A method and system for negative cache control of recursive DNS servers

Abstract

The application discloses a negative cache control method and system of a recursive DNS server, and the method comprises the following steps: recording a recursive time consumption and generating a cache entry when a SERVFAIL response is received by configuring an amplifier constant and a reference maximum value, determining a valid period length by the product of the recursive time consumption and the amplifier constant, and taking the product of the reference maximum value and the amplifier constant as an upper limit constraint, keeping the cache entry to enter a retention extension period after the valid period length expires, requerying in the retention extension period, deleting the cache entry and recalculating the valid period length if a SERVFAIL response is still obtained, and replacing the cache entry with a valid response if a valid response is obtained. The application can dynamically adjust the cache length according to the fault response time, realize fault hierarchical processing and cache smooth transition, and avoid service cliff-like unavailability.

Description

Technical Field

[0001] This application belongs to the field of DNS resolution technology, specifically relating to a negative caching control method and system for a recursive DNS server. Background Technology

[0002] As a core infrastructure of the Internet, DNS is responsible for translating human-readable domain names into machine-readable IP addresses. In complex distributed network architectures, when the authoritative DNS server experiences configuration errors, network outages, domain name expiration, key invalidation (DNSSEC verification failure), or backend service crashes, the recursive DNS server, after trying all available paths and still unable to obtain a valid resolution result, will typically return a SERVFAIL status code response to the client.

[0003] To prevent faulty domain names from triggering high-concurrency retry requests, which could lead to backbone network bandwidth collapse or exhaustion of the recursive server's own resolution performance, modern DNS servers typically employ a negative caching mechanism. According to this mechanism, after receiving a SERVFAIL result, the recursive server caches this error state in its local memory for a period of time, usually determined by a custom TTL value or software default configuration (e.g., BIND or Unbound typically cache for 1 to 5 seconds by default). During this period, if a similar request for the same domain arrives, the recursive server will directly retrieve the SERVFAIL from the cache and return it, without initiating a further recursive query.

[0004] Currently, mainstream DNS recursive servers generally set a fixed cache time (Time To Live, TTL) for SERVFAIL responses. This same cache duration applies to both intermittent jitter caused by momentary network packet loss and permanent failures due to complete domain name configuration failure. This results in requests that could recover quickly in jitter scenarios being forcibly blocked, while in cases of fundamental failure, the excessively short cache time cannot effectively block malicious high-frequency retry requests from clients, lacking the ability to elastically tiered handle based on the fault causal chain. If an inappropriate or excessively long TTL value is used, the end-user experience will be a precipitous unavailability, because after triggering the SERVFAIL negative cache, the recursive server will immediately cut off all resolution attempts for such requests, causing the business to be directly paralyzed.

[0005] In summary, how to implement a tiered caching strategy for SERVFAIL responses while ensuring the DNS system's high-concurrency defense capabilities and appropriate handling of abnormal requests is a technical problem that needs to be solved in this field. Summary of the Invention

[0006] This application provides a negative caching control method and system for a recursive DNS server to solve the technical problems in the prior art, which are that the SERVFAIL negative caching uses a fixed caching duration, which makes it impossible to distinguish between transient and permanent failures, that the cache is cleared upon expiration, which leads to a cliff-like unavailability of services, and that the caching duration cannot be smoothly adjusted in multiple rounds of failures.

[0007] Firstly, a method for controlling negative caching in a recursive DNS server, the method comprising:

[0008] Step S1: Set the amplifier constant and the maximum reference value;

[0009] Step S2: In response to the domain name resolution request initiated by the client, initiate a recursive query to the upstream authoritative DNS server. If a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response.

[0010] Step S3: Generate the validity period of the SERVFAIL cache entry based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, set the validity period to the product of the reference maximum value and the amplifier constant.

[0011] Step S4: When the validity period expires, the SERVFAIL cache entry is retained for a retention extension period. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request.

[0012] Step S5: During the retention extension period, in response to a new domain name resolution request for the same domain name, a recursive query is performed again. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted. Then, based on the total time spent in this recursive query, the new validity period is recalculated according to a preset rule. Steps S4-S5 are repeated until a new domain name resolution request for the same domain name obtains a valid response. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

[0013] Optionally, in the above scheme, the preset rules include:

[0014] Determine whether the time the SERVFAIL cache entry has been retained since the expiration of the validity period exceeds the retention extension period. If it has, delete the SERVFAIL cache entry and recalculate the new validity period according to step S3. If it has not exceeded the expiration period, calculate the new validity period by weighting the current validity period of the SERVFAIL cache entry with the validity period calculated by the current recursive query according to step S3 using a preset weight.

