Request routing processing

CA 2616612 2017-03-29 queries based on the threshold number of DNS queries. The DNS query processing component is also operable to cause the filtering of at least one of the one or more DNS queries based on the determination. The filtering of the at least one or more DNS queries corresponds to selective filtering of DNS queries based on assigned network addresses for the DNS server authoritative for the identified domain and includes causing the filtering of at least one or more DNS queries received at the service provider and directed to one or mote assigned network address subdivisions or zones available to the service provider based on access control lists.

- IBCA 02816612 2015-04-01

DNS server computing devices corresponding to the assigned network addresses will be delegated to be authoritative to respond to DNS queries for the identified domain.

[0003eJ In accordance with another disclosed aspect there is provided a nontransitory, computer-readable storage medium having one or more computer-executable components for managing DNS queries, the one or more computer-executahle components comprising computer-executable instructions to obtain, by a service provider, a request for hosting DNS query services for an identifiable domain, and determine, by the service provider, a number of assignable network address subdivisions, each network address subdivision corresponding to a range within a pool of available network addresses for service provider DNS server components. The one or more computer-executable components further comprise computer-executable instructions to assign, by the service provider, a network address in each of the determined network address subdivisions. The assigned network addresses from each subdivision for the identifiable domain are not matching. The one or more computer-executable components also comprise computerexecutable instructions to transmit, by the service provider, the assigned network address for each determined network address subdivision, DNS server computing devices corresponding to the assigned network addresses will be delegated to be authoritative to respond to DNS queries for the identified domain.

[0O03f] In accordance with another disclosed aspect there is provided a computerimplemented method for managing DNS queries. The method involves obtaining a request for hosting DNS query sendees for an identifiable domain, the hosting of the DNS query services including providing services responsive to DNS queries. The method also involves assigning a set of DNS servers for hosting the DNS query services, each DNS server in the set of DNS servers being selected from defined network address zones, the defined network address zones corresponding to a division of assignable network addresses for service provider DNS servers. The method further involves assigning the set of DNS servers for hosting the DNS query' services including selecting a non-significant portion of each assigned network address from unique values corresponding to a non-overlapping range of potential values, and causing the DNS servers corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identifiable domain.

-1CCA 02816612 2015-04-01

[0003gl In accordance with another disclosed aspect there is provided a system for managing DNS queries. The system includes a DNS query processor, at a service provider, coupled to a memory and operative to obtain a request for hosting DNS query services for an identifiable domain, the hosting of the DNS query services includes providing sendees responsive to DNS queries. The DNS query processor is also operative to assign a set of DNS servers for hosting the DNS query' services by selecting a non-significant portion of each assigned network address from unique values corresponding to a non-overlapping range of potential values. Each DNS server in the set of DNS servers being selected from defined network address zones. The defined network address zones correspond to a division of assignable network addresses for service provider DNS servers. The DNS query processor is also operative to cause the DNS servers corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identifiable domain,

[0003h] in accordance with another disclosed aspect there is provided a nontransitory, computer-readable storage medium having one or more computer-executable components for managing DNS queries. The one or more computer-executable components include computer-executable instructions to obtain, by a service provider, a request for hosting DNS query services for an identifiable domain. The hosting of the DNS query services includes providing services responsive to DNS queries. The one or more computer-executable components also include computer-executable instructions to assign, by the service provider, a set of DNS servers for hosting the DNS query services, each DNS server in the set nf DNS servers being selected from defined network address zones, the defined network address zones corresponding to a division of assignable network addresses for service provider DNS servers. The computer-executable instructions to assign a set of DNS servers include computerexecutable instructions for assigning the set of DNS servers for hosting the DNS query' services by selecting a non-significant portion of each assigned network address from unique values corresponding to a non-overlapping range of potential values. The one or more computer-executable components further include computer-executable instructions to cause, by the service provider, the DNS servers corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identifiable domain.

- IDCA 02816612 2015-03-31

BRIEF DESCRIPTION OF THE DRAWINGS (0004] The foregoing aspects and many of the attendant advantages of this invention will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:

[0005( FIGURE 1 is a block diagram illustrative of content delivery environment including a number of client computing devices, a content provider, a network storage provider, and a content delivery network service provider;

[0006] FIGURE 2 is a block diagram of the content delivery environment of FIGURE i illustrating the registration of a content provider with a network storage provider;

[0007] FIGURE 3 is a block diagram of the content delivery environment of FIGURE 1 illustrating the registration of a content provider with a service provider for providing request routing services on behalf of the content provider;

[0008] FIGURE 4 is a block diagram of the content delivery environment of FIGURE 1 illustrating the processing of request routing requests by a service provider on behalf of the content provider;

[0009) FIGURES 5A and 5B are block diagrams of the content delivery environment of FIGURE 1 illustrating one embodiment of the processing of resource routing requests generated by client computing devices;

[0010] FIGURE 6 is a flow diagram illustrative of a content provider request routing registration processing routine implemented by a service provider; and

[00Π] FIGURE 7 is a flow diagram illustrative of a request routing processing routine implemented by a service provider.

