Local DNS security analysis method and system

Abstract

The invention discloses a local DNS security resolution method and system, and the method comprises the steps: receiving a domain name resolution request sent by a user, querying whether a local DNS resolution module has a corresponding resolution record or not according to the domain name resolution request, and if not, executing the next step; judging whether the external DNS server is available or not, if not, executing the next step, and if yes, forwarding the domain name resolution request to the external DNS server to enable the external DNS server to perform resolution; receiving an analysis result of the external DNS server, judging whether the external DNS is attacked or not, and if yes, executing the next step; querying whether the local snapshot module has a corresponding analysis record according to the domain name analysis request, and if not, executing the next step; and performing recursive query on the domain name resolution request to obtain and return a resolution result to the user. According to the method and the device, when the third-party DNS server fails, the analysis request can be processed in time.

Description

Technical Field

[0001] The present application relates to the field of DNS resolution technology, and in particular to a local DNS security resolution method and system. Background Art

[0002] With the rapid development of the Internet, DNS, as one of the key infrastructures, has become the main target of network attacks. In order to improve resolution efficiency, DNS uses the stateless UDP protocol and transmits data in plain text. Although this design improves user experience and access efficiency, it exposes greater risks in terms of security. At present, common DNS security threats include local DNS hijacking, ISP DNS hijacking, DNS cache poisoning, domain name registration hijacking, and incidents caused by technical failures, management errors, and infrastructure failures of external servers. These forms of attacks will seriously threaten the security of the network, the integrity of the data, and even more serious network disconnection incidents.

[0003] In order to deal with these threats, existing protection technologies such as DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), DNSSEC, etc. have achieved certain results, and some large DNS service providers such as Google Public DNS and Alibaba Public DNS provide more secure public DNS services, and these services have been designed with distributed architecture and redundancy. However, although these protection measures have alleviated the risk of DNS hijacking to a certain extent, they still have limitations that cannot be ignored, mainly reflected in the following aspects:

[0004] (1) Existing protection technologies rely on third-party DNS service providers to ensure the security of the resolution process, such as Google Public DNS and Alibaba DNS. This means that even if these service providers themselves take measures such as encrypted transmission and identity authentication, users are still exposed to possible attacks from third-party service providers. If a third-party DNS service is attacked or tampered with, the user's DNS resolution process may still be affected, causing security risks.

[0005] (2) Current protection methods mainly focus on protecting the communication security between users and third-party DNS servers, while the protection of local DNS services is relatively insufficient. In the absence of a locally controllable DNS resolution service, users cannot take over the resolution service in time when the third-party service is attacked, which can easily lead to resolution service interruption or malicious tampering. Summary of the invention

[0006] Based on this, in response to the above technical problems, a local DNS security resolution method is provided to solve the problem that when the external server of the prior art is attacked, the resolution task cannot be provided in time.

[0007] In a first aspect, a local DNS security resolution method is provided, the method comprising:

[0008] Receive a domain name resolution request sent by a user, query the local DNS resolution module to see if there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if no, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling an external DNS server and recursive query;

[0009] Determine whether the external DNS server is available, if not, execute the next step, if yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if yes, execute the next step, if not, return the resolution result of the external DNS server to the user;

[0010] According to the domain name resolution request, query the local snapshot module whether there is a corresponding resolution record, if yes, return the resolution result to the user, if no, execute the next step; the local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query;

[0011] The domain name resolution request is subjected to a recursive query to obtain and return a resolution result to the user.

[0012] In the above scheme, optionally, the local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module;

[0013] The local strong resolution module stores the domain name resolution record configured by the user;

[0014] The cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries;

[0015] The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

[0016] In the above scheme, optionally, forwarding the domain name resolution request to an external DNS server also includes: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve it, forwarding it to a public DNS server for resolution.

[0017] In the above solution, optionally, the external DNS server preferentially uses the DoT or DoH protocol.

[0018] In the above scheme, further optionally, after receiving the resolution result of the external DNS server and determining according to the resolution result that the external DNS server has not been attacked, the method further includes:

[0019] The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

[0020] In the above scheme, optionally, returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of multiple IP addresses and the corresponding path quality, and preferably returning the IP with the lowest delay to the user.

[0021] In the above solution, optionally, the method further includes: storing all parsing processes and security events.

[0022] In a second aspect, a local DNS security resolution system is provided, the system comprising:

[0023] Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query;

[0024] External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if yes, execute the next step, if not, return the resolution result of the external DNS server to the user;

[0025] Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if no, execute the next step; the local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query;

[0026] Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

[0027] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a local DNS security resolution method described in the first aspect are implemented.

