JP2007243565A - Dns server device, dns query request control method, and dns query request control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable response control to be quickly and minutely performed when a DoS attack occurs. <P>SOLUTION: An authority server 30 is a server that manages optional domains and manages access control lists in which an authorization response or a reject response is specified by system, zone and domain. The authority server 30 performs response control referring successively to the access control lists prepared by system, zone and domain on the basis of a sending agency IP of a query request when the server 30 receives a DNS query request. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a DNS server device, a DNS query request control method, and a DNS query request control program that receive a DNS query request and control a response to the DNS query request.

  2. Description of the Related Art Conventionally, DNS (Domain Name System) that associates a host name (domain name) and an IP address (Internet Protocol Address) is widely used in Internet services that are generally used. And, a DoS attack (Denial of Service) against these DNS servers by a malicious user causes a disruption / stop of Internet services such as stopping the DNS server. Therefore, as an effective means for combating a DoS attack against these DNS servers, there is an access control (response control) for controlling a query response by an IP address of a transmission source that transmits a DNS query request to the DNS server. .

  This response control will be described in detail. The DNS server manages an access control list that defines a query response such as no response, rejection response, or resource record response for each IP address that transmits a DNS query request. Based on the IP address that has transmitted the query request, the access control list is referred to and response control of the query response is performed.

  For example, in the BIND of the DNS software that is commonly used in the DNS server, this response control can be performed by setting the system unit and the zone unit. More specifically, a DNS server that has received a DNS query request firstly performs access control that is defined in units of systems and zones based on the IP address of the source that transmitted the DNS query request (hereinafter referred to as the source IP). Refer to the list and perform response control. Thus, in BIND, response control can be performed in units of systems and zones.

  However, with this technique, response control cannot be performed for each domain constituting the zone, and therefore response control cannot be performed under more detailed conditions. Therefore, in order to solve this problem, a technique for performing response control in units of domains has been disclosed (for example, refer to Patent Document 1). Specifically, the DNS server is configured so that all of the systems and zones are configured. Manages access control lists defined on a domain basis. When a DNS query request is received, the DNS server performs response control based on an access control list defined for each domain.

Japanese Patent Laying-Open No. 2005-210513

  However, in the above-mentioned Patent Document 1, it is necessary to set response control in all registered domains, and since there are many setting parts and work is complicated, quick response control is performed when a DoS attack occurs. There was a problem that could not.

  Therefore, the present invention has been made to solve the above-described problems of the prior art, and it is possible to realize detailed response control in units of domains in addition to simple and quick response control in units of systems and zones. An object of the present invention is to provide a DNS server device, a DNS query request control method, and a DNS query request control program.

  In order to solve the above-described problems and achieve the object, the invention according to claim 1 is a DNS server apparatus that receives a DNS query request and controls a response to the DNS query request, and is a system unit and / or zone Response control content for the DNS query request for each unit, response control content storage means for storing the response control content for the DNS query request for each domain unit, and response control content stored in the response control content storage means And DNS query response control means for controlling a response to the DNS query request in units of systems and / or zones and in units of domains.

  The invention according to claim 2 is the above invention, wherein the response control content storage means stores response control content for each of the system unit, the zone unit, and the domain unit, and the DNS query response The control means controls the response to the DNS query request based on the response control content stored in each unit in the order of the system unit, zone unit, and domain unit.

  The invention according to claim 3 is the above-described invention, wherein the response control content storage means controls the response in the domain unit as at least one response control content in the system unit. The DNS query response control means responds to the DNS query request based on the access control content of the domain unit when the DNS query request corresponds to the access control content of the system unit. It is characterized by controlling the response.

  According to a fourth aspect of the present invention, in the above invention, the response control content storage means stores a resource record as at least one of the response control contents of the system unit, and the DNS query response When the DNS query request corresponds to the response control content of the system unit, the control means responds the resource record to the DNS query request.

  According to a fifth aspect of the present invention, in the above invention, the response control content storage means corresponds to a device address for identifying a DNS client device and / or a cache server device that is a transmission source of the DNS query request. In addition, the response control content is stored, and the DNS query response control means identifies a DNS client device and / or a cache server device that is a transmission source of the DNS query request included in the DNS query request. A response to the DNS query request is controlled based on a device address to be used.