[0015] Optionally, in the above scheme, the benchmark maximum value is less than or equal to the timeout time of a single recursive query.

[0016] Optionally, in the above scheme, the retention extension period is a configurable fixed duration.

[0017] Optionally, in the above scheme, the amplifier constant is 30.

[0018] Secondly, a negative caching control system for a recursive DNS server, the system comprising:

[0019] Configuration module: Used to set amplifier constants and reference maximum values;

[0020] Domain name resolution request and response module: Used to respond to domain name resolution requests initiated by clients, initiate recursive queries to upstream authoritative DNS servers, and if a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response;

[0021] Validity period calculation module: used to generate the validity period of SERVFAIL cache entries based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, the validity period is set to the product of the reference maximum value and the amplifier constant.

[0022] The validity period expiration judgment module is used to retain the SERVFAIL cache entry into a retention extension period after the validity period expires. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request.

[0023] The recursive recursion module is used to recursively query the domain name resolution request for the same domain name during the retention extension period. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted, and the new validity period is recalculated according to preset rules. The process is repeated from the validity period expiration judgment module to the recursive recursion module until a valid response is obtained for a new domain name resolution request for the same domain name. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

[0024] Optionally, in the above scheme, the preset rules include:

[0025] Determine whether the time the SERVFAIL cache entry has been retained since the expiration of the validity period exceeds the retention extension period. If it has, delete the SERVFAIL cache entry and recalculate the new validity period according to step S3. If it has not exceeded the expiration period, calculate the new validity period by weighting the current validity period of the SERVFAIL cache entry with the validity period calculated by the current recursive query according to step S3 using a preset weight.

[0026] Optionally, in the above scheme, the benchmark maximum value is less than or equal to the timeout time of a single recursive query.

[0027] Thirdly, a computer device includes a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the steps of the negative cache control method for a recursive DNS server described in the first aspect.

[0028] Fourthly, a computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the negative cache control method for a recursive DNS server described in the first aspect.

[0029] Compared with the prior art, this application has at least the following beneficial effects:

[0030] This application, by configuring a timeout base and amplifier multiplier, determines the validity period of a cached entry based on the recursion time after receiving a SERVFAIL response. After the validity period expires, the cached entry is retained for a retention extension period. If a SERVFAIL response is still obtained during the retention extension period, the cached entry is deleted and the validity period is recalculated. This achieves the following beneficial effects: Firstly, using recursion time as a dynamic feedback signal of fault severity allows the cache duration to adaptively adjust according to the current network and server status, effectively distinguishing between momentary jitter and fundamental failure. Secondly, the retention extension period avoids the abrupt business unavailability caused by clearing caches upon expiration, improving business continuity. Thirdly, by recalculating the validity period and applying it in the new round of caching, dynamic adjustment of the cache duration is achieved for multi-round failure scenarios. This ensures the high-concurrency defense capability of the recursive server while also ensuring timely response to user requests, significantly improving the robustness and service quality of the DNS resolution system under abnormal scenarios. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating a negative caching control method for a recursive DNS server, as provided in one embodiment of this application. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments.

[0033] In one embodiment, such as Figure 1 As shown, a negative caching control method for a recursive DNS server is provided, the method comprising:

[0034] Step S1: Set the amplifier constant and the reference maximum value.

[0035] In step S1, 1) set an amplifier constant M related to the SERVFAIL cache TTL value. The value can be determined according to a custom strategy (a typical value can be set to 30 times amplification). 2) set a baseline maximum value B for the SERVFAIL cache TTL value as one of the factors constraining the maximum TTL value. This value can be consistent with the timeout of each recursive session triggered by the client (a typical value can be set to 10 seconds) or smaller.

[0036] Step S2: In response to the domain name resolution request initiated by the client, initiate a recursive query to the upstream authoritative DNS server. If a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response.

