A local DNS security resolution method and system

Abstract

The application discloses a local DNS security resolving method and system, comprising the following steps: receiving a domain name resolving request sent by a user, querying whether the local DNS resolving module has a corresponding resolving record according to the domain name resolving request, if not, executing the next step, judging whether an external DNS server is available, if not, executing the next step, if yes, forwarding the domain name resolving request to the external DNS server to make the external DNS server perform resolving, receiving a resolving result of the external DNS server, and judging whether the external DNS is attacked, if yes, executing the next step, querying whether the local snapshot module has a corresponding resolving record according to the domain name resolving request, if not, executing the next step, and performing recursive query on the domain name resolving request to obtain and return a resolving result to the user. Through the application, the resolving request can be processed in time when the third-party DNS server fails.

Description

Technical Field

[0001] The present application relates to the field of DNS resolution technology, and in particular to a local DNS security resolution method and system. Background Art

[0002] With the rapid development of the internet, DNS, as a critical infrastructure, has become a primary target for cyberattacks. To improve resolution efficiency, DNS uses the stateless UDP protocol and transmits data in plaintext. While this design improves user experience and access efficiency, it also poses significant security risks. Common DNS security threats include local DNS hijacking, ISP DNS hijacking, DNS cache poisoning, domain name registration hijacking, and incidents caused by external servers due to technical failures, administrative errors, or infrastructure failures. These attacks can severely threaten network security, data integrity, and even lead to network outages.

[0003] To combat these threats, existing protection technologies such as DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNSSEC have achieved some success. Furthermore, some major DNS service providers, such as Google Public DNS and Alibaba Public DNS, offer more secure public DNS services, and these services utilize distributed architectures and redundant designs. However, while these protections have mitigated the risk of DNS hijacking to a certain extent, they still have significant limitations, primarily in the following areas:

[0004] (1) Existing protection technologies rely on third-party DNS service providers, such as Google Public DNS and Alibaba DNS, to ensure the security of the resolution process. This means that even if these service providers themselves adopt measures such as encrypted transmission and authentication, users are still exposed to possible attacks from third-party service providers. If the third-party DNS service is attacked or tampered with, the user's DNS resolution process may still be affected, posing a security risk.

[0005] (2) Current protection methods mainly focus on protecting the communication security between users and third-party DNS servers, while the protection of local DNS services is relatively insufficient. Without a locally controllable DNS resolution service, users cannot take over the resolution service in a timely manner when the third-party service is attacked, which can easily lead to resolution service interruption or malicious tampering. Summary of the Invention

[0006] Based on this, in response to the above technical problems, a local DNS security resolution method is provided to solve the problem that when the external server of the existing technology is attacked, the resolution task cannot be provided in time.

[0007] In a first aspect, a local DNS security resolution method is provided, the method comprising:

[0008] Receive a domain name resolution request from a user, query the local DNS resolution module to see if there is a corresponding resolution record based on the domain name resolution request, and if so, return the resolution result to the user; if not, proceed to the next step; the local DNS resolution module stores the cache record of the specific domain name and the latest resolution record of the domain name returned when calling an external DNS server and recursive query;

[0009] Determine whether the external DNS server is available. If not, proceed to the next step. If so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution. Receive the resolution result of the external DNS server and determine whether the external DNS is under attack. If so, proceed to the next step. If not, return the resolution result of the external DNS server to the user.

[0010] According to the domain name resolution request, the local snapshot module is queried to see whether there is a corresponding resolution record. If so, the resolution result is returned to the user. If not, the next step is executed. The local snapshot module stores all resolution records of the domain name returned when calling the external DNS server and the recursive query;

[0011] The domain name resolution request is subjected to a recursive query to obtain and return a resolution result to the user.

[0012] In the above solution, optionally, the local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module;

[0013] The local forced resolution module stores the domain name resolution records configured by the user;

[0014] The cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries;

[0015] The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

[0016] In the above solution, optionally, forwarding the domain name resolution request to an external DNS server also includes: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve it, forwarding it to a public DNS server for resolution.

[0017] In the above solution, optionally, the external DNS server preferentially uses the DoT or DoH protocol.

