Abstract:The DNS root server is at the top of the hierarchical structure of the DNS system and is the initial node that bootstraps all DNS queries. If the root server resolves abnormally, all domain name resolutions will fail, and many users cannot access the Internet. For this reason, this paper detects the root server itself resolution anomalies and non-self resolution anomalies by constructing high-confidence root zone file and anomaly judgment rules. First, we use the weighted voting statistics method to build high-confidence root zone file by calculating the confidence of multi-source root zone files. Based on high-confidence root zone files, we construct three types of anomaly detection judgment rules: (1) root-side resolution anomaly judgment rules based on feature value matching, (2) response hijacking judgment rules by correlating response anomaly features and resolution routing information, (3) root zone file synchronization anomaly judgment rules by calculating the relative synchronization delay of multi-source root zone files. Finally, using three anomaly judgment rules, we perform anomaly detection on the root resolution data obtained by active measurement. Our detection results show that root zone file synchronization delay distributions of different root server instances vary greatly. Some instances even show minute-level convergence, resulting in incorrect resolution for some TLDs. We also detect one response hijacking incident for 2 TLDs resolution, caused by the domain takeover mechanism adopted by the ISP to reduce inter-domain traffic settlement and decrease resolution latency. Except for the unresponsive exception caused by network packet loss, no root-side resolution anomaly is found, indicating that there is no artificial manipulation of TLD resolution on the root server and reflecting the responsibility of each root server operator aiming to maintain global Internet interconnection. The detection results show that the detection rules proposed in this paper can effectively achieve the anomaly detection of root server resolution and help to maintain the health and stability of the DNS system.

Measurement and Analysis on DNS Configuration Errors in.CN Domain

DNS configuration detection model

Inconsistency Between Domain Name and Server Location: Phenomena, Causes, and Countermeasures

Configuration anormaly detection and resolution risk assessment of authoritative domain name server

Research on DNS Authoritative Server's Performance and Security

Authoritative Server’s Impact on Domain Name System’s Performance and Security

Survey on Domain Name System Security.

Modeling, Measuring, and Analyzing the Resolution Process of Popular Domains.

Reexamining DNS from a global recursive resolver perspective

Analysis And Measurement Of Zone Dependency In The Domain Name System

Measuring Update Performance and Consistency Anomalies in Managed DNS Services

A Comprehensive Study of DNS Operational Issues by Mining DNS Forums

Evaluating the Quality of Service of the DNS Root Server from the Service Scope

DNS Root Server Resolution Anomaly Detection

Robust or Risky: Measurement and Analysis of Domain Resolution Dependency

Traffic Measurement Based DNSSEC Analysis

Formal Description and Quantitative Analysis of DNSSEC Resolution Service

Performance Analysis of a Fast Domain Naming System

Measuring the Practical Effect of DNS Root Server Instances: A China-Wide Case Study

Investigating Deployment Issues of DNS Root Server Instances from a China-wide View

Design and Implementation of Traditional DNS Protocol