Recursive DNS nameserver

• US 8,606,926 B2
• Filed: 06/14/2006
• Issued: 12/10/2013
• Est. Priority Date: 06/14/2006
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: OpenDNS Incorporated (Cisco Systems, Inc.)
• Inventors: Ulevitch, David
• Primary Examiner(s): Donabed, Ninos
• Application Number:
  US11/424,230
• Publication Number:
  US 20070294419A1
• Time in Patent Office: 2,736 Days
• Field of Search: 709/230, 709/245, 709/227
• US Class Current: 709/227
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses

Abstract

A recursive DNS server receives a request for domain name information associated with a domain name from a subscriber. In response to the request for domain name information, the recursive DNS nameserver determines a subscriber identifier and subscriber information associated with the subscriber identifier. The recursive DNS nameserver resolves the request for domain name information based on the subscriber information to generate a response to the request for domain name information. The recursive DNS nameserver then returns the response to the request for domain name information to the subscriber.

Claims

1. A computer-implemented method of processing Domain Name System requests, the method comprising:

storing domain name records for a plurality of domain names at a DNS nameserver, each domain name of the plurality having a different owner, the domain name records including a subset of domain name records having a flag indicating an association with suspicious domains;

storing subscriber information for a set of subscribers, the subscriber information for each subscriber including preferences provided by the subscriber that indicate how to resolve requests from the subscriber for domain name information, the preferences applying across the plurality of domain names, the preferences including at least one preference for resolving requests associated with the suspicious domains;

receiving at the DNS nameserver from a first subscriber of domain name resolution services a request for domain name information associated with a first domain name having a first owner and having a domain name record including a flag indicating an association with the suspicious domains;

determining ageing information associated with the first domain name;

storing the ageing information in a domain name record for the first domain in a local cache;

managing the expiration of the domain name record for the first domain name in the local cache in accordance with the ageing information;

determining a subscriber identifier and subscriber information associated with the first subscriber in response to the request for domain name information;

resolving the request for domain name information based on the subscriber information associated with the first subscriber and the ageing information to generate a response to the request for domain name information; and

returning the response to the request for domain name information, the response including substitute domain name information for a domain unaffiliated with the first domain name.

2. The method of claim 1 wherein resolving the request for domain name information further comprises obtaining information associated with a domain name record for the first domain name from a local cache based on a positive determination that the local cache contains the domain name record for the first domain.

3. The method of claim 1 wherein resolving the request for domain name information further comprises obtaining a substitute Uniform Resource Locator that satisfies a substitution criterion for the first domain name in the request for domain name information.

4. The method of claim 3 wherein obtaining the substitute Uniform Resource Locator is based on a negative determination that a local cache contains a domain name record for the first domain name in the request for domain name information.

5. The method of claim 3 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

6. The method of claim 3 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

7. The method of claim 1 wherein resolving the request for domain name information further comprises retrieving the domain name information associated with the first domain name from an authoritative nameserver.

8. The method of claim 1 further comprising storing the response to the request for domain name information in a domain name record for the first domain name in a local cache.

9. The method of claim 1, wherein

resolving the request for domain name information in accordance with the flag and the at least one preference for resolving requests associated with suspicious domains.

10. The method of claim 9 further comprising providing an indication in the response based on the at least one preference in the subscriber information that the first domain name in the request for domain name information is identified as a suspicious site.

11. The method of claim 1 further comprising:

receiving geographic location information related to the subscriber identifier for the first subscriber; and

resolving the request for domain name information based on the geographic location information related to the subscriber identifier for the first subscriber.

12. A recursive domain nameserver for recursively processing Domain Name Service requests, the recursive domain nameserver comprising:

a communications interface exchanging data with a communications network;

one or more storage devices maintaining subscriber information for a plurality of subscribers of domain name resolution services provided by the recursive domain nameserver, the subscriber information including subscriber-provided preferences that indicate how to resolve requests from the subscribers for domain name information associated with a plurality of domains, the preferences including at least one preference for resolving requests associated with suspicious domains, the one or more storage devices maintaining domain name records for a plurality of domain names, each domain name of the plurality having a different owner, the domain name records including a subset of domain name records having a flag indicating an association with the suspicious domains; and

a processor coupled to the communications interface and the one or more storage devices, the processor configured to receive a first request for domain name information associated with a first domain name having a domain name record including a flag indicating an association with the suspicious domains, determine ageing information associated with the first domain name, store the ageing information in the domain name record for the first domain name in a local cache, manage expiration of the domain name record for the first domain name from the local cache in accordance with the ageing information, determine a subscriber identifier and subscriber information associated with the subscriber identifier in response to the first request for domain name information, resolve the first request for domain name information based on the subscriber information and the ageing information to generate a response to the first request for domain name information, and return the response to the first request for domain name information, the response including substitute domain name information for a domain unaffiliated with the first domain name.

