WO2017049789A1 - Method and system for optimizing dns root service access - Google Patents

Abstract

Disclosed are a method and system for optimizing DNS root service access. The system comprises a recursive resolver, a root zone data buffer and a root zone file analyser, wherein the recursive resolver is responsible for resolving and searching for DNS data: firstly checking whether a set buffer of the recursive resolver is provided with a corresponding resource record (RR), if so, feeding back a query result, otherwise checking in a data buffer of the root zone data buffer, and feeding back a query result if it is found, otherwise querying in a root domain name server and performing feedback; performing DNSSEC verification on a query result of a DNSSEC query; and after the verification is passed, storing relevant data to the root zone data buffer; and the root zone file analyser is responsible for analysing whether a root zone file is updated, and if the root zone file is updated, notifying the root zone data buffer to clear the buffered data. The present invention can solve the problem of too long an access time of a root server, and cannot destroy the existing root domain name resolution mechanism potentially at the same time.

Description

Method and system for optimizing DNS root service access Technical field

The present invention relates to a method and system for optimizing DNS root service access, and belongs to the field of network technology.

Background technique

With the continuous development of the Internet and the gradual promotion of new top-level domain names, it is necessary to further improve the quality of root services, such as strengthening the fast query response of root services and reducing the time required to access DNS root data. The DNS recursive resolver comes with some caching mechanism, but this mechanism, because it is not optimized for the root zone data, cannot meet the growing need to reduce the time to access DNS root data.

As shown in Figure 1, the existing recursive parser's buffer is a generic cache for all levels of domain names and various zone files. At present, the existing parsing technology does not specifically cache the root zone data, and adopts a common caching mechanism, which is not conducive to reducing the time for accessing the DNS root data.

In response to the explosive development of root zone access, since 2002, the DNS root service system has widely adopted anycast technology to expand the number of root servers. To date, there are nearly 490 root server mirror nodes in the world. Because the deployment of the root mirror server is limited by resources and requires high deployment environment, it cannot be deployed in an unrestricted manner. Therefore, the method of deploying the root image by using anycast technology cannot meet the requirement of reducing the time for accessing the DNS root data.

The IETF recently introduced a mechanism for running a root server on a loop address. This approach is equivalent to adding a few additional root servers running on the local loop in addition to the 13 root servers specified worldwide. Although this mechanism can reduce the access time of the root to a certain extent, this mechanism may destroy the existing Internet domain name resolution mechanism after a large number of deployments, and the DNS root domain name service may be disabled, which may interfere with the normal and stable operation of the Internet.

Summary of the invention

In view of the technical problems existing in the prior art, an object of the present invention is to provide a method and system for optimizing DNS root service access. The present invention addresses the characteristics of the root zone file and the need to reduce the data access time of the root zone, adds a root data buffer and its associated algorithms and steps, adds algorithms and steps related to the root zone data analyzer, and improves recursion. The algorithm of the parser. According to the setting characteristics of the current root zone file, the present invention can increase the access root zone data speed by about 7 times on average compared with the existing general cache-based performance. The invention can solve the problem that the root server access time is too long, and does not potentially damage the existing root domain name resolution mechanism.

The general purpose buffer currently used by the recursive parser caches data for all levels of domain names, and cannot be topped from the root server. The domain data is specifically optimized. The general-purpose cache is stored. Since the domain name data is not known to be up-to-date, the cache time for the domain name is generally short. The time of the domain name cache depends on whether the cached domain name data is the latest and most recent data; as long as the domain name data is the latest real data, in theory, it can be cached all the time. One function of the original authoritative service (SOA) record is to inform the zone file data changes through the serial number change in the SOA, but the root zone file sometimes only changes the SOA record itself, and other data in the zone. It has not changed. The system ensures that the root domain name data is the latest data through the polling of the original authoritative service (SOA) records in the root server and the detection of the root zone file. At the same time, the application of the DNSSEC technology ensures that the obtained domain name data is true. Untamed. By designing new functional algorithms and improved algorithms, the system prolongs the time of data in the cache, reduces access to the root server, and reduces the average access time.