DETAILED DESCRIPTION

[0012] Generally described, the present disclosure is directed to managing requesting routing functionality corresponding to resource requests for one or more resources associated with a content provider. Aspects of the disclosure will be described with regard to the management and processing of request routing functionality by a service provider, such as a content delivery network (“CDN”) service provider, on behalf of an entity requesting the request routing functionality, such as a content provider. Illustratively, the request routing

-2CA 02816612 2015-03-31 functionality can correspond to the processing, by computing devices associated with the service provider, such as a DNS server component associated with a specific network address, of domain name service (“DNS”) requests on behalf of a content provider. The service provider DNS server components resolve the received DNS queries by identifying a network address of a computing device that will provide requested resources, such as a cache component. Additionally, in embodiments in which the number of DNS queries issued to a targeted content provider domain exceeds a threshold, the service provider can selectively filter DNS queries to mitigate the effect of the incoming DNS queries. For example, in situations associated with a DNS query-based attack, some portion of the DNS queries can be filtered to mitigate the effect of the DNS query-based attack.

[0013] In one embodiment, the service provider can assign a number of DNS server components that will be authoritative for DNS queries to an identified content provider domain on behalf of a content provider. The assigned DNS server components correspond to network addresses that are selected by the service provider from a distributed set of service provider network addresses in a manner that takes into consideration a number of aspects, in one aspect, the service provider can implement processes for ensuring that no two domains, regardless of the owner, are serviced by service provider DNS server components in which the set DNS server components have matching network addresses, in another aspect, the service provider can implement processes for ensuring that, for a specific domain, the portion of the network addresses of the assigned DNS server components significant for network routing purposes do not having matching values and that the portion of the network addresses of the assigned DNS server component not significant for network routing purposes also do not have matching values, (0014] In embodiments in which the number of received DNS queries exceeds a threshold, such as in DNS query-based attacks, the service provider can implement a number of techniques that results in the filtering of the DNS queries in a manner that can mitigate performance impact associated with the services provided to the content provider domain or the overall performance of the service provider components. For example, the service provider can facilitate the selective filtering of DNS queries from one or more of the ranges of network addresses. In another example, the service provider can facilitate the selective filtering of DNS

-3 CA 02816612 2015-03-31 queries by configuring DNS queries directed toward a specific DNS server network address to be processed by specific DNS server components, such as by forwarding DNS queries, (0015] Although various aspects of the disclosure will be described with regard to illustrative examples and embodiments, one skilled in the art will appreciate that the disclosed embodiments and examples should not be construed as limiting. For example, the present disclosure may be described with regard to request routing services provided by a service provider, such as a CDN service provider, that may provide additional services and functionality including network-based storage services, caching services, and content delivery services. However, one skilled in the relevant art will appreciate that a service provider need not provide all, or any, of the additional services or functionality that may be associated with some service providers, such as a CDN service provider. Likewise, although the present application will be discussed with regard to a content provider as the requestor of services, such as the DNS request processing services, the one skilled in the relevant art will appreciate that the requestor of the service need not provide any additional functionality that may be otherwise attributed to content providers.

[0016] FIGURE 1 is a block diagram illustrative of content delivery environment 100 for the managing registration of content provider with a service provider, such as a CDN service provider, and subsequent processing of at least a portion of content requests on behalf of the content provider. As illustrated in FIGURE 1, the content delivery environment 100 includes a number of client computing devices 102 (generally referred to as clients) for requesting content from a content provider, a network storage provider 110, and/or a service provider 106. In an illustrative embodiment, the client computing devices 102 can correspond to a wide variety of computing devices including personal computing devices, laptop computing devices, hand-held computing devices, terminal computing devices, mobile devices, wireless devices, various electronic devices and appliances and the like. In an illustrative embodiment, the client computing devices 102 include necessary hardware and software components for establishing communications over a communication network 108, such as a wide area network or local area network. For example, the client computing devices 102 may be equipped with networking equipment and browser software applications that facilitate communications via the Internet or an intranet.