[0028] In a fourth aspect, a computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a local DNS security resolution method described in the first aspect.

[0029] This application has at least the following beneficial effects:

[0030] After receiving the domain name request sent by the user, this application first queries the local DNS resolution module to see if there is a corresponding resolution record to find the cache record of the specified domain name. If not, it will be resolved through the external DNS server. After monitoring that the external DNS server is under attack, it will query the local snapshot module that stores the resolution record previously resolved by the external DNS server for resolution. If the local snapshot module does not have a corresponding resolution record, it will perform a recursive query. In this way, even if the external DNS server is attacked, the local can provide resolution in time to ensure that the resolution result is returned to the user in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of a local DNS security resolution method provided by an embodiment of the present application;

[0032] Figure 2 A schematic diagram of a recursive query process provided by an embodiment of the present application;

[0033] Figure 3 A detailed process flow chart of a local DNS security resolution method provided for one embodiment of the present application;

[0034] Figure 4 A flowchart of a local snapshot module for saving domain name records and querying domain name records provided by an embodiment of the present application;

[0035] Figure 5 A flowchart for determining whether an external DNS server is available provided by an embodiment of the present application;

[0036] Figure 6 A flowchart for selecting an IP address to be returned in a detection and resolution result is provided for one embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0038] In one embodiment, Figure 1 and Figure 3As shown, a local DNS security resolution method is provided, the method comprising:

[0039] Step S1: Receive a domain name resolution request sent by a user, and query the local DNS resolution module whether there is a corresponding resolution record according to the domain name resolution request. If so, return the resolution result to the user, if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling an external DNS server and recursive query.

[0040] In step S1, when a user sends a domain name resolution request, the local DNS resolution module first receives and processes the request, querying layer by layer according to the following priority:

[0041] a. Local strong solution module: Checks whether there is a corresponding analysis record. If found, the result is returned directly.

[0042] b. Authoritative resolution module: If there is still no record in the cache, query the authoritative resolution, and return immediately if the result is found.

[0043] c. Cache module: If there is no record in the forced solution module, the cache is queried. If the corresponding record is found, the result is returned directly.

[0044] Among them, the local strong resolution module stores the static resolution records of specific domain names; the cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries, and when there are multiple resolution results for the same domain name from external DNS services and recursive queries, the cache module only saves the latest resolution results of the same domain name; the authoritative resolution module stores the official records of domain names stored by authoritative servers.

[0045] Local DNS resolution module: This module implements the local DNS resolution function, and the user's DNS request is resolved locally, avoiding the risk of using a third-party DNS server. If the local DNS server cannot resolve certain domain names, the module will forward the request to other trusted DNS servers.

[0046] Local strong resolution module: This module is used to respond to local configuration DNS resolution requests. For example, when the third-party DNS server is cache-poisoned, the local strong resolution module can be used to force resolution of the domain name to ensure that the DNS request always returns the correct IP address. Even if the third-party DNS service is attacked, the local strong resolution module can ensure the accuracy and security of local resolution.

[0047] Step S2: Determine whether the external DNS server is available. If not, proceed to the next step. If yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution. Receive the resolution result of the external DNS server and determine whether the external DNS is under attack. If yes, proceed to the next step. If not, return the resolution result of the external DNS server to the user.

[0048] In step S2, if none of the modules in step S1 provide a resolution result, the request is forwarded to an external DNS service and is resolved in the following order of priority:

[0049] a. External DNS service (using DoH (DNS-over-HTTPS) protocol or DoT (DNS-over-TLS) protocol);

[0050] b. Public DNS server;

[0051] When an external server performs parsing, the DoT or DoH protocol is used preferentially during the entire parsing process to ensure the integrity and security of data during transmission and prevent tampering or eavesdropping.

[0052] At the same time, the DNS traffic is monitored in real time, abnormal requests are detected, domain names with high frequency changes are identified and prompted to the user. If attacks such as DNS hijacking and cache poisoning are detected, the system will promptly trigger the protection mechanism to block malicious traffic and return the correct results through the snapshot module to ensure the security of user resolution. When the external DNS server is attacked or interrupted, the snapshot module will take over all resolution requests to ensure that users can still obtain accurate results, even if the external service fails completely. Figure 5 The figure shows the process steps for determining whether an external DNS server is available.

[0053] Step S3: query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if not, execute the next step; the local snapshot module stores all resolution records of the domain name returned when calling the external DNS server and recursive query.

[0054] In this application, the local snapshot module saves the records of external recursion and third-party server resolution by configuring the local snapshot module. The domain name resolution snapshot can return the resolution result at the millisecond level without relying on the response time of the third-party service when the third-party resolution is abnormal, providing stable security for the local domain name resolution.

