Mitigating DNS DoS attacks

摘要: This paper considers DoS attacks on DNS wherein attackers flood the nameservers of a zone to disrupt resolution resource records belonging and consequently, any its sub-zones. We propose minor change in caching behavior resolvers that can significantly alleviate impact such attacks. In our proposal, do not completely evict cached whose TTL has expired; rather, are stored separate "stale cache". If, during query, resolver does receive response from responsible for authoritatively answering it use information stale cache answer query. effect, is part global database been accessed by represents an insurance policy uses only when relevant servers unavailable. analyze 65-day trace quantify benefits under different attack scenarios. Further, while proposed also changes semantics, we argue adversely fundamental characteristics as autonomy operators hence, very simple practical candidate mitigating DNS.