[0018] In the above solution, further optionally, after receiving the resolution result of the external DNS server and determining that the external DNS server has not been attacked according to the resolution result, the method further includes:

[0019] The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

[0020] In the above solution, optionally, returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of multiple IP addresses and the corresponding path quality, and preferably returning the IP with the lowest latency to the user.

[0021] In the above solution, optionally, the method further includes: storing all parsing processes and security events.

[0022] In a second aspect, a local DNS security resolution system is provided, the system comprising:

[0023] Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module to see if there is a corresponding resolution record based on the domain name resolution request, and if so, return the resolution result to the user; if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query;

[0024] External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if so, execute the next step, if not, return the resolution result of the external DNS server to the user;

[0025] Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request. If so, it returns the resolution result to the user. If not, it executes the next step. The local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query;

[0026] Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

[0027] In a third aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a local DNS security resolution method described in the first aspect are implemented.

[0028] In a fourth aspect, a computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a local DNS security resolution method described in the first aspect.

[0029] This application has at least the following beneficial effects:

[0030] After receiving a domain name request from a user, this application first queries the local DNS resolution module to see if there is a corresponding resolution record, in order to find the cached record of the specified domain name. If not, it resolves the domain name through an external DNS server. After detecting that the external DNS server is under attack, it queries the local snapshot module that stores the resolution record previously resolved by the external DNS server for resolution. If the local snapshot module does not have a corresponding resolution record, it performs a recursive query. In this way, even if the external DNS server is under attack, the local server can still provide timely resolution, ensuring that the resolution result is returned to the user in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flowchart of a local DNS security resolution method provided in one embodiment of the present application;

[0032] Figure 2 A schematic diagram of a recursive query process provided by an embodiment of the present application;

[0033] Figure 3 A detailed flow chart of a local DNS security resolution method provided in one embodiment of the present application;

[0034] Figure 4 A flowchart of a local snapshot module for saving and querying domain name records provided in one embodiment of the present application;

[0035] Figure 5 A flowchart for determining whether an external DNS server is available is provided in one embodiment of the present application;

[0036] Figure 6 A flowchart for selecting and returning an IP address in a detection and resolution result is provided for one embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0038] In one embodiment, Figure 1 and Figure 3As shown, a local DNS security resolution method is provided, the method comprising:

[0039] Step S1: Receive a domain name resolution request sent by the user, and query the local DNS resolution module based on the domain name resolution request to see if there is a corresponding resolution record. If so, return the resolution result to the user; if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query.

[0040] In step S1, when a user sends a domain name resolution request, the local DNS resolution module first receives and processes the request, querying layer by layer according to the following priority:

[0041] a. Local strong solution module: Checks whether there is a corresponding solution record. If found, it returns the result directly.

[0042] b. Authoritative resolution module: If there is still no record in the cache, query the authoritative resolution and return immediately if the result is found.

[0043] c. Cache module: If there is no record in the forced solution module, the cache is queried. If the corresponding record is found, the result is returned directly.

[0044] Among them, the local strong resolution module stores the static resolution records of specific domain names; the cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries, and when there are multiple resolution results for the same domain name from external DNS services and recursive queries, the cache module only saves the latest resolution results of the same domain name; the authoritative resolution module stores the official records of domain names stored by authoritative servers.

[0045] Local DNS resolution module: This module implements local DNS resolution and resolves user DNS requests locally, eliminating the risks of using third-party DNS servers. If the local DNS server cannot resolve certain domain names, the module forwards the request to other trusted DNS servers.

[0046] Local Forced DNS Module: This module responds to locally configured DNS resolution requests. For example, if a third-party DNS server is cache-poisoned, the local forced resolution module can be used to force domain name resolution, ensuring that DNS requests always return the correct IP address. Even if the third-party DNS service is attacked, the local forced resolution module can ensure the accuracy and security of local resolution.

[0047] Step S2: Determine whether the external DNS server is available. If not, proceed to the next step. If so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution. Receive the resolution result of the external DNS server and determine whether the external DNS is under attack. If so, proceed to the next step. If not, return the resolution result of the external DNS server to the user.