The technical solution of the present invention is:

A method for optimizing DNS root service access, the steps of which are:

1) setting a zone data buffer in the recursive server;

2) When the recursive parser needs to query the resource record RR corresponding to a certain type of top-level domain name from the root domain name server, first check whether the recursive parser's setting cache has a corresponding resource record RR, and if so, the feedback includes The resource records the query result of the RR, otherwise step 3);

3) The recursive server checks the resource record RR corresponding to the type of the top-level domain name in the data buffer of the root zone data buffer, and if the corresponding resource record RR is found, the feedback includes the query result of the resource record RR, otherwise Go to step 4);

4) The recursive server queries the root domain name server for the resource record RR corresponding to the type of the top-level domain name. If the corresponding resource record RR is found, the feedback includes the query result of the resource record RR; if the corresponding resource record RR is not found, , the feedback result of the query failure is fed back;

5) For the query result including the resource record RR, the recursive parser checks whether the query corresponding to the query result is a DNSSEC query, and if so, performs DNSSEC detection on the query result, and if verified by DNSSEC, the recursive parser The corresponding resource record RR obtained by querying the top-level domain of the type is stored in the root zone data buffer. If the DNSSEC verification is not performed, the query result is not cached in the root zone data buffer; if the query corresponding to the query result is not DNSSEC If the query is sent, the recursive parser sends a DNSSEC query to the root domain name server for querying the resource record RR corresponding to the type of the top-level domain name, and performs DNSSEC verification on the feedback result. If the verification is performed, the recursive parser queries the top level of the type. The corresponding resource record RR obtained by the domain is stored in the root zone data buffer, otherwise the query result is not cached in the root zone data buffer.

Further, a zone file analyzer is further disposed in the DNS root service system; the root zone file analyzer determines whether the resource record RR in the root zone buffer is updated, and the method is:

21) The root zone file analyzer obtains the SOA record from the root domain name server query, and then sets the version number of the root zone data buffer to the serial number of the SOA record, and sets the value of the refresh timer to expire of the SOA record. value;

22) The root zone file analyzer obtains a root zone file from an Internet digital distribution authority, and performs a digest operation on the root zone file after removing the SOA record and its digital signature record RRSIG, and uses the obtained digest value as the root zone data. The fingerprint of the buffer;

23) The root zone file analyzer periodically queries the SOA record of the root domain name server, and compares the version number of the root zone data buffer with the serial number of the SOA. If they are consistent, the query is performed periodically; if not, the root zone is notified. The data buffer stops responding to the recursive parser and reacquires the root zone file, and performs a digest operation on the root zone file after removing the SOA record and its digital signature record RRSIG, and then caches the newly generated digest value and the root zone data. The fingerprint of the device is compared; if it is consistent, the version number of the root zone data buffer is set to the serial number of the currently acquired SOA, and the SOA in the root zone data buffer is updated, and then the root zone data buffer is notified to continue the recursive resolution. The device responds; if not, discards all data in the root zone data buffer and then notifies the root zone data buffer to continue responding to the recursive resolver.

Further, the root zone data buffer sets a refresh timer for each resource record RR newly placed in the root zone data buffer.

Further, in the root zone data buffer, the refresh timer of each resource record RR is counted down, and the time TTL of the resource record RR is retained in the original value; the root zone data buffer discards the refresh timer value expired. Resource record RR.

Further, for the resource record RR included in the query result, the recursive server deletes the refresh timer of the resource records RR in the query result, and starts counting down the TTL of the resource record RR in the query result.

Further, the root zone file analyzer periodically queries the root domain name server for the SOA record interval to be the refresh value of the SOA record or the value set by the DNS administrator.

