Edge DNS Caching Negative Responses DDoS Mitigation

The patent applies preliminary action by pre-caching negative responses and wildcard DNS records at the Edge server before they are needed. When the Origin server determines that certain DNS queries will result in negative responses or wildcard matches, it proactively pushes these responses to the Edge cache, so they are ready for immediate serving without requiring Origin involvement during attack traffic

The patent introduces an intermediary mechanism where the Edge server acts as a mediator between client queries and the Origin server. By caching negative responses and wildcard records at the Edge, the system creates an intermediate layer that can satisfy certain queries without forwarding them to the Origin, thereby protecting the Origin from overload while maintaining response accuracy

The patent applies segmentation by dividing the DNS query handling responsibilities between the Edge server and the Origin server. The Edge server handles caching of negative responses and wildcard records, while the Origin server focuses on providing authoritative DNS records. This segmentation allows the Edge to absorb and filter out malicious traffic targeting negative responses, protecting the Origin from DDoS attacks

The patent converts the harmful effect of DDoS attacks into a benefit by using the attack traffic pattern itself to trigger cache population. During normal operation, the Origin server identifies which queries will result in negative responses and pre-caches them at the Edge. When a DDoS attack occurs with similar traffic patterns, the pre-populated cache at the Edge absorbs the attack traffic, turning the potential harm into a protective benefit