[0048] In step S2, if none of the modules in step S1 provide a resolution result, the request is forwarded to the external DNS service and resolved in the following order of priority:

[0049] a. External DNS service (using DoH (DNS-over-HTTPS) protocol or DoT (DNS-over-TLS) protocol);

[0050] b. Public DNS server;

[0051] When an external server performs parsing, the DoT or DoH protocol is used preferentially during the entire parsing process to ensure the integrity and security of data during transmission and prevent tampering or eavesdropping.

[0052] At the same time, DNS traffic is monitored in real time to detect abnormal requests, identify domain names that change frequently, and prompt users. If attacks such as DNS hijacking and cache poisoning are detected, the system will trigger the protection mechanism in time to block malicious traffic and return the correct results through the snapshot module to ensure the security of user resolution. When the external DNS server is attacked or interrupted, the snapshot module will take over all resolution requests to ensure that users can still obtain accurate results, even if the external service fails completely. Figure 5 The figure shows the process steps for determining whether the external DNS server is available.

[0053] Step S3: query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request. If so, return the resolution result to the user. If not, execute the next step; the local snapshot module stores all resolution records of the domain name returned when calling the external DNS server and recursive query.

[0054] In this application, the local snapshot module saves the records of external recursion and third-party server resolution by configuring the local snapshot module. The domain name resolution snapshot can return the resolution results at the millisecond level without relying on the response time of the third-party service when the third-party resolution is abnormal, providing stable security for the local domain name resolution.

[0055] The records of external recursive and third-party server resolution contain multiple resolution results for the same domain name. The local snapshot module saves all resolution results for the same domain name. The cache module is generally updated based on the local snapshot module.

[0056] Step S4: Perform a recursive query on the domain name resolution request to obtain and return the resolution result to the user.

[0057] In the above-mentioned local DNS security resolution method, after receiving a domain name request sent by a user, the local DNS resolution module is first queried to see if there is a corresponding resolution record to find the cached record of the specified domain name. If not, the external DNS server is used for resolution. After detecting that the external DNS server is under attack, the local snapshot module that stores the resolution record previously resolved by the external DNS server is queried for resolution. If the local snapshot module does not have a corresponding resolution record, a recursive query is performed. In this way, even if the external DNS server is under attack, the local server can still provide resolution in a timely manner, ensuring that the resolution result is returned to the user in a timely manner.

[0058] In one embodiment, the local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module;

[0059] The local forced resolution module stores the domain name resolution records configured by the user;

[0060] The cache module stores the latest resolution record of the same domain name;

[0061] The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

[0062] In this embodiment, if Figure 4 As shown, the cache module periodically generates and saves the latest record of a domain name based on all cached records of the domain name stored in the local snapshot module. When saving cached records, the local snapshot module first checks whether the returned domain name and corresponding IP address exist in the local snapshot module when receiving a resolution record returned from an external DNS server or a recursive query. If so, the returned domain name and corresponding IP address are ignored. If not, a historical record is created to save the new domain name and corresponding IP address.

[0063] In one embodiment, forwarding the domain name resolution request to an external DNS server further comprises: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve the domain name, forwarding the domain name resolution request to a public DNS server for resolution.

[0064] In one embodiment, the external DNS server preferentially uses the DoT or DoH protocol.

[0065] In one embodiment, after receiving the resolution result from the external DNS server and determining that the external DNS server has not been attacked according to the resolution result, the method further includes:

[0066] The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

[0067] In one embodiment, returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of the multiple IP addresses and the corresponding path quality, and returning the IP with the lowest delay to the user. Figure 6 As shown, select the process step that returns the IP address in the detection and resolution results.

[0068] In this application, Figure 3 The local detection module in the system performs the following two functions: 1) Periodically checks the status of third-party domain name servers to ensure service availability. 2) Multi-IP link and latency detection: When the domain name server returns multiple IPs, the link status and latency test is performed on each IP, and the IP with the lowest latency is returned first. 3) Combined with the local domain name snapshot module, it records domain name resolution and IP change history in real time to facilitate monitoring of domain name status and trends, quickly locate anomalies, and optimize decision-making. These features, as local detection nodes, can obtain first-hand information, which is more accurate and reliable than relying on external domain name servers to detect roots. At the same time, combined with snapshots, it enhances traceability capabilities and security monitoring effects.