[0055] The records of external recursion and third-party server resolution contain multiple resolution results for the same domain name. The local snapshot module saves all resolution results for the same domain name. The cache module is generally updated based on the local snapshot module.

[0056] Step S4: recursively query the domain name resolution request to obtain and return the resolution result to the user.

[0057] In the above-mentioned local DNS security resolution method, after receiving the domain name request sent by the user, the local DNS resolution module is first queried to see if there is a corresponding resolution record to find the cache record of the given domain name. If not, the external DNS server is used for resolution. After monitoring that the external DNS server is under attack, the local snapshot module storing the resolution record previously resolved by the external DNS server is queried for resolution. If the local snapshot module does not have a corresponding resolution record, a recursive query is performed. In this way, even if the external DNS server is under attack, the local can provide resolution in a timely manner to ensure that the resolution result is returned to the user in a timely manner.

[0058] In one embodiment, the local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module;

[0059] The local strong resolution module stores the domain name resolution record configured by the user;

[0060] The cache module stores the latest resolution record of the same domain name;

[0061] The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

[0062] In this embodiment, if Figure 4 As shown, the cache module periodically generates the latest record of the domain name based on all cache records of the domain name stored in the local snapshot module for storage. When the local snapshot module saves the cache record, when the resolution record is returned from the external DNS server or recursive query, it will first determine whether the returned domain name and the corresponding IP exist in the local snapshot module. If so, it will be ignored. If not, a historical record will be created to save the new domain name and the corresponding IP.

[0063] In one embodiment, forwarding the domain name resolution request to an external DNS server further includes: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve the domain name, forwarding the domain name resolution request to a public DNS server for resolution.

[0064] In one embodiment, the external DNS server preferentially uses the DoT or DoH protocol.

[0065] In one embodiment, after receiving the resolution result of the external DNS server and determining according to the resolution result that the external DNS server has not been attacked, the method further includes:

[0066] The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

[0067] In one embodiment, returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of the multiple IP addresses and the corresponding path quality, and returning the IP with the lowest delay to the user. Figure 6 As shown, select the process step that returns the IP address in the detection and resolution results.

[0068] In this application, Figure 3 The local detection module in performs the following two functions: 1) Periodically checks the status of third-party domain name servers to ensure service availability. 2) Multi-IP link and delay detection: When the domain name server returns multiple IPs, the link status and delay test is performed on each IP, and the IP with the lowest delay is returned first. 3) Combined with the local domain name snapshot module, the domain name resolution and IP change history are recorded in real time to facilitate monitoring of domain name status and trends, quickly locate anomalies and optimize decision-making. The above features can be used as local detection nodes to obtain first-hand information, which is more accurate and reliable than relying on external domain name servers to detect roots. At the same time, combined with snapshots, it strengthens traceability capabilities and security monitoring effects.

[0069] The implementation steps of this application include:

[0070] 1. The user installs a local DNS resolution service device on the personal computer and starts the service.

[0071] 2. The device will be automatically configured to use DoT (DNS over TLS) and DoH (DNS over HTTPS) protocols to ensure that all DNS requests are transmitted through encrypted channels to prevent DNS traffic from being eavesdropped and tampered with.

[0072] 3. When a user visits a website, the DNS resolution request is first processed by the local DNS resolution module. If it cannot be resolved, it will trigger snapshot query, recursive query and automatically initiate queries to other trusted DNS servers.

[0073] 4. The detection module and snapshot module are combined to monitor the integrity and consistency of DNS resolution results in real time. If a third-party DNS server failure or abnormality (such as hijacking, cache poisoning) is detected, it will automatically switch to local snapshot resolution.

[0074] 5. If the domain name resolution server is attacked or tampered with, the fast module quickly resolves the record value to ensure that users can still obtain accurate DNS resolution results.

[0075] In one embodiment, a local DNS security resolution system is provided, the system comprising:

[0076] Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query;

[0077] External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if yes, execute the next step, if not, return the resolution result of the external DNS server to the user;

[0078] Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if no, execute the next step; the local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query;

[0079] Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

[0080] The local DNS security resolution service device of the present application is widely applicable to the following scenarios: personal computers, home networks and financial networks. On personal computers, users can deploy the device on personal devices to ensure local controllability of users and ensure the security of DNS resolution during personal Internet access, prevent attacks such as DNS hijacking and cache poisoning, and external domain name server failures, and improve browsing experience and data security.