[0037] In step S2, the recursive DNS server records the total time T consumed by the entire recursive process, which is used to calculate the TTL value when generating the SERVFAIL cache.

[0038] Step S3: Generate the validity period of the SERVFAIL cache entry based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, set the validity period to the product of the reference maximum value and the amplifier constant.

[0039] In step S3, when the SERVFAIL cache is generated for the first time, the TTL value is calculated using the following formula: To prevent the TTL from exceeding an acceptable value in certain abnormal situations, it is also necessary to constrain its maximum value, i.e., when... Time settings: .

[0040] Step S4: When the validity period expires, the SERVFAIL cache entry is retained for a retention extension period. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request.

[0041] In step S4, when the TTL has not expired, the relevant requests will be directly answered using this SERVFAIL cache. However, when the TTL expires, the SERVFAIL cache will not be cleared immediately, but it will not be used to answer client requests. Here, the time for the SERVFAIL cache to continue to remain after expiration is defined as t.

[0042] Step S5: During the retention extension period, in response to a new domain name resolution request for the same domain name, a recursive query is performed again. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted. Then, based on the total time spent in this recursive query, the new validity period is recalculated according to the preset rules. Steps S4-S5 are repeated until a new domain name resolution request for the same domain name obtains a valid response. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

[0043] In step S5, after the TTL expires, the client request can trigger the recursive server to recursively query outwards again. If a valid response is eventually obtained, the remaining SERVFAIL cache will be cleared, and the SERVFAIL result will be replaced with valid data for caching. If a SERVFAIL result is still obtained, it will be checked whether the SERVFAIL cache has been retained for more than t. If t has been exceeded, the SERVFAIL cache will be cleared, and the TTL value will be calculated based on the initial generation. If t has not been exceeded, the TTL at the time of the original SERVFAIL creation and the TTL obtained from this recursive trigger will be averaged according to weights (which can be equal weights) and used to set the TTL value when the SERVFAIL cache is created this time, so that the TTL is generated in a smoother way.

[0044] In the aforementioned negative caching control method for a recursive DNS server, by configuring the timeout base and amplifier multiplier, the validity period of the cache entry is determined based on the recursion time after receiving the SERVFAIL response. After the validity period expires, the cache entry is retained for a retention extension period. If a SERVFAIL response is still obtained during the retention extension period, the cache entry is deleted and the validity period is recalculated. This achieves the following beneficial effects: Firstly, using the recursion time as a dynamic feedback signal of the severity of the fault allows the cache duration to be adaptively adjusted according to the current network and server status, effectively distinguishing between momentary jitter and fundamental failure. Secondly, by setting the retention extension period, the business unavailability caused by clearing the cache upon expiration is avoided, improving business continuity. Thirdly, by recalculating the validity period and making it effective in the new round of caching, dynamic adjustment of the cache duration under multi-round failure scenarios is achieved. This ensures the high-concurrency defense capability of the recursive server while also taking into account the timely response to user requests, significantly improving the robustness and service quality of the DNS resolution system under abnormal scenarios.

[0045] In one embodiment, the preset rule includes: determining whether the time a SERVFAIL cache entry has been retained since its expiration exceeds the retention extension period; if it has, deleting the SERVFAIL cache entry and recalculating the new expiration period according to step S3; if it has not, taking the current expiration period of the SERVFAIL cache entry and the expiration period calculated by the current recursive query according to step S3 as a weighted average according to a preset weight, and using this average as the new expiration period.

[0046] In one embodiment, the baseline maximum value is less than or equal to the timeout time for a single recursive query.

[0047] In one embodiment, the retention period is a configurable fixed duration. It needs to be set according to individual preferences during actual deployment.

[0048] In one embodiment, the amplifier constant is 30.

[0049] In one embodiment, a negative caching control system for a recursive DNS server is provided, the system comprising:

[0050] Configuration module: Used to set amplifier constants and reference maximum values;

[0051] Domain name resolution request and response module: Used to respond to domain name resolution requests initiated by clients, initiate recursive queries to upstream authoritative DNS servers, and if a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response;

[0052] Validity period calculation module: used to generate the validity period of SERVFAIL cache entries based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, the validity period is set to the product of the reference maximum value and the amplifier constant.

[0053] The validity period expiration judgment module is used to retain the SERVFAIL cache entry into a retention extension period after the validity period expires. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request.