  The invention according to claim 6 is the above invention, wherein the response control content storage means stores any one of no response, rejection response, and resource record as the response control content, The DNS query response control means performs any one of the non-response, rejection response, and resource record response.

  The invention according to claim 7 is the above invention, wherein the DNS query request is a request for name resolution, a request for dynamic DNS, a request for zone update, or a request for zone transfer. The DNS query response control unit controls a response to a request related to name resolution, a request related to dynamic DNS, a request related to zone update, or a request related to zone transfer.

  The invention according to claim 8 is the DNS query request control method according to the above invention, wherein a DNS query request is received and a response to the DNS query request is controlled. A response control content storing step for storing response control content for the DNS query request in the response control content storage means, and storing response control content for the DNS query request in the response control content storage means for each domain, and the response control content A DNS query response control step of controlling a response to the DNS query request in units of systems and / or zones and in units of domains based on response control contents stored in a storage means. And

  The invention according to claim 9 is the DNS query request control program for causing the computer to execute a DNS query request control method for receiving a DNS query request and controlling a response to the DNS query request in the above invention, The response control content for the DNS query request is stored in the response control content storage unit for each system unit and / or zone unit, and the response control content for the DNS query request is stored in the response control content storage unit for each domain unit A DNS query response for controlling a response to the DNS query request in the system unit and / or the zone unit and the domain unit based on the control content storage procedure and the response control content stored in the response control content storage means Control procedure to be executed by computer I am characterized in.

  According to the invention of claim 1, 8 or 9, the DNS server device stores the response control content (access control file) for the DNS query request for each system unit and / or zone unit, and for each domain unit DNS query. Since the response control content for the request is stored and the response to the DNS query request is controlled in the system unit and / or the zone unit and the domain unit, the response in the system unit and / or the zone unit is responded to the DNS query request. As a result of the combination of control and response control in units of domains, it is possible to realize detailed response control in units of domains as well as simple and quick response control in units of systems and zones.

  According to the invention of claim 2, the DNS server device stores the response control contents for each system unit, each zone unit, and each domain unit, and in each unit in the order of the system unit, the zone unit, and the domain unit. Since the response to the DNS query request is controlled on the basis of the stored response control content, the response control by the domain unit is performed, and then compared with the method of performing the response control by the system unit or the zone unit, it is quick as a whole. Response control can be realized.

  According to the invention of claim 3, the DNS server device stores the response control content indicating that the response should be controlled in domain units as at least one of the response control content in system units. When the DNS query request corresponds to the access control content of the system, the response to the DNS query request is controlled based on the access control content of the domain unit. Therefore, for some DNS query requests, the domain follows the system unit. By omitting zone-based response control, such as controlling responses in units, it is possible to achieve faster response control as a whole.

  According to the invention of claim 4, the DNS server device stores a resource record as at least one of the response control contents of the system unit, and the DNS query request corresponds to the response control content of the system unit. In some cases, since resource records are responded to DNS query requests, response control in zone units and domain units, such as responding to resource records following system units, is omitted for some DNS query requests. Thus, it is possible to realize faster response control as a whole.

  According to the invention of claim 5, the DNS server device is a device address (client IP address, cache server IP address) for identifying the DNS client device and / or cache server device that is the source of the DNS query request. The response control content is stored in association with the DNS query request, and based on the device address for identifying the DNS client device and / or cache server device that is the transmission source of the DNS query request included in the DNS query request, Since the response to the DNS query request is controlled, for each DNS client device or cache server device that is the source of the DNS query request, in addition to simple and quick response control in units of systems and zones, detailed response control in units of domains Can be realized It is.

  According to the invention of claim 6, the DNS server device stores any one of no response, rejection response, and resource record as response control contents, and includes no response, rejection response, and resource record response. Since any one is performed, no response, rejection response, resource record response (for example, one resource record prepared for all clients, resource prepared for each client address) in system unit, zone unit, domain unit It is possible to realize a variety of response control in which any one of a record, a resource record prepared for each country, and a response such as a resource record prepared for each inside and outside the company is performed.