13. The recursive domain nameserver of claim 12 wherein the processor is further configured to obtain information associated with a domain name record for the first domain name from a local cache based on a positive determination that the local cache contains the domain name record for the first domain name.

14. The recursive domain nameserver of claim 12 wherein the processor is further configured to obtain a substitute Uniform Resource Locator that satisfies a substitution criterion for the first domain name in the first request for domain name information.

15. The recursive domain nameserver of claim 14 wherein the processor is further configured to obtain the substitute Uniform Resource Locator based on a negative determination that a local cache contains a domain name record for the first domain name in the first request for domain name information.

16. The recursive domain nameserver of claim 14 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the first request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

17. The recursive domain nameserver of claim 14 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the first request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

18. The recursive domain nameserver of claim 12 wherein the processor is further configured to retrieve the domain name information associated with the first domain name from an authoritative nameserver.

19. The recursive domain nameserver of claim 12 wherein the processor is further configured to store the response to the first request for domain name information in a domain name record for the first domain in a local cache.

20. The recursive domain nameserver of claim 12 wherein the processor is further configured to provide an indication in the response based on the one or more preferences in the subscriber information that the first domain name in the first request for domain name information is identified as a suspicious site.

21. The recursive domain nameserver of claim 12 wherein the processor is further configured to receive geographic location information related to the subscriber identifier, and resolve the first request for domain name information based on the geographic location information related to the subscriber identifier.

22. A computer readable storage device including a computer readable medium containing instructions executable by a computer, the executable instructions comprising:

code for receiving subscriber information from a subscriber of recursive domain name resolution services, the subscriber information including a set of preferences that indicate how to resolve requests from the subscriber for domain name information, the preferences applying across the plurality of domain names, the preferences including at least one preference for resolving requests associated with suspicious domains, and wherein domain name records for a plurality of domain names are stored at a DNS nameserver, each domain name of the plurality having a different owner, the domain name records including a subset of domain name records having a flag indicating an association with the suspicious domains;

code for receiving a request for domain name information associated with a domain name having a domain name record including a flag indicating an association with the suspicious domains;

code for determining ageing information associated with the domain name;

code for storing the ageing information in a domain name record in a local cache;

code for managing the expiration of the domain name record from the local cache in accordance with the ageing information;

code for determining a subscriber identifier and subscriber information in response to the request for domain name information;

code for resolving the request for domain name information based on the subscriber information and the ageing information to generate a response to the request for domain name information;

code for returning the response to the request for domain name information, the response including substitute domain name information for a domain unaffiliated with the first domain name.

23. The computer program product of claim 22 further comprising code for obtaining information associated with a domain name record for the domain name from a local cache based on a positive determination that the local cache contains the domain name record.

24. The computer program product of claim 22 wherein the code for resolving the request for domain name information further comprises code for obtaining a substitute Uniform Resource Locator that satisfies a substitution criterion for the domain name in the request for domain name information.

25. The computer program product of claim 24 further comprising code for obtaining the substitute Uniform Resource Locator based on a negative determination that a local cache contains a domain name record for the domain name in the request for domain name information.

26. The computer program product of claim 24 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

27. The computer program product of claim 24 wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and the referrer identifier in the substitute Uniform Resource Locator.

28. The computer program product of claim 22 further comprising code for retrieving the domain name information associated with the domain name from an authoritative nameserver.

29. The computer program product of claim 22 further comprising code for storing the response to the request for domain name information in a domain name record in a local cache.

30. The computer program product of claim 22 further comprising:

code for resolving the request for domain name information in accordance with the flag and one or more resolution preferences for resolving domain name requests in the subscriber information.

31. The computer program product of claim 30 further comprising code for providing an indication in the response based on the one or more preferences in the subscriber information that the domain name is identified as a suspicious site.

32. The computer program product of claim 22 further comprising:

code for receiving geographic location information related to the subscriber identifier; and

code for resolving the request for domain name information based on the geographic location information related to the subscriber identifier.