Selective routing of domain name system (DNS) requests

• US 10,616,179 B1
• Filed: 06/25/2015
• Issued: 04/07/2020
• Est. Priority Date: 06/25/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: McCarriar, Daniel Lee, Wantuch, Andrew Charles, Lizcano, Leonardo, Ngo, Steven Hunton, Liu, Xin, Schultheiss, Kyle Benjamin, Zen, Lee-Ming, Gu, Yu, Xiang, Fan, Santoso, Yohanes
• Primary Examiner(s): Choudhury, Azizul
• Application Number:
  US14/750,698
• Time in Patent Office: 1,748 Days
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

Domain Name System (DNS) requests can be routed to either a private DNS server or a public DNS server based on a determination made by a DNS classifier. The private DNS server allows customers to use custom DNS names for internal resources without exposing the names or IP addresses to the public Internet.

Claims

1. A method of selectively routing domain name system (DNS) requests, the method comprising:

receiving, by an intermediate classifier server computer, a DNS request including a domain name and an identifier from a host server computer in a multi-tenant environment, the host server computer hosting a virtual network environment and the DNS request originating from the host server computer;

extracting, by the intermediate classifier server computer, the identifier from the DNS request received from the host server computer, the identifier associated with a requester of the DNS request;

determining, by the intermediate classifier server computer, whether to route the DNS request to a private DNS server computer in charge of private domain names or to a public DNS server computer in charge of public domain names by using at least the extracted identifier to search whether the domain name is within a mapping table for the private DNS;

for a determination to route the DNS request to the private DNS server computer because the domain name is within the mapping table for the private DNS, performing a lookup using the identifier and the domain name; and

returning an address associated with the lookup from the private DNS server computer to the host server computer in response to the DNS request,

wherein determining whether to route the DNS request to the private DNS server computer or the public DNS server computer includes determining a logical data center that the DNS request originated.

2. The method of claim 1, wherein the address is a first address and further including:

for a determination to route the DNS request to the public DNS server computer, performing a lookup by the public DNS server computer using the domain name, without using the identifier, and returning a second address different than the first address in response to the DNS request so that the DNS request has different responses depending on the identifier associated with the requester.

3. The method of claim 1, determining whether to route the DNS request to the private DNS server computer or the public DNS server computer includes determining whether the request was generated from a virtual private network executing within the multitenant environment.

4. The method of claim 3, wherein DNS requests generated from within the virtual private network resolve differently than DNS requests generated outside of the virtual private network.

5. The method of claim 1, wherein the requester is a virtual private network associated with a customer of the multi-tenant network.

6. A computer-readable storage medium including instructions that upon execution cause a computer system to:

receive a Domain Name System (DNS) request in a classifier server computer of a service provider from an instance in a multi-tenant virtual network environment of the service provider, wherein the DNS originates from the instance and an identifier internal to the service provider is associated with the DNS request;

determine whether to forward the DNS request from the classifier server computer to a private DNS server computer that resolves private domain names or forward the DNS request from the classifier server computer to a public DNS server computer that resolves publicly available domain names, wherein the determination includes searching, by the classifier server computer, whether a domain name and the identifier associated with the DNS request matches a stored domain name within a mapping table of domain names and a stored identifier within a mapping table of identifiers assessable by the classifier server computer;

based on the searching, return an address associated with a selected one of the private DNS server computer or public DNS server computer;

determine a logical data center within the service provider from which the DNS request originated, wherein the DNS request is resolved differently based on the determined logical data center; and

based on the address, forward, by the classifier server computer, the DNS request to the selected one of the private DNS server computer or public DNS server computer to resolve the DNS request.

7. The computer-readable storage medium of claim 6, wherein the determination whether to forward the DNS request to a private or public DNS server computer is made based on whether the request was received from a host server computer within a virtual private network within the service provider.

8. The computer-readable storage medium according to claim 6, wherein instructions, upon execution, further cause the computer system to:

using the private DNS server, determine a geographical region from which the DNS request originated and use the geographic region in conjunction with the identifier to perform a domain name resolution.

9. The computer-readable storage medium according to claim 6, wherein publicly available domain names are registered domain names with a domain name registrar independent of the service provider and the private domain names are not registered with the domain name registrar and are maintained by the service provider.

10. The computer-readable storage medium according to claim 6, wherein the instructions, upon execution, further cause the computer system to:

receive a customer request to configure a private DNS zone associated with a virtual network within the service provider;

associating the identifier with the virtual network;

determine that the DNS request is associated with the identifier; and

perform a lookup using the identifier as a key to determine whether the private DNS server computer should resolve the DNS request.

11. The computer-readable storage medium according to claim 6, wherein the instructions, upon execution, further cause the computer system to:

receive a customer API request that controls which of the private and public DNS server computers for which to route the DNS request.

12. The computer-readable storage medium according to claim 6, wherein the instructions, upon execution, further cause the computer system to:

associate multiple virtual networks with a DNS hosted zone and domain names within the DNS hosted zone so that requests from any of the multiple virtual networks are routed to the private DNS server.

13. The computer-readable storage medium according to claim 6, wherein the instructions, upon execution, further cause the computer system to:

override existing domain name resolutions that are implemented by the public DNS server computer using the private DNS server so that private domain names can conflict with publicly available domain names.

14. The computer-readable storage medium according to claim 6, wherein the forwarding of the DNS request to the private DNS server computer includes incorporating an identifier of a virtual network with the DNS request and forwarding the DNS request to the public DNS server computer does not include the identifier of the virtual network.

15. A system for resolving Domain Name System (DNS) requests, comprising:

a multi-tenant environment including multiple server computers at least some of which are adapted to be used to host a virtual network environment;

a DNS classifier that is configured to receive a DNS request originating from the virtual network environment of the multi-tenant environment, to perform a lookup using an identifier of the DNS request associated with the virtual network environment, and to forward the DNS request to either a public DNS server computer or a private DNS server computer, wherein the lookup includes determining whether the DNS request is associated with a domain name that is found in a mapping table and wherein the DNS classifier forwards the DNS request based on an address returned by the lookup; and

the private DNS server computer coupled to the DNS classifier and configured to resolve the DNS request using the identifier and a domain name associated with the DNS request,

wherein the private DNS server is configured to determine a logical data center within the multitenant environments from which the DNS request originated and resolve the DNS request differently based on the determined logical data center.

16. The system of claim 15, further including storage configured to store the mapping table, wherein the mapping table associates identifiers of virtual network environments within the multi-tenant environment with information indicating whether there is a private domain associated with the identifier, wherein the information includes at least the domain name.

17. The system of claim 15, wherein the DNS classifier and the private DNS server computer are configured to override existing domain name resolutions that are implemented by the public DNS server computer so that private domain names can conflict with publicly available domain names.