[0069] The implementation steps of this application include:

[0070] 1. The user installs a local DNS resolution service device on the personal computer and starts the service.

[0071] 2. The device will be automatically configured to use DoT (DNS over TLS) and DoH (DNS over HTTPS) protocols to ensure that all DNS requests are transmitted through encrypted channels to prevent DNS traffic from being eavesdropped and tampered with.

[0072] 3. When a user visits a website, the DNS resolution request is first processed by the local DNS resolution module. If the resolution fails, it will trigger snapshot query, recursive query and automatic query to other trusted DNS servers.

[0073] 4. The detection module and snapshot module are combined to monitor the integrity and consistency of DNS resolution results in real time. If a failure or anomaly (such as hijacking or cache poisoning) of a third-party DNS server is detected, it will automatically switch to local snapshot resolution.

[0074] 5. If the domain name resolution server is attacked or tampered with, the fast module quickly resolves the record value to ensure that users can still obtain accurate DNS resolution results.

[0075] In one embodiment, a local DNS security resolution system is provided, the system comprising:

[0076] Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module to see if there is a corresponding resolution record based on the domain name resolution request, and if so, return the resolution result to the user; if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query;

[0077] External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if so, execute the next step, if not, return the resolution result of the external DNS server to the user;

[0078] Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request. If so, it returns the resolution result to the user. If not, it executes the next step. The local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query;

[0079] Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

[0080] The local DNS security resolution service device of this application is widely applicable to the following scenarios: personal computers, home networks and financial networks. On personal computers, users can deploy the device on their personal devices to ensure local controllability and DNS resolution security during personal Internet access, prevent attacks such as DNS hijacking and cache poisoning, and external domain name server failures, and improve browsing experience and data security.

[0081] The advantages of this application are:

[0082] (1) Locally Controllable DNS Resolution Service: This invention provides a locally deployed DNS resolution service device, allowing users to fully control the DNS resolution process without relying solely on third-party DNS services. This design effectively reduces the risk of network interruption caused by external DNS service attacks or failures, while enhancing the security and stability of the user's network.

[0083] (2) Integrated DoT and DoH protocols: This device integrates the DNS over TLS (DoT) and DNS over HTTPS (DoH) protocols, encrypting the transmission of DNS requests and responses to prevent data from being eavesdropped, tampered with, or forged during transmission. This feature significantly improves the privacy and security of DNS resolution, effectively preventing man-in-the-middle attacks and eavesdropping threats.

[0084] (3) DNS recursive query and local strong resolution technology: This invention supports DNS recursive query. When certain domain names cannot be resolved locally, recursive query can be used to request resolution from a trusted external DNS server. At the same time, local strong resolution technology is used to deal with resolution anomalies caused by DNS cache poisoning or other attacks, ensuring the accuracy and security of resolution results, and effectively preventing DNS hijacking and data tampering.

[0085] (4) Domain Name Resolution Snapshot Technology: This device supports the domain name resolution snapshot function, which automatically saves the resolution records returned by the external DNS server. If the resolution record determines that the DNS server has not been attacked, the record in the local snapshot module is compared with the returned resolution record to see if they are consistent. If they are inconsistent, the latest returned record is updated. If the resolution record determines that the DNS server has been attacked, the record is not saved.

[0086] (5) Local Detection Technology: This device obtains real-time data through a local detection module, which is more accurate and reliable than solutions that rely on external DNS servers. Combined with snapshot technology, it not only improves traceability capabilities but also significantly enhances the security monitoring of DNS traffic, helping to detect abnormal behavior in real time and respond promptly.

[0087] (6) Independence and Anti-Attack Capability: Because the present invention implements DNS resolution and security protection entirely locally, it avoids dependence on external DNS service providers. Even if the external DNS service is attacked or interrupted, users can still obtain stable domain name resolution services. In addition, the local deployment design significantly improves the system's anti-attack capability, can effectively prevent various DNS-related threats, and provide users with a highly reliable and secure network environment.

[0088] (7) Locally Controllable DNS Resolution Service: This invention provides a locally deployed DNS resolution service device that allows users to fully control the DNS resolution process independently of third-party DNS services. This design significantly reduces network outages and security risks caused by attacks or failures on external DNS services.

