Domain name resolution using a distributed DNS network

• US 7,725,602 B2
• Filed: 10/31/2005
• Issued: 05/25/2010
• Est. Priority Date: 07/19/2000
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Swildens, Eric Sven-Johan, Day, Richard David, Liu, Zaide “Edward”
• Primary Examiner(s): Jean; Frantz B
• Application Number:
  US11/264,616
• Publication Number:
  US 20060112176A1
• Time in Patent Office: 1,667 Days
• Field of Search: 709/246, 709/217, 709/218, 709/219, 709/203, 709/245, 709/225, 709/226, 709/238, 707/E17.12, 711/110, 711/118
• US Class Current: 709/245
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/289 Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A distributed DNS network includes a central origin server that actually controls the zone, and edge DNS cache servers configured to cache the DNS content of the origin server. The edge DNS cache servers are published as the authoritative servers for customer domains instead of the origin server. When a request for a DNS record results in a cache miss, the edge DNS cache servers get the information from the origin server and cache it for use in response to future requests. Multiple edge DNS cache servers can be deployed at multiple locations. Since an unlimited number of edge DNS cache servers can be deployed, the system is highly scalable. The disclosed techniques protect against DoS attacks, as DNS requests are not made to the origin server directly.

Claims

1. A method for dynamically distributing Domain Name System (DNS) name resolution requests from a client, comprising:

mapping a virtual DNS server IP address to a plurality of edge DNS cache servers, the plurality of edge DNS cache servers caching DNS content from an origin DNS server;

wherein DNS content comprises one or more DNS records;

publishing the virtual DNS server IP address as the authoritative DNS server for a domain;

receiving a domain name resolution request directed to the virtual DNS server IP address from a client; and

in response to receiving the domain name resolution request, selecting one of the plurality of edge DNS cache servers to serve the request;

wherein when the client is a known client and the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, the selected edge DNS cache server obtains the DNS content needed to answer the DNS name resolution request from the origin DNS server;

wherein the steps are performed by one or more computing devices.

2. The method of claim 1, wherein a zone associated with the domain is controlled by the origin DNS server.

3. The method of claim 1, wherein the origin DNS server receives DNS content updates from a user, and distributes the updates to the plurality of edge DNS cache servers in response to receiving the updates.

4. The method of claim 1, wherein the origin DNS server receives DNS content updates from a user, and the edge DNS cache servers receive the DNS content updates from the origin DNS server by making a request to the origin DNS server for updates.

5. The method of claim 1, wherein at least one edge DNS cache server is associated with a plurality of virtual DNS servers, and receives domain name resolution requests from clients for a plurality of domains.

6. The method of claim 1, wherein additionally comprising the steps of:

the selected edge DNS cache server caches the obtained DNS content.

7. The method of claim 6, wherein the selected edge DNS cache server obtains DNS content in addition to the DNS content needed to answer the domain name resolution request from the origin DNS server, and caches all DNS content obtained from the origin DNS server.

8. The method of claim 1, wherein the step of mapping a virtual DNS server IP address to the plurality of edge DNS cache servers comprises assigning the virtual server IP address to each of the plurality of edge DNS cache servers.

9. The method of claim 1, wherein the step of mapping a virtual DNS server IP address to the plurality of edge DNS cache servers comprises delegating a domain name to the plurality of edge DNS cache servers through CNAME records.

10. The method of claim 1, wherein the step of mapping a virtual DNS server IP address to the plurality of edge DNS cache servers comprises specifying an anycast address for the plurality of edge DNS cache servers.

11. The method of claim 1, wherein the step of mapping a virtual DNS server IP address to the plurality of edge DNS cache servers comprises using a load-balancing application that load balances the plurality of edge DNS cache servers.

12. The method of claim 1, additionally comprising the step of receiving probe information from at least one probe.

13. The method of claim 12, wherein the step of selecting one of the plurality of edge DNS cache servers to serve the request comprises using the received probe information to select one of the plurality of edge DNS cache servers.

14. The method of claim 12, wherein the DNS probe information contains data selected from the group comprising server availability, server load, and network proximity between the client and an edge DNS cache server.

15. The method of claim 1, wherein a first edge DNS cache server of the plurality of edge DNS cache servers is deployed in a first location, and a second edge DNS cache server of the plurality of edge DNS cache servers is deployed in a second location, wherein the first location is geographically separate from the second location.

16. The method of claim 1, additionally comprising:

determining a frequency of receiving domain name resolution requests from clients; and

detecting a Denial of Service attack based on the determined frequency.

17. The method of claim 16, wherein the step of detecting a Denial of Service attack comprises comparing the determined frequency with a threshold, and when the frequency is greater than the threshold, determining that a Denial of Service attack is occurring.

18. The method of claim 17, wherein when a Denial of Service attack is detected, further comprising the steps of:

when the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, not answering the domain name resolution request.

19. The method of claim 17, wherein when a Denial of Service attack is detected, further comprising:

the selected edge DNS cache server not answering the domain name resolution request when the client making the request is an unknown client.