A system for optimizing DNS root service access, comprising: a recursive parser, a root zone data buffer, and a root zone file analyzer; wherein

The recursive parser is responsible for parsing and searching DNS data. When it is required to query the resource record RR corresponding to a certain type of top-level domain name from the root domain name server, first check whether the recursive parser's setting cache has a corresponding resource record. RR, if yes, the feedback includes the query result of the resource record RR; otherwise, the recursive server checks the resource record RR corresponding to the type of the top-level domain name in the data buffer of the root zone data buffer, if the corresponding response is found The resource record RR, the feedback includes the query result of the resource record RR; otherwise, the recursive server queries the root domain name server for the resource record RR corresponding to the type of the top-level domain name, and if the corresponding resource record RR is found, the feedback includes the resource. Recording the query result of the RR; if the corresponding resource record RR is not found, feeding back the query result of the query failure; and if the query result including the resource record RR is a DNSSEC query, performing DNSSEC verification on the query result; Through DNSSEC verification, the recursive parser stores the corresponding resource record RR obtained by querying the top-level domain of the type into the root zone data buffer. If the DNSSEC verification is not passed, the query result is not cached in the root zone data buffer. If the query corresponding to the query result is not a DNSSEC query, the recursive parser sends a DNSSEC query to the root domain name server to query the resource record RR corresponding to the same top-level domain name, and performs DNSSEC verification on the feedback result. Then the recursive parser will query the top-level domain of the type RR corresponding to the resource record stored in the root zone data buffer area or not in the data buffer buffers the root of the query result;

The root zone data buffer is responsible for storing the resource record RR corresponding to the top-level domain obtained by the recursive parser from the root domain name server querying the top-level domain name TLD and the recursive server performing DNSSEC verification;

The root zone file parser is responsible for analyzing whether the root zone file has been updated. If an update is made, the root zone data buffer is notified to clear the cached data.

Further, the root zone data buffer is provided with three parameters: a version number, a fingerprint, and a refresh timer; wherein the version number is a serial number of the SOA record obtained from the root domain name server query, and the refresh timer value is a SOA record. The expiration value of the fingerprint is the digest value of the root zone file after removing the SOA record and its digital signature record RRSIG.

Further, in the root zone data buffer, the refresh timer of each resource record RR is counted down, and the time TTL of the resource record RR is retained in the original value; the root zone data buffer discards the refresh timer value expired. Resource record RR.

Further, for the resource record RR included in the query result, the recursive server deletes the refresh timer of the resource records RR in the query result, and starts counting down the TTL of the resource record RR in the query result.

By designing a new recursive parser, the invention increases the root zone data buffer and the root zone file analyzer, and effectively reduces the time of accessing the root server through the coordinated cooperation of the three.

The present invention provides a method and system for optimizing DNS root service access. The system consists of three main components: recursive parser, root zone data buffer, and root zone file parser.

The recursive parser is responsible for parsing and searching DNS data;

The root zone data buffer is responsible for storing the corresponding resource record RR obtained by the recursive parser from the root server for querying a type of top-level domain name TLD.

The root zone file parser is responsible for analyzing the root zone file and discriminating whether the root zone file has been updated. If it is updated, the root zone data buffer needs to be notified to clear the cached data.

The root zone data buffer has three parameters, a version number, a fingerprint, and a refresh timer.

1) Version number:

The assignment is the same as the SOA serial number of the current version of the root zone file.

2) Fingerprint:

The assignment is the digest value of the root region file (excluding the original authoritative service SOA and its digital signature record RRSIG) performing the digest operation of the same algorithm (such as MD5).

3) Refresh timer:

The contents of the root zone data buffer cache must use a timer. Each resource record RR will be assigned a refresh timer, which is given a default value when each RR is placed in the root data cache. The value of this default timer is the expired value of the root zone SOA record. Administrators can also set their own timer values. If the root zone data cannot be updated normally between the domain name root server and other secondary servers, the data valid time of the secondary domain name server is the expire value of the SOA. The invention can adjust the parameter value to increase the buffering time of the data in the root zone data buffer to be as long as expire, or can be increased to be longer according to the administrator's needs.