[0089] For the specific definition of a local DNS security resolution system, please refer to the definition of a local DNS security resolution method above and will not be repeated here. Each module in the above-mentioned local DNS security resolution system can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above modules can be embedded in or independent of the processor of the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0090] In one embodiment, a computer device is provided, which may be a server, comprising a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with an external terminal via a network connection. When executed by the processor, the computer program implements the aforementioned local DNS security resolution method.

[0091] In one embodiment, a computer program product is further provided, including a computer program / instruction. When the computer program / instruction is executed by a processor, the computer program / instruction involves all or part of the process in the above embodiment method.

[0092] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0093] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A local DNS security resolution method, characterized in that: The method comprises: Receive a domain name resolution request from a user, query the local DNS resolution module to see if there is a corresponding resolution record based on the domain name resolution request, and if so, return the resolution result to the user; if not, proceed to the next step; the local DNS resolution module stores the cache record of the specific domain name and the latest resolution record of the domain name returned when calling an external DNS server and recursive query; Determine whether the external DNS server is available. If not, proceed to the next step. If so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution. Receive the resolution result of the external DNS server and determine whether the external DNS is under attack. If so, proceed to the next step. If not, return the resolution result of the external DNS server to the user. According to the domain name resolution request, the local snapshot module is queried to see whether there is a corresponding resolution record. If so, the resolution result is returned to the user. If not, the next step is executed. The local snapshot module stores all resolution records of the domain name returned when calling the external DNS server and the recursive query; The domain name resolution request is subjected to a recursive query to obtain and return a resolution result to the user.

2. The local DNS security resolution method according to claim 1, characterized in that: The local DNS resolution module includes a local strong resolution module, a cache module, and an authoritative resolution module; The local forced resolution module stores the domain name resolution records configured by the user; The cache module stores the latest resolution records of domain names returned when calling external DNS servers and recursive queries; The authoritative resolution module stores official authoritative records of domain names stored by the authoritative server.

3. The local DNS security resolution method according to claim 1, characterized in that: Forwarding the domain name resolution request to an external DNS server also includes: forwarding the domain name resolution request to the external DNS server for resolution, and if the external DNS server cannot resolve the domain name, forwarding the domain name resolution request to a public DNS server for resolution.

4. The local DNS security resolution method according to claim 1, characterized in that: The external DNS server preferably uses the DoT or DoH protocol.

5. The local DNS security resolution method according to claim 2, characterized in that: After receiving the resolution result of the external DNS server and determining, based on the resolution result, that the external DNS server has not been attacked, the method further includes: The domain name resolution record of the external DNS is stored in the cache module and the local snapshot module.

6. The local DNS security resolution method according to claim 1, characterized in that: Returning the resolution result of the external DNS server to the user includes: obtaining multiple IP addresses in the resolution result, evaluating the health status of the multiple IP addresses and the corresponding path quality, and returning the IP with the lowest delay to the user.

7. The local DNS security resolution method according to claim 1, characterized in that: The method further includes: storing all parsing processes and security events.

8. A local DNS security resolution system, characterized in that: The system comprises: Specific domain name resolution record query module: used to receive domain name resolution requests sent by users, query the local DNS resolution module to see if there is a corresponding resolution record based on the domain name resolution request, and if so, return the resolution result to the user; if not, execute the next step; the local DNS resolution module stores the specific domain name cache record and the latest resolution record of the domain name returned when calling the external DNS server and recursive query; External DNS server resolution module: used to determine whether the external DNS server is available, if not, execute the next step, if so, forward the domain name resolution request to the external DNS server so that the external DNS server performs resolution, receive the resolution result of the external DNS server, and determine whether the external DNS is under attack, if so, execute the next step, if not, return the resolution result of the external DNS server to the user; Local snapshot resolution record query module: used to query the local snapshot module whether there is a corresponding resolution record according to the domain name resolution request. If so, it returns the resolution result to the user. If not, it executes the next step. The local snapshot module stores all the resolution records of the domain name returned when calling the external DNS server and recursive query; Recursive query module: used to perform recursive query on the domain name resolution request to obtain and return the resolution result to the user.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images