  According to the invention of claim 7, the DNS server device controls a response to a request related to name resolution, a request related to dynamic DNS, a request related to zone update (notify), or a request related to zone transfer. Therefore, it is possible to realize detailed response control in units of domains in addition to simple and quick response control in units of systems and zones in response to various requests received by the DNS server device.

  Exemplary embodiments of a DNS server device, a DNS query request control method, and a DNS query request control program according to the present invention will be described below in detail with reference to the accompanying drawings.

  Below, the outline | summary and characteristic of the DNS server apparatus which concern on Example 1, the structure of a DNS server apparatus, and the flow of a process are demonstrated, and the effect by Example 1 is demonstrated finally. The “authoritative server” appearing in the first embodiment below corresponds to the “DNS server device” described in the claims.

[Outline and Features of DNS Server Device (Authoritative Server)]
First, the outline and characteristics of the DNS server device (authoritative server) according to the first embodiment will be described with reference to FIG. FIG. 1 is a system configuration diagram illustrating an overall configuration of a DNS system including a DNS server device (authoritative server) according to the first embodiment.

  As shown in FIG. 1, the DNS system according to the first embodiment is configured by connecting a plurality of authority servers 30 and a DNS client 10 to the Internet. In such a DNS system, the authority server 30 that has received a DNS query request from the DNS client 10 transmits a resource record corresponding to the received DNS query request to the source DNS client 10 or a query response based on the source IP. The response control to the query request such as refusal (rejection response) is outlined, and the simple response control by the system unit or zone unit and the detailed response control by domain unit are realized. The main feature is that this is possible.

  This main feature will be described in detail. In FIG. 1, the authority server 30 is a server that manages an arbitrary domain, and is permitted in units of systems, zones, and domains in association with the IP address of the DNS client 10. Manages access control lists that specify responses or denial responses. When the DNS query request is transmitted from the DNS client 10 ((1) in FIG. 1), the authoritative server 30 having such a configuration receives the DNS query request and responds based on the received source IP. The control is executed ((2) in FIG. 1), and the result is transmitted as a query response to the DNS client of the transmission source ((3) in FIG. 1).

  Specifically, the authority server 30 first refers to the access control list defined on a system basis based on the source IP of the received DNS query request, and the source IP is specified as a permission response. If it is, the access control list defined for each zone is referred to and it is determined whether or not it is similarly defined as a permission response. If the response is specified as a permission response, the access control list specified for each domain is referred to determine whether the response is specified as a permission response. If so, the specified resource record is transmitted as a query response. On the other hand, when the denial response is defined in the access control list defined for each system, zone, or domain, the denial response is transmitted as a query response.

  As described above, the authority server 30 according to the first embodiment can apply the response control in units of systems and / or zones and the response control in units of domains to the DNS query request in combination. As described above, in addition to simple and quick response control in units of systems and zones, fine response control in units of domains can be realized.

[Configuration of DNS server device (authoritative server)]
Next, the configuration of the authority server shown in FIG. 1 will be described with reference to FIGS. 2 is a block diagram showing the configuration of the authority server 30, FIG. 3 is a diagram showing an example of an access control list (system unit), and FIG. 4 is an example of an access control list (zone unit). FIG. 5 is a diagram showing an example of an access control list (domain unit). As shown in FIG. 2, the authority server 30 includes a communication control I / F unit 31, a storage unit 32, and a control unit 33.

  Among these, the communication control I / F unit 31 is a means for controlling communication regarding various information exchanged with the DNS client. Specifically, a DNS query request transmitted from the DNS client is received, and a query response is transmitted to the originating DNS client.

  The storage unit 32 is a storage unit (storage unit) that stores data and programs necessary for various processes performed by the control unit 33. Particularly, as closely related to the present invention, an access control list (system unit) 32a , An access control list (zone unit) 32b and an access control list (domain unit) 32c. The storage unit 32 corresponds to “response control content storage unit” recited in the claims.

  Among these, the access control list (system unit) 32a is means for storing response control contents for the DNS query request in units of the system in association with the IP address of the DNS client 10 that is the source of the DNS query request. Specifically, as illustrated in FIG. 3, IP addresses and network addresses that do not respond to DNS query requests, and IP addresses and network addresses that are permitted responses to DNS query requests are listed and stored. Means. For example, in FIG. 3, if the DNS query request source IP is 172.168.23.1 or 1234 :: 0: 1 or is in 172.1168.23.192/26, there is no response and the DNS query request source IP Is not included in 172.168.23.0/24 or 1234 :: / 112, it will be a rejection response.