-4CA 02816612 2015-03-31 (0017] Although not illustrated in FIGURE 1, each client computing device 102 utilizes some type of local DNS resolver component, such as a DNS name server, that generates the DNS queries attributed to the client computing device, in one embodiment, the local DNS resolver component may be provide by an enterprise network to which the client computing device 102 belongs. In another embodiment, the local DNS resolver component may be provided by an Internet Service Provider (ISP) that provides the communication network connection to the client computing device 102.

(0018] The content delivery environment 100 can also include a content provider 104 in communication with the one or more client computing devices 102 via the communication network 108. The content provider 104 illustrated in FIGURE 1 corresponds to a logical association of one or more computing devices associated with a content provider.

-4Aç * ifif. 17 3ί*ι xritjo

WO 2012/071282

PCT/US201Î/061486

Specifically, the content provider 104 can include a web server component 112 corresponding to one or more server computing devices for obtaining and processing requests for content (such as Web pages) from the client computing devices 102. The content provider 104 can further include an origin server component 114 and associated storage component 116 corresponding to one or more computing devices for obtaining and processing requests for network resources. One skilled in the relevant art will appreciate that the content provider 104 can be associated with various additional computing resources, such additional computing devices for administration of content and resources and the like. Additionally, although the origin server component 114 and associated storage component 116 are logically associated with the content provider 104, the origin server component 114 and associated storage components 116 may be geographically distributed throughout the communication network 108 in a manner to best serve various demographics of client computing devices 102, Still further, although illustrative components have been described with regard to the content provider 104, a content provider may have any configuration of components associated with a domain addressable on the communication network 108.

[0019] As further illustrated in FIGURE 1, the content provider 104 can be associated with one or more DNS name server components 118 that are operative to receive DNS queries related to registered domain names associated with the content provider. The one or more DNS name servers can be authoritative to resolve client computing device DNS queries corresponding to the registered domain names of the content provider 104. A DNS name server component is considered to be authoritative to a DNS query if the DNS name server can resolve the query by providing a responsive IP address. As will be explained in greater detail below, in accordance with illustrative embodiments, at least a portion of the request routing functionality provider the DNS name server components 118 will be provided by a service provider on behalf of the content provider 104.

[0020] With continued reference to FIGURE 1, the content delivery environment 100 can further include a service provider 106 in communication with the one or more client computing devices 102, the content provider 104, and the network storage provider 110 via the communication network 108. The service provider 106 illustrated in FIGURE 1 corresponds to a logical association of one or more computing devices associated with a service provider. Specifically, the service provider 106 can include a number of Point of Presence (“POP”) locations 120, 126, 132 that correspond to nodes on the communication network 108, Each POP 120, 126, 132 includes a DNS component 122, 128, 134 made up of

-5Ç * i*2f Ifiê 17 3i*1 30

WO 2012/071282

PCT/DS2011/061486 a number of DNS server computing devices for resolving DNS queries from the client computers 102. Each POP 120, 126, 132 also optionally includes a resource cache component 124, 130, 136 made up of a number of cache server computing devices for storing resources from content providers or network storage providers and transmitting various requested resources to various client computers. The DNS components 122, 128, 134 and the resource cache components 124, 130, 136 may further include additional software and/or hardware components that facilitate communications including, but not limited, load balancing or load sharing softw are/hardware components.

[0021] In an illustrative embodiment, the DNS component 122, 128, 134 and resource cache component 124, 130, 136 are considered to be logically grouped, regardless of whether the components, or portions of the components, are physically separate. Additionally, although the POPs 120, 126, 132 are illustrated in FIGURE 1 as logically associated with the CDN service provider 106, the POPs will be geographically distributed throughout the communication network 108 in a manner to best serve various demographics of client computing devices 102. Additionally, one skilled in the relevant art will appreciate that the service provider 106 can be associated with various additional computing resources, such additional computing devices for administration of content and resources, and the like.

[0022] With further continued reference to FIGURE 1, the content delivery environment 100 can also include a network storage provider 110 in communication with the one or more client computing devices 102, the service provider 106, and the content provider 104 via the communication network 108. The network storage provider 110 illustrated in FIGURE 1 also corresponds to a logical association of one or more computing devices associated with a network storage provider. Specifically, the network storage provider 110 can include a number of network storage provider Point of Presence (^LNSP POP) locations 138, 142 that correspond to nodes on the communication network 108, Each NSP POP 138, 142includes a storage component 140, 144 made up of a number of storage devices for storing resources from content providers which will be processed by the network storage provider 110 and transmitted to various client computers. The storage components 140, 144 may further include additional software and/or hardware components that facilitate communications including, but not limited to, load balancing or load sharing soft ware/hard ware components.