[0081] The advantages of this application are:

[0082] (1) Locally controllable DNS resolution service: The present invention provides a locally deployed DNS resolution service device, which allows users to fully control the DNS resolution process without relying solely on third-party DNS services. This design effectively reduces the risk of network interruption caused by external DNS service attacks or failures, while enhancing the security and stability of the user's network.

[0083] (2) Integrated DoT and DoH protocols: This device integrates DNS over TLS (DoT) and DNS over HTTPS (DoH) protocols, and encrypts the transmission of DNS request and response data to prevent data from being eavesdropped, tampered with, or forged during transmission. This function significantly improves the privacy and security of DNS resolution and effectively prevents man-in-the-middle attacks and eavesdropping threats.

[0084] (3) DNS recursive query and local strong resolution technology: The present invention supports DNS recursive query. When certain domain names cannot be resolved locally, recursive query can be used to request resolution from a trusted external DNS server. At the same time, local strong resolution technology is used to deal with resolution anomalies caused by DNS cache poisoning or other attacks, ensuring the accuracy and security of resolution results, and effectively preventing DNS hijacking and data tampering.

[0085] (4) Domain name resolution snapshot technology: This device supports the domain name resolution snapshot function, which automatically saves the resolution records returned by the external DNS server. If the DNS server is judged not to be attacked based on the resolution records, the records in the local snapshot module are compared with the returned resolution records to see if they are consistent. If they are inconsistent, the latest returned records are updated; if the DNS server is judged to be attacked based on the resolution records, they are not saved.

[0086] (5) Local detection technology: This device obtains real-time data through the local detection module, which is more accurate and reliable than solutions that rely on external DNS servers. Combined with snapshot technology, it not only improves the traceability capability, but also significantly enhances the security monitoring effect of DNS traffic, helping to detect abnormal behavior in real time and respond promptly.

[0087] (6) Independence and anti-attack capability: Since the present invention implements DNS resolution and security protection completely locally, it avoids dependence on external DNS service providers. Even if the external DNS service is attacked or interrupted, users can still obtain stable domain name resolution services. In addition, the local deployment design significantly improves the system's anti-attack capability, can effectively prevent various DNS-related threats, and provide users with a highly reliable and highly secure network environment.

[0088] (7) Locally controllable DNS resolution service: The present invention provides a locally deployed DNS resolution service device, which allows users to fully control the DNS resolution process independently of third-party DNS services. This design greatly reduces network interruptions and security risks caused by attacks or failures of external DNS services.

[0089] For the specific definition of a local DNS security resolution system, please refer to the definition of a local DNS security resolution method above, which will not be repeated here. Each module in the above-mentioned local DNS security resolution system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0090] In one embodiment, a computer device is provided, which may be a server, and includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, the above-mentioned local DNS security resolution method is implemented.

[0091] In one embodiment, a computer program product is also provided, including a computer program / instruction, which, when executed by a processor, involves all or part of the process in the above-mentioned embodiment method.

[0092] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0093] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A local DNS security resolution method, characterized in that: The method comprises: Receive a domain name resolution request sent by a user, query the local DNS resolution module to see if there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if no, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling an external DNS server and recursive query; Determine whether the external DNS server is available, if not, execute the next step, if yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if yes, execute the next step, if not, return the resolution result of the external DNS server to the user; According to the domain name resolution request, query the local snapshot module whether there is a corresponding resolution record, if yes, return the resolution result to the user, if no, execute the next step; the local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query; The domain name resolution request is subjected to a recursive query to obtain and return a resolution result to the user.

2. The local DNS security resolution method according to claim 1, characterized in that: The local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module; The local strong resolution module stores the domain name resolution record configured by the user; The cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries; The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

3. The local DNS security resolution method according to claim 1, characterized in that: Forwarding the domain name resolution request to an external DNS server also includes: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve the domain name, forwarding the domain name resolution request to a public DNS server for resolution.

4. The local DNS security resolution method according to claim 1, characterized in that: The external DNS server preferably uses the DoT or DoH protocol.

5. The local DNS security resolution method according to claim 2, characterized in that: After receiving the resolution result of the external DNS server and determining according to the resolution result that the external DNS server has not been attacked, the method further includes: The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

6. The local DNS security resolution method according to claim 1, characterized in that: Returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of the multiple IP addresses and the corresponding path quality, and returning the IP with the lowest delay to the user.

7. The local DNS security resolution method according to claim 1, characterized in that: The method also includes: storing all parsing processes and security events.

8. A local DNS security resolution system, characterized in that: The system comprises: Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query; External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if yes, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if yes, execute the next step, if not, return the resolution result of the external DNS server to the user; Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request, if yes, return the resolution result to the user, if no, execute the next step; the local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query; Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images