Abstract:The DNS root server is at the top of the hierarchical structure of the DNS system and is the initial node that bootstraps all DNS queries. If the root server resolves abnormally, all domain name resolutions will fail, and many users cannot access the Internet. For this reason, this paper detects the root server itself resolution anomalies and non-self resolution anomalies by constructing high-confidence root zone file and anomaly judgment rules. First, we use the weighted voting statistics method to build high-confidence root zone file by calculating the confidence of multi-source root zone files. Based on high-confidence root zone files, we construct three types of anomaly detection judgment rules: (1) root-side resolution anomaly judgment rules based on feature value matching, (2) response hijacking judgment rules by correlating response anomaly features and resolution routing information, (3) root zone file synchronization anomaly judgment rules by calculating the relative synchronization delay of multi-source root zone files. Finally, using three anomaly judgment rules, we perform anomaly detection on the root resolution data obtained by active measurement. Our detection results show that root zone file synchronization delay distributions of different root server instances vary greatly. Some instances even show minute-level convergence, resulting in incorrect resolution for some TLDs. We also detect one response hijacking incident for 2 TLDs resolution, caused by the domain takeover mechanism adopted by the ISP to reduce inter-domain traffic settlement and decrease resolution latency. Except for the unresponsive exception caused by network packet loss, no root-side resolution anomaly is found, indicating that there is no artificial manipulation of TLD resolution on the root server and reflecting the responsibility of each root server operator aiming to maintain global Internet interconnection. The detection results show that the detection rules proposed in this paper can effectively achieve the anomaly detection of root server resolution and help to maintain the health and stability of the DNS system.

Analysis And Measurement Of Zone Dependency In The Domain Name System

Robust or Risky: Measurement and Analysis of Domain Resolution Dependency

Modeling, Measuring, and Analyzing the Resolution Process of Popular Domains.

Survey on Domain Name System Security.

DNSWeight: Quantifying Country-Wise Importance of Domain Name System

Measurement and Analysis on DNS Configuration Errors in.CN Domain

Inconsistency Between Domain Name and Server Location: Phenomena, Causes, and Countermeasures

Reexamining DNS from a Global Recursive Resolver Perspective

Authoritative Server’s Impact on Domain Name System’s Performance and Security

DNS Root Server Resolution Anomaly Detection

DNS configuration detection model

Traffic Measurement Based DNSSEC Analysis

A Cdn-Based Domain Name System

Performance Analysis of a Fast Domain Naming System

A Comprehensive Study of DNS Operational Issues by Mining DNS Forums

Finding the Best Answer: Measuring the Optimization of Public and Authoritative DNS.

Formal Description and Quantitative Analysis of DNSSEC Resolution Service

Evaluating the Quality of Service of the DNS Root Server from the Service Scope

ZDNS: A Fast DNS Toolkit for Internet Measurement

Configuration anormaly detection and resolution risk assessment of authoritative domain name server