[0023] in an illustrative embodiment, the storage components 140, 144 are considered to be logically grouped, regardless of whether the components, or portions of the components, are physically separate. Additionally, although the NSP POPs 138, 142 are

-6Ç * i*2f Ifiê 17 3i*1 <|H-JO

WO 2O12/W7Î282

PCT/US2011/061486 illustrated in FIGURE 1 as logically associated with the network storage provider 110, the NSP POPs will be geographically distributed throughout the communication network 108 in a manner to best serve various demographics of client computing devices 102. Additionally, one skilled in the relevant art will appreciate that the network storage provider 110 can be associated with various additional computing resources, such additional computing devices for administration of content and resources, DNS name servers, and the like.

[0024] Even further, one skilled in the relevant art will appreciate that the components of the network storage provider 110 and components of the service provider 106 can be managed by the same or different entities. One skilled in the relevant art will also appreciate that the components and configurations provided in FIGURE 1 are illustrative in nature. Accordingly, additional or alternative components and/or configurations, especially regarding the additional components, systems, and subsystems for facilitating communications may be utilized. Specifically, one skilled in the relevant art will appreciate the network storage provider 110 may be omitted from the content delivery environment 100.

[0025] With reference now to FIGURES 2-5B, the interaction between various components of the content delivery environment 100 of FIGURE 1 will be illustrated. For purposes of the example, however, the illustration has been simplified such that many of the components utilized to facilitate communications are not shown. One skilled in the relevant art will appreciate that such components can be utilized and that additional interactions would accordingly occur without departing from the spirit and scope of the present disclosure,

[0026] With reference to FIGURE 2, an illustrative interaction for the optional registration of a content provider 104 with the network storage provider 110 for hosting content on behalf of the content provider 104 will be described. As illustrated in FIGURE 2, the storage provider content registration process begins with registration of the content provider 104 with the network storage provider 110, In an illustrative embodiment, the content provider 104 utilizes a registration application program interface (“API”) to register with the network storage provider 110 such that the network storage provider 110 can provide content on behalf of the content provider 104. The registration API can include the identification of the origin server 114 of the content provider 104 that may provide requested resources to the network storage provider 110. In addition or alternatively, the registration API can include the content to be stored by the network storage provider 110 on behalf of the content provider 104. In one embodiment, the network storage provider 110 may act as an origin server for the content provider 104.

-7C * nW 17 τηι <rn. jo

WO 2012/071282

PCT/US2011/061486

[0027] With continued reference to FIGURE 2, upon receiving the registration API, the network storage provider 110 obtains and processes the content provider registration information. In an illustrative embodiment, the network storage provider 110 can then generate additional information that will be used by the client computing devices 102 as part of the content requests. The additional infoimation can include, without limitation, content provider identifiers, such as content provider identification codes, storage provider identifiers, such as storage provider identification codes, executable code for processing resource identifiers, such as script-based instructions, and the like. One skilled in the relevant art will appreciate that various types of additional information may be generated by the network storage provider 110 and that the additional information may be embodied in any one of a variety of formats.

[0028] In one embodiment, the network storage provider 110 returns an identification of applicable domains for the network storage provider (unless it has been previously provided) and any additional information to the content provider 104. In turn, the content provider 104 can then process the stored content with content provider specific information. In one example, as illustrated in FIGURE 2, the content provider 104 translates resource identifiers originally directed toward a domain of the origin server i 14 to a domain corresponding to the network storage provider 110. The translated URLs are embedded into requested content in a manner such that DNS queries for the translated URLs will resolve to a DNS server corresponding to the network storage provider 110 and not a DNS server corresponding to the content provider 104.

[0029] With reference now to FIGURE 3, an illustrative interaction for registration, by the content provider 104, to utilize the request routing services provided by the service provider 106 will be described. As illustrated in FIGURE 3, the request routing service registration process provided by the sendee provider 106 begins with registration of the content provider 104 with the service provider 106. In an illustrative embodiment, the content provider 104 utilizes a registration API to register with the service provider 106 such that the service provider 106 can provide request routing services on behalf of the content provider 104. The registration API includes the identification of the domains for which the sendee provider 106 will be authoritative (e.g., “contentprovider.com”), the identification of the storage component 140, 144 of the network storage provider 110 or origin servers 114 that will provide requested resources to the client computing devices 102. The registration API can also include additional information including request routing information,

-8CA 02816612 2015-03-31 identification information, or other information that will be used to resolve client computing device DNS requests on behalf of the content provider 104, as will be explained below.

