Abstract:The root zone is located at the top level of the DNS system's hierarchical structure and serves as the entry point for all domain name resolutions. The accuracy of the root zone file determines whether domain names can be resolved correctly. To solve the problems of single-source distrust and inaccurate data in the use of root zone files, this paper utilizes multi-source root zone files to build an accurate, real-time, and highly trustworthy root zone file through the validation of data accuracy and integrity. First, we propose a weighted voting statistical verification method. We select top-level domain name records with the highest confidence from the multi-source root zone data, thereby improving data accuracy. Second, through a dynamic cyclic construction process, we achieve dynamic monitoring of root zone file version changes, effectively ensuring the real-time nature of root zone data. Finally, we adopt a DNSSEC verification mechanism to address the issue of unreliable transmission paths for actively probed root zone data, ensuring data integrity by verifying the signed top-level domain name records and their ZSK, KSK keys. In addition, through the analysis of experimental data, we find that the main reason for the inaccuracy and unreliability of the root zone file is the delay in updating and synchronizing the file. We also discover the presence of redundant KSK keys in some of the source root zone data, which led to failure in the DNSSEC validation chain. The high-trust root zone file constructed in this paper provides data support for research on the root-side resolution anomaly detection and localization application of root zone files and has wide-ranging practical value.

Rethinking DNS Configuration Verification with a Distributed Architecture

Automated Verification of an In-Production DNS Authoritative Engine

Research on Cross-Domain Trustable Blockchain Based Decentralized DNS Architecture

Research on the Construction of High-Trust Root Zone File Based on Multi-Source Data Verification

Assisting Reachability Verification of Network Configurations Updates with NUV

Reexamining DNS from a Global Recursive Resolver Perspective

Toward Comprehensive Network Verification: Practices, Challenges and Beyond

Configuration anormaly detection and resolution risk assessment of authoritative domain name server

A Highly Compatible Verification Framework with Minimal Upgrades to Secure An Existing Edge Network

TI-DNS: A Trusted and Incentive DNS Resolution Architecture based on Blockchain

Design and Implementation of Traditional DNS Protocol

A Practical Solution to the Client-Ldns Mismatch Problem

Measurement and Analysis on DNS Configuration Errors in.CN Domain

SafeZone: A Hierarchical Inter-Domain Authenticated Source Address Validation Solution

Accuracy, Scalability, Coverage

Distributed Consistent Network Updates in SDNs: Local Verification for Global Guarantees

Carbide: Highly Reliable Networks Through Real-Time Multiple Control Plane Composition

DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels

A Lightweight Packet Forwarding Verification in SDN using Sketch

Robust or Risky: Measurement and Analysis of Domain Resolution Dependency

An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?