1. Detailed steps for the use of the system:

In the first step, when the recursive parser needs to query the RR corresponding to a certain type of top-level domain name from the root domain name server, it should first check the cache specified in RFC 1035 of the recursive resolver. If the corresponding RR is found, the answer is made according to the requirements of RFC1035, and jump to step 4, otherwise you will jump to step 2.

In the second step, in the data buffer of the root zone data buffer, check the RR corresponding to a certain type of top-level domain name. If it finds the corresponding RR, it will compose the answer according to the requirements of RFC1035, and jump to step 4, otherwise it will jump to step 3.

Step 3, query the root domain name server (that is, query the RR corresponding to a certain type of top-level domain name in step 1), and if the corresponding RR is found, jump to steps 5 and 4; if not Find the corresponding RR, the root domain name server will give some information that the RR corresponding to a certain type of top-level domain name does not exist as an answer, then jump to step 4.

In step 4, the recursive parser finds the answer and ends it according to and follows the steps specified in RFC 1035.

In step 5, if it is a DNSSEC query, the recursive resolver should verify that the response is detected by DNSSEC. If it is verified by DNSSEC, the recursive parser should place the corresponding resource record RR obtained by these queried top-level domains into the root zone data buffer, and set the refresh timing for each resource record RR that is newly placed in the root zone data buffer. Device. in case This data is not placed in the root zone data buffer without DNSSEC validation. If it is not a DNSSEC query, go to step 6.

In step 6, the recursive resolver should send another DNSSEC query of the same problem to the root domain name server. If the response is verified by DNSSEC, the recursive resolver should place the corresponding resource record RR obtained by these queried top-level domains into the root zone data cache. And set a refresh timer for each resource record RR that is newly placed in the root zone data buffer. If these RRs cannot be verified by DNSSEC, the recursive resolver should not cache them in the root zone data buffer.

2. System requirements

In order to implement the mechanism described in the present invention:

1. The system must be able to verify DNSSEC resource records.

2. The system must have a recent backup of the DNS root key on the recursive resolver for use by the recursive resolver when doing DNSSEC validation.

3. Only supplementary data from the root domain name server TLD RR data and related RFC1033, RFC1034, RFC4033, and RFC4034 specifications can be cached by the root zone data buffer.

The above requirement is to ensure that the authoritative data in the root data cache must match the corresponding authoritative data in the root server.

3. Root zone data buffer requirements

The data of the root zone data buffer will be discarded by the timeout mechanism set by the value of a refresh timer. It can also be analyzed by the root zone file analyzer, based on the comparison between the serial number in the SOA and the serial number in the root buffer, and the summary of the root zone data (except the SOA record and the corresponding RRSIG record). The value is compared with the fingerprint in the root buffer. If the two are different, it can be determined that the old root data is invalid, and the root data buffer is also instructed to discard the data.

The requirements for running the root zone data buffer are as follows:

1) In the root zone data buffer, the refresh timer is counted down, and the TTL of the resource record RR is retained at the original value without change.

2) Each RR will be assigned a default refresh timer when it is placed in the root zone data buffer. When the RR is output from the root zone data buffer, the refresh timer will be deleted and the TTL in the RR will start to "count down".

3) The root zone data buffer should discard the RR whose refresh timer value expires.

4. Root Zone File Analyzer operation

Step 1: Obtain an SOA record from the root domain name server query. The SOA record includes a serial number (serial), a refresh value (refresh), and an expiration value (expire), and sets a root zone data buffer version number=SOA record serial number. Serial Value; the value of the refresh timer = the expire value of the SOA record.

Step 2: Obtain the complete root zone file from the Internet Assigned Numbers Authority (IANA) and perform the same digest operation (such as MD5 algorithm) on the root zone file (excluding SOA and its RRSIG) to obtain the abstract. value. Set the fingerprint=summary value of the root zone data buffer.

