Domain name resolution using a distributed DNS network

• US 8,117,296 B2
• Filed: 05/25/2010
• Issued: 02/14/2012
• Est. Priority Date: 07/19/2000
• Status: Expired due to Term

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Liu, Zaide “Edward”, Swildens, Eric Sven-Johan, Day, Richard David
• Primary Examiner(s): Jean, Frantz
• Application Number:
  US12/786,895
• Publication Number:
  US 20100257258A1
• Time in Patent Office: 630 Days
• Field of Search: 709/220, 709/223, 709/235, 709/245, 713/150, 713/168
• US Class Current: 709/223
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/10015 Access to distributed or replicated servers, e.g. using brokers
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/289 Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A distributed DNS network includes a central origin server that actually controls the zone, and edge DNS cache servers configured to cache the DNS content of the origin server. The edge DNS cache servers are published as the authoritative servers for customer domains instead of the origin server. When a request for a DNS record results in a cache miss, the edge DNS cache servers get the information from the origin server and cache it for use in response to future requests. Multiple edge DNS cache servers can be deployed at multiple locations. Since an unlimited number of edge DNS cache servers can be deployed, the system is highly scalable. The disclosed techniques protect against DoS attacks, as DNS requests are not made to the origin server directly.

Claims

1. A computer-implemented method, comprising:

mapping a plurality of domain name service (DNS) cache servers to a virtual DNS server, the virtual DNS server being published as authoritative for a domain;

caching DNS content from an origin DNS server at the plurality of DNS cache servers, the DNS content comprising one or more DNS records for use in responding to DNS requests for the domain;

wherein DNS requests from clients for the domain are served by the plurality of DNS cache servers mapped to the authoritative virtual DNS server, instead of the origin DNS server, so as to hide the origin DNS server from such clients;

and wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the virtual DNS server is represented by an IP address, and mapping the plurality of DNS cache servers to the virtual DNS server comprises:

assigning the IP address to a first DNS cache server; and

assigning the IP address to a second DNS cache server.

3. The method of claim 2, further comprising:

configuring the IP address as an anycast address.

4. The method of claim 1, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises delegating the domain name to the plurality of DNS cache servers.

5. The method of claim 1, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises configuring a load-balancer to select one of the plurality of DNS cache servers to serve a given DNS request directed to the virtual DNS server.

6. The method of claim 1, wherein the domain is a content provider domain, the content provider controlling the origin DNS server, and wherein the virtual DNS server and the plurality of DNS cache servers are associated with a content delivery network service provider to which the content provider has outsourced delivery of content.

7. The method of claim 1, further comprising the plurality of DNS cache servers protecting the origin DNS server from attack.

8. The method of claim 7, wherein the plurality of DNS cache servers selectively respond to DNS queries to protect the origin DNS server from attack.

9. The method of claim 1, wherein the plurality of DNS cache servers are a plurality of edge DNS cache servers.

10. A computer-readable non-transitory medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform the following steps:

mapping a plurality of domain name service (DNS) cache servers to a virtual DNS server, the virtual DNS server being published as authoritative for a domain;

caching DNS content from an origin DNS server at the plurality of DNS cache servers, the DNS content comprising one or more DNS records for use in responding to DNS requests for the domain;

wherein DNS requests from clients for the domain are served by the plurality of DNS cache servers mapped to the authoritative virtual DNS server, instead of the origin DNS server, so as to hide the origin DNS server from such clients.

11. The computer-readable non-transitory medium of claim 10, wherein the virtual DNS server is represented by an IP address, and mapping the plurality of DNS cache servers to the virtual DNS server comprises:

assigning the IP address to a first DNS cache server; and

,

assigning the IP address to a second DNS cache server.

12. The computer-readable non-transitory medium of claim 11, wherein the steps further include:

configuring the IP address as an anycast address.

13. The computer-readable non-transitory medium of claim 10, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises delegating the domain name to the plurality of DNS cache servers.

14. The computer-readable non-transitory medium of claim 10, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises configuring a load-balancer to select one of the plurality of DNS cache servers to serve a given DNS requests directed to the virtual DNS server.

15. The computer-readable non-transitory medium of claim 10, wherein the domain is a content provider domain, the content provider controlling the origin DNS server, and wherein the virtual DNS server and the plurality of DNS cache servers are associated with a content delivery network service provider to which the content provider has outsourced delivery of content.

16. The computer-readable non-transitory medium of claim 10, wherein the steps include the plurality of DNS cache servers protect the origin DNS server from attack.

17. The computer-readable non-transitory medium of claim 16, wherein the plurality of DNS cache servers selectively respond to DNS queries to protect the origin DNS server from attack.

18. The computer-readable non-transitory medium of claim 10, wherein the plurality of DNS cache servers are a plurality of edge DNS cache servers.

19. An apparatus, comprising:

one or more processors and memory storing instructions that, when executed by the one or more processor, cause the apparatus to;

map a plurality of domain name service (DNS) cache servers to a virtual DNS server, the virtual DNS server being published as authoritative for a domain;

cache DNS content from an origin DNS server at the plurality of DNS cache servers, the DNS content comprising one or more DNS records for use in responding to DNS requests for the domain;

wherein DNS requests from clients for the domain are served by the plurality of DNS cache servers mapped to the authoritative virtual DNS server, instead of the origin DNS server, so as to hide the origin DNS server from such clients.

20. The apparatus of claim 19, wherein the virtual DNS server is represented by an IP address, and mapping the plurality of DNS cache servers to the virtual DNS server comprises:

assigning the IP address to a first DNS cache server; and

,

assigning the IP address to a second DNS cache server.

21. The apparatus of claim 20, wherein the executed instructions further cause the apparatus to:

configure the IP address as an anycast address.

22. The apparatus of claim 19, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises delegating the domain name to the plurality of DNS cache servers.

23. The apparatus of claim 19, wherein mapping the plurality of DNS cache servers to the virtual DNS server comprises configuring a load-balancer to select one of the plurality of DNS cache servers to serve a given DNS request directed to the virtual DNS server.

24. The apparatus of claim 19, wherein the domain is a content provider domain, the content provider controlling the origin DNS server, and wherein the virtual DNS server and the plurality of DNS cache servers are associated with a content delivery network service provider to which the content provider has outsourced delivery of content.

25. The apparatus of claim 19, wherein upon execution the one or more instructions cause the plurality of cache DNS servers protect the origin DNS server from attack.

26. The apparatus of claim 25, wherein upon execution the one or more instructions cause the plurality of cache DNS servers selectively respond to DNS queries to protect the origin DNS server from attack.

27. The apparatus of claim 19, wherein the plurality of DNS cache servers are a plurality of edge DNS cache servers.