[0054] The recursive recursion module is used to recursively query the domain name resolution request for the same domain name during the retention extension period. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted, and the new validity period is recalculated according to preset rules. The process is repeated from the validity period expiration judgment module to the recursive recursion module until a valid response is obtained for a new domain name resolution request for the same domain name. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

[0055] In one embodiment, a computer device is also provided, the processor of which provides computing and control capabilities, the computer device implementing the above-described negative caching control method for a recursive DNS server by loading and running a computer program.

[0056] In one embodiment, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the methods described in the embodiments above.

[0057] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A negative caching control method for a recursive DNS server, characterized in that, The method includes: Step S1: Set the amplifier constant and the maximum reference value; Step S2: In response to the domain name resolution request initiated by the client, initiate a recursive query to the upstream authoritative DNS server. If a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response. Step S3: Generate the validity period of the SERVFAIL cache entry based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, set the validity period to the product of the reference maximum value and the amplifier constant. Step S4: When the validity period expires, the SERVFAIL cache entry is retained for a retention extension period. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request. Step S5: During the retention extension period, in response to a new domain name resolution request for the same domain name, a recursive query is performed again. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted. Then, based on the total time spent in this recursive query, the new validity period is recalculated according to a preset rule. Steps S4-S5 are repeated until a new domain name resolution request for the same domain name obtains a valid response. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

2. The negative caching control method for a recursive DNS server according to claim 1, characterized in that, The preset rules include: Determine whether the time the SERVFAIL cache entry has been retained since the expiration of the validity period exceeds the retention extension period. If it has, delete the SERVFAIL cache entry and recalculate the new validity period according to step S3. If it has not exceeded the expiration period, calculate the new validity period by weighting the current validity period of the SERVFAIL cache entry with the validity period calculated by the current recursive query according to step S3 using a preset weight.

3. The negative caching control method for a recursive DNS server according to claim 1, characterized in that, The benchmark maximum value is less than or equal to the timeout time of a single recursive query.

4. The negative caching control method for a recursive DNS server according to claim 1, characterized in that, The retention extension period is a configurable fixed duration.

5. The negative caching control method for a recursive DNS server according to claim 1, characterized in that, The amplifier constant is 30.

6. A negative caching control system for a recursive DNS server, characterized in that, The system includes: Configuration module: Used to set amplifier constants and reference maximum values; Domain name resolution request and response module: Used to respond to domain name resolution requests initiated by clients, initiate recursive queries to upstream authoritative DNS servers, and if a SERVFAIL response is received, record the total time taken from initiating the recursive query to receiving the SERVFAIL response; and generate a SERVFAIL cache entry corresponding to this SERVFAIL response; Validity period calculation module: used to generate the validity period of SERVFAIL cache entries based on the product of the total time and the amplifier constant M. If the validity period is greater than the product of the reference maximum value and the amplifier constant, the validity period is set to the product of the reference maximum value and the amplifier constant. The validity period expiration judgment module is used to retain the SERVFAIL cache entry into a retention extension period after the validity period expires. During the retention extension period, the SERVFAIL cache entry is not used to directly respond to the client's domain name resolution request. The recursive recursion module is used to recursively query the domain name resolution request for the same domain name during the retention extension period. If the recursive query still obtains a SERVFAIL response, the SERVFAIL cache entry is deleted, and the new validity period is recalculated according to preset rules. The process is repeated from the validity period expiration judgment module to the recursive recursion module until a valid response is obtained for a new domain name resolution request for the same domain name. If a valid response is obtained, the SERVFAIL cache entry is deleted and the valid response is cached.

7. The negative caching control system for a recursive DNS server according to claim 6, characterized in that, The preset rules include: Determine whether the time the SERVFAIL cache entry has been retained since the expiration of the validity period exceeds the retention extension period. If it has, delete the SERVFAIL cache entry and recalculate the new validity period according to step S3. If it has not exceeded the expiration period, calculate the new validity period by weighting the current validity period of the SERVFAIL cache entry with the validity period calculated by the current recursive query according to step S3 using a preset weight.

8. The negative caching control system for a recursive DNS server according to claim 6, characterized in that, The benchmark maximum value is less than or equal to the timeout time of a single recursive query.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to claims 1-5.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in claims 1-5.

Images