20. A computer-readable storage medium storing one or more sequences of instructions for dynamically distributing Domain Name System (DNS) name resolution requests from client, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform steps comprising:

mapping a virtual DNS server IP address to a plurality of edge DNS cache servers, the plurality of edge DNS cache servers caching DNS content from an origin DNS server;

wherein DNS content comprises one or more DNS records;

publishing the virtual DNS server as the authoritative DNS server for a domain;

receiving a domain name resolution request from a client directed to the virtual DNS server IP address; and

in response to receiving the domain name resolution request, selecting one of the plurality of edge DNS cache servers to serve the request;

wherein when the client is a known client and the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request;

cached, the selected edge DNS cache server obtains the DNS content needed to answer the DNS name resolution request from the origin DNS server.

21. A distributed Domain Name System (DNS) network system comprising:

at least one origin DNS server;

a plurality of edge DNS cache servers, each edge DNS cache server caching DNS content from the origin DNS server, the DNS content comprising DNS records;

a DNS server load balancing component;

at least one probe;

wherein the DNS server load balancing component selects an edge DNS cache server to serve a domain name resolution request received from a client based on information from the at least one probe;

wherein when the client is a known client and the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, the selected edge DNS cache server obtains the DNS content needed to answer the DNS name resolution request from the origin DNS server.

22. The system of claim 21, additionally comprising administrative tools component that is used by a user to control the origin DNS server and monitor the distributed DNS network system.

23. The system of claim 22, wherein the administrative tools component is implemented as a HTTP-based application that can run on a browser.

24. An apparatus for dynamically distributing DNS name resolution requests from a client, comprising:

mapping logic configured to map a virtual DNS server IP address to a plurality of edge DNS cache servers, the plurality of edge DNS cache servers caching DNS content from an origin DNS server;

wherein DNS content comprises one or more DNS records;

publishing logic configured to publish the virtual DNS server as the authoritative DNS server for a domain;

receiving logic configured to receive a domain name resolution request from a client directed to the virtual DNS server IP address; and

selecting logic configured to select, in response to receiving the domain name resolution request, one of the plurality of edge DNS cache servers to serve the request;

wherein when the client is a known client and the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, the selected edge DNS cache server obtains the DNS content needed to answer the DNS name resolution request from the origin DNS server.

25. The apparatus of claim 24, wherein a zone associated with the domain is controlled by the origin DNS server.

26. The apparatus of claim 24, wherein the origin DNS server receives DNS content updates from a user, further comprising distributing means configured to distribute the updates to the plurality of edge DNS cache servers in response to receiving the updates.

27. The apparatus of claim 24, wherein the origin DNS server receives DNS content updates from a user, and the edge DNS cache servers receive the DNS content updates from the origin DNS server by making a request to the origin DNS server for updates.

28. The apparatus of claim 24, wherein at least one edge DNS cache server is associated with a plurality of virtual DNS servers, and receives domain name resolution requests from clients for a plurality of domains.

29. The apparatus of claim 24, additionally comprising:

caching logic configured to cache, at the selected edge DNS cache server, the obtained DNS content.

30. The apparatus of claim 29, wherein the selected edge DNS cache server obtains DNS content in addition to the DNS content needed to answer the domain name resolution request from the origin DNS server, and caches all DNS content obtained from the origin DNS server.

31. The apparatus of claim 24, wherein the mapping logic is further configured to assign the virtual server IP address to each of the plurality of edge DNS cache servers.

32. The apparatus of claim 24, wherein the mapping logic is further configured to delegate a domain name to the plurality of edge DNS cache servers through CNAME records.

33. The apparatus of claim 24, wherein the mapping logic is further configured to specify an anycast address for the plurality of edge DNS cache servers.

34. The apparatus of claim 24, wherein the mapping logic is further configured to use a load-balancing application that load balances the plurality of edge DNS cache servers.

35. The apparatus of claim 24, additionally comprising probe receiving logic configured to receive probe information from at least one probe.

36. The apparatus of claim 35, wherein the selecting logic is further configured to use the received probe information to select one of the plurality of edge DNS cache servers.

37. The apparatus of claim 35, wherein the DNS probe information contains data selected from the group comprising server availability, server load, and network proximity between the client and an edge DNS cache server.

38. The apparatus of claim 24, wherein a first edge DNS cache server of the plurality of edge DNS cache servers is deployed in a first location, and a second edge DNS cache server of the plurality of edge DNS cache servers is deployed in a second location, wherein the first location is geographically separate from the second location.

39. The apparatus of claim 24, additionally comprising:

frequency determination logic configured to determine a frequency of receiving domain name resolution requests from clients; and

detection logic configured to detect a Denial of Service attack based on the determined frequency.

40. The apparatus of claim 39, wherein the detection logic is further configured to compare the determined frequency with a threshold, and when the frequency is greater than the threshold, determine that a Denial of Service attack is occurring.

41. The apparatus of claim 40, wherein when a Denial of Service attack is detected, further comprising:

when the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, then not answering the domain name resolution request.

42. The apparatus of claim 40, wherein when a Denial of Service attack is detected, further comprising:

the selected edge DNS cache server does not have DNS content needed to serve the domain name resolution request cached, then means for the selected edge DNS cache server to obtain the DNS content needed to answer the DNS name resolution request from the origin DNS server if the client making the request is a known client, and the selected edge DNS cache server wherein when the client is an unknown client, the selected edge DNS cache server does not answering answer the domain name resolution request if the client making the request is an unknown client.