  The access control list (zone unit) 32b is means for storing response control contents for the DNS query request in units of zones in association with the IP address of the DNS client 10 that is the source of the DNS query request. Specifically, as illustrated in FIG. 4, it is means for enumerating and storing IP addresses and network addresses that are permitted responses to DNS query requests in zone units (for example, zone = AAA). For example, in FIG. 4, if the DNS query request is for a network whose zone is AAA, the source IP of the DNS query request is in 172.168.23.0/24 or 1234 :: 1: 0/120 In this case, a permission response is obtained.

  The access control list (domain unit) 32c is a means for storing the response control content for the DNS query request in a domain unit as a resource record file in association with the IP address of the DNS client 10 that is the source of the DNS query request. Specifically, as illustrated in FIG. 5, an IP address or network address that is a rejection response to a DNS query request in a domain unit (for example, domain aaa.AAA), an IP address or a network address other than the rejection response In this case, the resource record to be transmitted as a query response is enumerated and stored. For example, in FIG. 5, in the case of a DNS query request for a network whose domain is aaa.AAA, if the DNS query request source IP is 192.168.23.1, a rejection response is obtained; The resource record corresponding to the DNS query request is transmitted.

  The control unit 33 is a processing unit that has a control program such as an OS (Operating System), a program that defines various processing procedures, and an internal memory for storing necessary data, and executes various processes using these. In particular, the DNS query response control unit 33a is closely related to the present invention. The DNS query response control unit 33a corresponds to “DNS query response control means” recited in the claims.

  The DNS query response control unit 33a is means for receiving a DNS query request from the DNS client 10 and executing response control. Specifically, when receiving the DNS query request, the DNS query response control unit 33a, based on the source IP of the DNS query request, stores an access control list (system unit) 32a stored in the storage unit 32, access control By referring to the list (zone unit) 32b and the access control list (domain unit) 32c in order, the response control content is determined, and the response control for transmitting the query response is performed.

  For example, the DNS query response control unit 33a that has received the DNS query request does not respond when “no response” is defined in the access control list (system unit) 32a in association with the source IP of the DNS query request. If the response control is defined as “permission response”, the access control list (zone unit) 32b is referred to. If the access control list (zone unit) 32b does not specify “permitted response”, a denial response query response is made. If it is specified as “permitted response”, then access control is performed. The list (domain unit) 32c is referred to. When the access control list (domain unit) 32c defines “rejection response”, a rejection response query response is performed; otherwise, the specified resource record query response is performed.

[Response control processing by DNS server device (authoritative server)]
Next, response control processing by the authority server will be described with reference to FIG. FIG. 6 is a flowchart showing the flow of response control processing.

  As shown in FIG. 6, when the authority server 30 receives the DNS query request (Yes at step S601), the access control list (system unit) 32a is referred to and the source IP of the DNS query request is blackhole (no response). It is determined whether or not (step S602). If the source IP is blackhole (no response) (Yes at step S602), the authority server 30 performs response control without response (step S603).

  On the other hand, if it is not blackhole (no response), the authority server 30 then refers to the access control list (system unit) 32a to determine whether or not the source IP is an allow (allowed response) target ( Step S604). If the source IP is not “allow” (No in Step S604), the authority server 30 transmits a rejection response as a query response (Step S605).

  On the other hand, if the source IP is an allow target, the authority server 30 next refers to the access control list (zone unit) 32b to determine whether the source IP is the target of the zone rejection response (step). S606). If the source IP is the target of the zone rejection response (Yes at step S606), the authority server 30 transmits the rejection response as a query response.

  On the other hand, when the source IP is not the target of the zone rejection response (No at Step S606), the authority server 30 refers to the access control list (domain unit) 32c to determine whether the source IP is the target of the domain rejection response. Determination is made (step S607). When the source IP is a domain rejection response target (Yes at step S607), the authority server 30 transmits the rejection response as a query response, and when the source IP is not a domain rejection response target ( In step S607, the resource record defined in the access control list (domain unit) 32c is transmitted as a query response (step S608).

