recovering from a degraded state, by detecting:
(i) an increase in a quantity of positive DNS responses received from the first authoritative name server from a first quantity detected while the first authoritative name server is in the degraded state, or
(ii) an increase in a response rate of positive DNS responses received from the first authoritative name server from a first response rate detected while the first authoritative name server is in the degraded state; and

in response, removing, by the resolution resiliency application, the first rate limit on the query rate.

11. The one or more non-transitory computer-readable storage media of claim 10 , further including instructions that, when executed by the one or more processors, cause the one or more processors to perform the steps of:
upon determining that the first authoritative name server has begun recovering from the degraded state, receiving, by the resolution resiliency application from the first authoritative name server, a flush list update;
determining that a first DNS record, included in a cache of the recursive resolver, is included in the flush list update; and
deleting the first DNS record from the cache.

12. The one or more non-transitory computer-readable storage media of claim 10 , further comprising setting a second rate limit on the query rate, wherein the second rate is based on an elapsed time between a current time and an initial recovery time associated with the degraded state.

13. The one or more non-transitory computer-readable storage media of claim 12 , wherein generating the DNS response comprises:
after removing the first rate limit, receiving a DNS query;
determining that a cache does not include a DNS record associated with the DNS query;
determining that the second rate limit allows the DNS query to be transmitted to the first authoritative name server; and
transmitting the DNS query to the first authoritative name server, wherein the first authoritative name server provides the DNS response.

14. The one or more non-transitory computer-readable storage media of claim 13 , wherein:
the DNS query specifies a domain name that is included in a first zone,
the first authoritative name server is associated with the first zone, and
the second authoritative name server is associated with the first zone.

15. The one or more non-transitory computer-readable storage media of claim 12 , wherein generating the DNS response comprises:
after removing the first rate limit, receiving a DNS query;
determining that a cache does not include a DNS record associated with the DNS query;
determining that the second rate limit prohibits the DNS query from being transmitted to the first authoritative name server; and
specifying a DNS return code that indicates a server error.

16. The one or more non-transitory computer-readable storage media of claim 10 , wherein each positive DNS response includes a requested DNS record.

17. A system comprising:
a memory storing a resolution resiliency application; and
a processor that is coupled to the memory, and executes the resolution resiliency application by:
determining, by a resolution resiliency application included with a recursive resolver and based on a status record received from a first authoritative name server or a second authoritative name server, that the first authoritative name server is in a degraded state;
setting first rate limit on a query rate, wherein the query rate specifies a frequency associated with the recursive resolver transmitting DNS queries to the first authoritative name server;
determinin

Assignees

• Verisign Inc

Inventors

• Huque Shumon
• Kaliski Jr Burton S
• Osterweil Eric
• Scalzo Frank
• Wessels Duane
• Wiley Glen

Classifications

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L61/58

  Caching of addresses or names · CPC title

• H04L61/45

  Network directories; Name-to-address mapping · CPC title

• H04L61/5076

  Update or notification mechanisms, e.g. DynDNS · CPC title

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title