Step 3: The root zone file analyzer periodically queries the SOA record of the root domain name server, and compares the version number of the root zone data buffer with the serial number serial value of the SOA. If the two values are the same, wait for a fixed time (the recommended time is the refresh value of the SOA or every 15 minutes), then jump to step 3; if the values are not the same, jump to step 4.

In step 4, the root zone data buffer is notified to temporarily stop responding to the recursive parser. Obtain a full root zone file and perform the same digest operation (such as MD5 algorithm) on the root zone data (excluding SOA and its RRSIG) to get the digest value. The fingerprint of the root zone data buffer is compared to the digest value. If the values are the same, the root zone file is only updated about the SOA data. If the other data has not changed, set the root zone data buffer version number = the currently obtained SOA serial value, if the root zone data buffer is saved. There are SOA records and they are also updated at the same time. The root zone data buffer is then notified to continue responding to the recursive parser. Go to step 3. If the values are different, indicating that the root zone data has changed, the system must discard all data in the root zone data buffer, then notify the root zone data buffer to continue responding to the recursive resolver, and then go to step 1.

Advantages of the present invention compared to the prior art:

1) Avoid the use of anycast anycast technology to deploy a large number of root images, saving cost and bandwidth, without frequent direct access to the root domain name server.

2) Compared to the parsing and general caching techniques specified in IETF RFC1035, this technology can reduce the response time for root zone data access by a factor of seven.

3) The present invention is easy to deploy and can be deployed on a large number of existing domain recursive servers.

DRAWINGS

1 is a schematic structural view of a conventional parser;

2 is a schematic structural view of a system of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings:

Take ".cn", ".com", and ".net" as examples:

1, the root zone data buffer initialization:

The root zone file analyzer obtains the SOA information and the summary information of the current root zone file, and assigns a value to the root zone data buffer. For example, the root zone SOA record queried is as follows:

Type=SOA,class=IN,dlen=64

Ttl=7156 (1 hour 59mins 16secs)

Primary name server=a.root-servers.net

Responsible mail addr=nstld.verisign-grs.com

Serial=2015091301

Refresh=1800(30mins)

Retry=900 (15mins)

Expire=604800(7days)

Default TTL=86400(1day)

Download the root zone file, remove the SOA record and its RRSIG record, perform MD5 calculation, and obtain the digest value D5-55-2E-81-33-B9-51-F0-2B-80-5D-D5-FC-8B-91- E3

So set the parameters of the root zone data buffer as follows:

Version number=2015091301

Fingerprint=D5-55-2E-81-33-B9-51-F0-2B-80-5D-D5-FC-8B-91-E3

Refresh timer = 604800

1, the root zone data buffer cumulative learning process:

When the recursive parser needs to query ".cn", first query the recursive parser with the cache specified in RFC1035. If it is not found, go to the root zone data buffer to find it. If it is not found, go to the remote root domain name server. After finding the relevant information of ".cn", if DNSSEC authentication is passed, the information about ".cn" is placed in the root zone data buffer, and a refresh timer is set for each resource record RR, and its value is set. Is 604800. By analogy, the root data buffer slowly has data that is often used by recursive parsers such as ".com" and ".net".

2, the root zone data buffer information query

When the recursive parser needs to query the information of ".cn", it can obtain data directly from the root region data buffer according to the algorithm and steps of the parser in the invention.

3, the root zone data buffer data update and clear

When the refresh timer value of the ".cn" data information in the root zone data buffer expires, the root zone data buffer deletes the data information of ".cn" to ensure the correctness and timeliness of the information. Or when the root zone file parser passes the SOA query and digest algorithm, By operating the algorithm and steps of the root zone file analyzer specified in the invention, it is found that the root zone file has been updated, and the root zone file analyzer will notify the root zone data buffer to delete all data including ".cn". At the same time, the root zone data buffer will resume learning.

Introduction to DNS SOA records:

In any Domain Name System (DNS) Zone file, it starts with the original Authoritative Service (SOA) record. The SOA resource record indicates that this DNS server is the best source of information for the data in the DNS domain.