[Effects of Example 1]
As described above, according to the first embodiment, the authority server 30 stores the response control content (access control file) for the DNS query request for each system unit and / or each zone unit, and also for each domain unit. Since the response control content for the request is stored and the response to the DNS query request is controlled in the system unit and / or the zone unit and the domain unit, the response in the system unit and / or the zone unit is responded to the DNS query request. As a result of the combination of control and response control in units of domains, it is possible to realize detailed response control in units of domains as well as simple and quick response control in units of systems and zones.

  Further, according to the first embodiment, the authority server 30 stores response control contents for each system unit, zone unit, and domain unit, and is stored in each unit in the order of system unit, zone unit, and domain unit. Since response to DNS query request is controlled based on the response control content, response control by domain unit is performed and then response control is performed more quickly than the method of performing response control by system unit or zone unit. Can be realized.

  Further, according to the first embodiment, the authority server 30 stores any one of no response, rejection response, and resource record as response control content, and either one of no response, rejection response, or resource record response. Doing one, system unit, zone unit, domain unit, no response, rejection response, resource record response (for example, one resource record prepared for all clients, resource record prepared for each client address, It is possible to realize a variety of response controls in which any one of the resource records prepared for each country and the responses of resource records prepared for each company or the like is performed.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above. Therefore, another embodiment included in the present invention will be described below as a second embodiment.

  For example, in the first embodiment, the case where the authority server 30 performs response control based on the IP address of the DNS client that transmits the DNS query request has been described. However, the present invention is not limited to this, and the DNS server Response control may be performed based on the IP address of the cache server functioning as a full service resolver.

  For example, as shown in FIG. 7, the authority server 30 is a server that manages an arbitrary domain, and is associated with the IP address of the cache server 20 and is permitted in units of systems, zones, and domains. Or, an access control list in which a denial response is specified is managed. Under such a configuration, when a DNS query request is transmitted from the DNS client 10 ((1) in FIG. 7), the cache server 20 that has received the DNS query request manages the authority server 30 that manages an arbitrary domain. A DNS query request is transmitted to (2) of FIG. The authoritative server 30 that has received the DNS query request performs response control based on the IP address of the transmission source cache server ((3) in FIG. 7), and transmits the result to the cache server 20 as a query response. ((4) in FIG. 7). Subsequently, the cache server 20 that has received the query response transmits the query response to the DNS client 10 that has transmitted the DNS query request ((5) in FIG. 7). Thereby, for each cache server device that is the source of the DNS query request, it is possible to realize detailed response control in units of domains in addition to simple and quick response control in units of systems and zones.

  In the first embodiment, the case where response control is performed in the order of the system unit, the zone unit, and the domain unit based on the source IP of the DNS query request has been described. However, the present invention is not limited to this, Response control in units may be omitted, and response control may be performed in order of system units and domain units. This makes it possible to realize faster response control as a whole by omitting response control in units of zones, such as controlling responses in units of domains following system units for some DNS query requests. It is.

  Further, the response control may be performed so that the response control in the domain unit is omitted and the resource record is responded in the system unit. With this, for some DNS query requests, the resource is continued after the system unit. By omitting the response control in units of zones and domains, such as responding to records, it is possible to realize faster response control as a whole.

  In the first embodiment, the response control of the DNS query request is described. However, the present invention is not limited to this. For example, the request for name resolution, the request for dynamic DNS, and zone update can be performed. The present invention can be similarly applied to such a request (notify) or response control of zone transfer. This makes it possible to realize detailed response control in units of domains in addition to simple and quick response control in units of systems and zones in response to various requests received by the authority server 30.

  In addition, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

  Each component of the DNS server device shown in FIG. 5 is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of the DNS server device is not limited to the one shown in the figure, and all or a part thereof can be functionally or physically in an arbitrary unit according to various loads or usage conditions. It can be configured to be distributed and integrated. Further, all or any part of each processing function performed in the DNS server device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic. .

  In the above embodiment, the DNS server device that implements the present invention has been described in terms of functions. However, each function of the DNS server device may be realized by causing a computer such as a personal computer or a workstation to execute a program. it can. That is, the various processing procedures described in the above embodiments can be realized by executing a program prepared in advance on a computer. These programs can be distributed via a network such as the Internet. Further, these programs can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD, and can be executed by being read from the recording medium by the computer. In other words, for example, a CD-ROM storing a DNS query request control program as shown in the embodiment (may be a separate CD-ROM for each apparatus) is distributed and stored in this CD-ROM. Each program may be read and executed by each computer.

