Abstract:The DNS root server is at the top of the hierarchical structure of the DNS system and is the initial node that bootstraps all DNS queries. If the root server resolves abnormally, all domain name resolutions will fail, and many users cannot access the Internet. For this reason, this paper detects the root server itself resolution anomalies and non-self resolution anomalies by constructing high-confidence root zone file and anomaly judgment rules. First, we use the weighted voting statistics method to build high-confidence root zone file by calculating the confidence of multi-source root zone files. Based on high-confidence root zone files, we construct three types of anomaly detection judgment rules: (1) root-side resolution anomaly judgment rules based on feature value matching, (2) response hijacking judgment rules by correlating response anomaly features and resolution routing information, (3) root zone file synchronization anomaly judgment rules by calculating the relative synchronization delay of multi-source root zone files. Finally, using three anomaly judgment rules, we perform anomaly detection on the root resolution data obtained by active measurement. Our detection results show that root zone file synchronization delay distributions of different root server instances vary greatly. Some instances even show minute-level convergence, resulting in incorrect resolution for some TLDs. We also detect one response hijacking incident for 2 TLDs resolution, caused by the domain takeover mechanism adopted by the ISP to reduce inter-domain traffic settlement and decrease resolution latency. Except for the unresponsive exception caused by network packet loss, no root-side resolution anomaly is found, indicating that there is no artificial manipulation of TLD resolution on the root server and reflecting the responsibility of each root server operator aiming to maintain global Internet interconnection. The detection results show that the detection rules proposed in this paper can effectively achieve the anomaly detection of root server resolution and help to maintain the health and stability of the DNS system.

Unravelling DNS Performance: A Historical Examination of F-ROOT in Southeast Asia

Measuring the Practical Effect of DNS Root Server Instances: A China-Wide Case Study

Performance Analysis of Root Anycast Nodes Based on Active Measurement

Investigating Deployment Issues of DNS Root Server Instances from a China-wide View

Evaluating the Quality of Service of the DNS Root Server from the Service Scope

Measuring Query Latency of Top Level DNS Servers.

Research on Optimal Selection Measurement of DNS Root Instance

DNS Root Server Resolution Anomaly Detection

3G Meets the Internet: Understanding the Performance of Hierarchical Routing in 3G Networks.

Reexamining DNS from a global recursive resolver perspective

DNSWeight: Quantifying Country-Wise Importance of Domain Name System

Performance Analysis of a Fast Domain Naming System

DNS Root Domain Name Analysis System Based on Block Chain

Understanding the Latency to Visit Websites in China: an Infrastructure Perspective

Research on DNS Authoritative Server's Performance and Security

Root Mirror Sites Identification and Service Area Analysis

A Comprehensive Study of DNS Operational Issues by Mining DNS Forums

A Cdn-Based Domain Name System

Measuring the Availability and Response Times of Public Encrypted DNS Resolvers

A DNS Reflection Method for Global Traffic Management.

Authoritative Server’s Impact on Domain Name System’s Performance and Security