Let's take a DNS SOA record as an example to illustrate its structure:

The SOA record is:

Primary nameserver: ns51.domaincontrol.com

HostmasterE-mail address:dns.jomax.net

Serial#:2010123100

Refresh: 28800

Retry: 7200

Expire: 604800 1 week

Default TTL: 86400

Source host (Primary nameserver):

The host location where the DNS log file is located.

Contact email (Hostmaster E-mail address):

Record the contact information of the host administrator, where the first point indicates @.

Serial number (Serial):

The format is yyyymmddnn, and nn means that this day is the first modification. The secondary domain name server loads a new copy of the zone data by comparing the serial number.

Refresh:

Tell the zone's secondary domain name servers how often the data in the zone is up to date.

Retry (retry):

If the secondary domain name server cannot access the primary server after the refresh interval, it starts to retry the connection once in a while. This time is usually shorter than the refresh time, but it does not have to be the case.

Expire (expired or expired):

If the secondary domain name server is not connected to the primary server during the expiration time, the secondary domain name server will use this and I will be invalid. This means that the secondary domain name server will stop answering the area because the data in these areas is too old to be useful. The setup time is much longer than the refresh and retry time, which is more reasonable in weeks.

Negative cache TTL (lifetime):

This value applies to negative responses from authoritative domain name servers in this zone.

Claims (10)