  As described above, the DNS server device, the DNS query request control method, and the DNS query request control program according to the present invention are useful for receiving a DNS query request and controlling a response to the DNS query request. It is suitable for realizing detailed response control by domain unit as well as simple and quick response control by system unit or zone unit.

1 is a system configuration diagram showing an overall configuration of a DNS system including a DNS server device. It is a block diagram which shows the structure of a DNS server apparatus. It is the figure which showed the example of the access control list (system unit). It is the figure which showed the example of the access control list (zone unit). It is the figure which showed the example of the access control list (domain unit). 7 is a flowchart illustrating a response control process performed by the DNS server device (authoritative server) according to the first embodiment. FIG. 10 is a system configuration diagram illustrating an overall configuration of a DNS system including a cache server according to a second embodiment.

Explanation of symbols

10 DNS client 20 Cache server 30 Authoritative server 31 Communication control I / F unit 32 Storage unit 32a Access control list (system unit)
32b Access control list (zone unit)
32c Access control list (domain unit)
33 control unit 33a DNS query response control unit

Claims (9)

A DNS server device that receives a DNS query request and controls a response to the DNS query request,
Response control content storage means for storing response control content for the DNS query request for each system unit and / or zone unit, and storing response control content for the DNS query request for each domain unit;
DNS query response control means for controlling a response to the DNS query request in the system unit and / or the zone unit and the domain unit based on the response control content stored in the response control content storage unit;
A DNS server device comprising: The response control content storage means stores response control content for each system unit, zone unit, and domain unit,
2. The DNS query response control means controls a response to the DNS query request based on response control contents stored in each unit in order of the system unit, zone unit, and domain unit. The DNS server device described in 1. The response control content storage means stores, as at least one of the system unit response control content, response control content indicating that a response should be controlled in the domain unit,
The DNS query response control means controls a response to the DNS query request based on the access control content of the domain unit when the DNS query request corresponds to the access control content of the system unit. The DNS server device according to claim 2. The response control content storage means stores a resource record as at least one response control content of the system unit,
The DNS query response control means responds the resource record to the DNS query request when the DNS query request corresponds to the response control content of the system unit. DNS server device. The response control content storage means stores the response control content in association with a device address for identifying a DNS client device and / or a cache server device that is a transmission source of the DNS query request,
The DNS query response control means responds to the DNS query request based on a device address for identifying a DNS client device and / or a cache server device that is a transmission source of the DNS query request included in the DNS query request. The DNS server device according to claim 1, wherein the DNS server device is controlled. The response control content storage means stores any one of no response, rejection response, and resource record as the response control content,
The DNS server apparatus according to claim 1, wherein the DNS query response control unit performs any one of the no-response, the rejection response, and the resource record response. The DNS query request is a request related to name resolution, a request related to dynamic DNS, a request related to zone update, or a request related to zone transfer,
7. The DNS query response control means controls a response to the name resolution request, dynamic DNS request, zone update request, or zone transfer request. The DNS server apparatus as described in any one. A DNS query request control method for receiving a DNS query request and controlling a response to the DNS query request,
The response control content for the DNS query request is stored in the response control content storage unit for each system unit and / or zone unit, and the response control content for the DNS query request is stored in the response control content storage unit for each domain unit Control content storage process;
A DNS query response control step of controlling a response to the DNS query request in the system unit and / or the zone unit and the domain unit based on the response control content stored in the response control content storage unit;
A DNS query request control method comprising: A DNS query request control program for causing a computer to execute a DNS query request control method for receiving a DNS query request and controlling a response to the DNS query request.
The response control content for the DNS query request is stored in the response control content storage unit for each system unit and / or zone unit, and the response control content for the DNS query request is stored in the response control content storage unit for each domain unit Control content storage procedure,
A DNS query response control procedure for controlling a response to the DNS query request in the system unit and / or the zone unit and the domain unit based on the response control content stored in the response control content storage unit;
A DNS query request control program for causing a computer to execute

Images