A method for optimizing DNS root service access, the steps of which are: 6) setting a zone data buffer in the recursive server; 7) When the recursive parser needs to query the resource record RR corresponding to a certain type of top-level domain name from the root domain name server, first check whether the recursive parser's setting cache has a corresponding resource record RR, and if so, the feedback includes The resource records the query result of the RR, otherwise step 3); 8) The recursive server checks the resource record RR corresponding to the type of the top-level domain name in the data buffer of the root zone data buffer, and if the corresponding resource record RR is found, the feedback includes the query result of the resource record RR, otherwise Go to step 4); 9) The recursive server queries the root domain name server for the resource record RR corresponding to the type of the top-level domain name. If the corresponding resource record RR is found, the feedback includes the query result of the resource record RR; if the corresponding resource record RR is not found, , the feedback result of the query failure is fed back; 10) For the query result including the resource record RR, the recursive parser checks whether the query corresponding to the query result is a DNSSEC query, and if so, performs DNSSEC detection on the query result, and if verified by DNSSEC, the recursive parser The corresponding resource record RR obtained by querying the top-level domain of the type is stored in the root zone data buffer. If the DNSSEC verification is not performed, the query result is not cached in the root zone data buffer; if the query corresponding to the query result is not DNSSEC If the query is sent, the recursive parser sends a DNSSEC query to the root domain name server for querying the resource record RR corresponding to the type of the top-level domain name, and performs DNSSEC verification on the feedback result. If the verification is performed, the recursive parser queries the top level of the type. The corresponding resource record RR obtained by the domain is stored in the root zone data buffer, otherwise the query result is not cached in the root zone data buffer. The method according to claim 1, wherein a zone file analyzer is further disposed in the DNS root service system; and the root zone file analyzer performs an update on the resource record RR in the root zone buffer. Judging, the method is: 24) The root zone file analyzer obtains the SOA record from the root domain name server query, and then sets the version number of the root zone data buffer to the serial number of the SOA record, and sets the value of the refresh timer to expire of the SOA record. value; 25) The root zone file analyzer obtains a root zone file from the Internet digital distribution authority, and performs a digest operation on the root zone file after removing the SOA record and the digital signature record RRSIG, and uses the obtained digest value as the root zone data. The fingerprint of the buffer; 26) The root zone file analyzer periodically queries the SOA record of the root domain name server, and compares the version number of the root zone data buffer with the serial number of the SOA. If they are consistent, the query is performed periodically; if not, the root is notified. The zone data buffer stops responding to the recursive parser and reacquires the root zone file, and performs a digest operation on the root zone file after removing the SOA record and its digital signature record RRSIG, and then the newly generated digest value and the root zone data. The fingerprint of the buffer is compared; if it is consistent, the version number of the root zone data buffer is set to the serial number of the currently acquired SOA, and the SOA in the root zone data buffer is updated, and then the root zone data buffer is notified to continue the recursion. The parser responds; if not, discards all data in the root zone data buffer and then notifies the root zone data buffer to continue responding to the recursive parser. The method according to claim 1 or 2, wherein said root zone data buffer sets a refresh timer for each resource record RR newly placed in the root zone data buffer. The method according to claim 3, wherein in the root zone data buffer, a refresh timer of each resource record RR is counted down, and a time TTL of the resource record RR is retained at the original value; The data buffer discards the resource record RR whose refresh timer value has expired. The method according to claim 2, wherein, for the resource record RR included in the query result, the recursive server deletes a refresh timer of the resource records RR in the query result, and records the resource in the query result The RR's TTL will start counting down. The method according to claim 1 or 2, wherein the root zone file analyzer periodically queries the time interval of the SOA record of the root domain name server to be a refresh value of the SOA record or a value set by the DNS administrator. A system for optimizing DNS root service access, comprising: a recursive parser, a root zone data buffer, and a root zone file analyzer; wherein The recursive parser is responsible for parsing and searching DNS data. When it is required to query the resource record RR corresponding to a certain type of top-level domain name from the root domain name server, first check whether the recursive parser's setting cache has a corresponding resource record. RR, if yes, the feedback includes the query result of the resource record RR; otherwise, the recursive server checks the resource record RR corresponding to the type of the top-level domain name in the data buffer of the root zone data buffer, and if the corresponding resource record is found The RR, the feedback includes the query result of the resource record RR; otherwise, the recursive server queries the root domain name server for the resource record RR corresponding to the type of the top-level domain name, and if the corresponding resource record RR is found, the feedback includes the resource record RR. The result of the query; if the corresponding resource record RR is not found, the query result of the query failure is fed back; and for the query result including the resource record RR, if it is a DNSSEC query, the query result is DNSSEC verified; if verified by DNSSEC , the recursive parser will query the corresponding resources obtained by the top-level domain of the type The source record RR is stored in the root zone data buffer. If the DNSSEC is not verified, the query result is not cached in the root zone data buffer; if the query corresponding to the query result is not a DNSSEC query, the recursive resolver goes to the root domain name. The server sends a query for the resource corresponding to the same top-level domain name. Recording the DNSSEC query of the RR and performing DNSSEC verification on the feedback result. If the verification is successful, the recursive parser stores the corresponding resource record RR obtained by querying the top-level domain of the type into the root zone data buffer, otherwise the root zone is not in the root zone. The query result is cached in the data buffer; The root zone data buffer is responsible for storing the resource record RR corresponding to the top-level domain obtained by the recursive parser from the root domain name server querying the top-level domain name TLD and the recursive server performing DNSSEC verification; The root zone file parser is responsible for analyzing whether the root zone file has been updated. If an update is made, the root zone data buffer is notified to clear the cached data. The system according to claim 7, wherein said root zone data buffer is provided with three parameters: a version number, a fingerprint, and a refresh timer; wherein the version number is a sequence of SOA records obtained from a query of the root domain name server. No. The refresh timer value is the expiration value of the SOA record, and the fingerprint is the digest value of the root zone file after removing the SOA record and its digital signature record RRSIG. The system according to claim 8, wherein in the root zone data buffer, a refresh timer of each resource record RR is counted down, and a time TTL of the resource record RR is retained at an original value; The data buffer discards the resource record RR whose refresh timer value has expired. The system according to claim 7 or 8 or 9, wherein, for the resource record RR included in the query result, the recursive server deletes a refresh timer of the resource records RR in the query result, and the query result is The TTL of the resource record RR starts counting down.

Images