[0030] The sendee provider 106 obtains the registration API and processes the information, in one aspect, the sendee provider 106 can generate the necessary request processing rules or alternative identifiers that may be utilized in the resolution of client computing device DNS queries. In another aspect, the service provider 106 can cause the registration of its DNS name server components for the relevant domains specified by the content provider 104, The service provider 104 can then send a response to the content provider 104, such as a confirmation. Responsive to the processing of the registration API, the service provider 106 can identity the network addresses of the service provider DNS servers, such as an internet Protocol address, that will process DNS queries on behalf of the content provider 104. The content provider 104 can then delegate the identified network addresses of the DNS servers that will be responsible for the identified content provider domain (e.g., “contentprovider.com”).

(0031] As will be explained in greater detail below, in one embodiment, the service provider 106 can distribute, or otherwise assign, network addresses associated with the DNS server components that will be authoritative to DNS requests to the content provider domain. Specifically, in embodiments in which the service provider 106 will assign a number of DNS server components that will be authoritative for a content provider domain, the service provider can first create a number of subdivisions, or zones, of network addresses available to the service provider. The number of subdivisions or zones corresponds to a distribution of the network addresses such that a selection of a network address from each of the subdivisions or zones ensures that a particular domain’s DNS server components have distributed network addresses and avoids situations in which any two assigned DNS server components would have completely overlapping, or exactly matching, network addresses (unless the number of subdivisions or zones is less than the number of DNS server components being assigned as authoritative for a domain). The distribution from different subdivisions can be generally referred to as a “non-overlapping distribution.”

[0032] For purposes of an illustrative example, assume that the service provider 106 has a pool of available network addresses. The service provider 106 can organize the pool into

-9CA 02816612 2015-03-31 two or more ranges of network addresses. For example, the ranges can be defined in a manner such that each network address having a common highest ordered octet could be considered to be in the same range. In another example, the ranges can be defined in a manner such two or more ranges may share a common highest ordered octet, but are distinguished by different second octets. Further, in another embodiment, the ranges of network addresses can correspond to a number of network addresses available for assignment. In alternative embodiments, at least one range of network address can correspond to a single network address for assignment.

[0033} As discussed above, each range of network addresses can be considered a subdivision or zone of the available network addresses. In one aspect, if the number of subdivisions is equal or greater than the number of network addresses that need to be assigned, the service provider 106 ensures a distribution of network addresses for the DNS server components such that no two network addresses will be matching by selecting a network address from different subdivisions. With reference to the previous example in which ranges are determined according to the highest ordered octet of the network address, each selected network address would correspond to a different value of the highest order octet, which ensures that at least that portion of the network addresses do not overlap (e.g., the second, third, fourth octets) and that no two network addresses for the particular domain will be matching. With reference to another example in which two ranges share common first and second octets, each selected network address would correspond to a different value of the third order octet, which still ensures that at least that portion of the network addresses do not overlap and that no two network addresses for the particular domain will be matching. Depending on the pool of network addresses available to the service provider 106, the ranges of network addresses associated with each subdivision or zone can be configured in various manners depending on the desired distribution of network addresses, the total number of available network addresses and the differences in values among the available network addresses.

[0034] in some embodiments, in addition to ensuring a “non-overlapping” distribution of assigned network addresses for a specific domain, if the service provider 106 processes multiple requests for different domains, there is the possibility that such a non-overlapping distribution could result in two or more different domains having at least one assigned DNS network address that matches, in some embodiments, the service provider 106 may wish to establish a threshold number of network addresses that can be matched across

- 10CA 02816612 2015-03-31 unrelated domains (e.g., one, two, three, etc.) or, conversely, a minimum number of network addresses that are not exactly matching between any two non-related domains. Accordingly, the sendee provider 106 can include different levels of processing regarding any potentially matching assigned network address in accordance with the established threshold of number of acceptable matching network addresses.

[0035] in one embodiment, if the threshold is set to zero such that there can be no matching network addresses, the service provider 106 can ensure that the assigned network addresses of DNS servers do not overlap by removing a DNS server’s network address from the pool of available network addresses has been assigned. One example of such a scenario is if there are two or more hosted domains that have a common name (e.g., www.domain.coni) and therefore, cannot have any matching DNS server component network addresses. In another embodiment, it may be possible for two domains to share one or more assigned network address of a DNS server component. However, it may be desirable for the service provider 106 to ensure that no two specific domains are assigned the exact same network addresses from each of the subdivisions or that, for any two domains, no more than half of the assigned DNS server component network addresses are matching. In such embodiments, the service provider 106 can conduct additional processing to ensure and correct for matching network addresses, such as by reducing the number of matching network addresses below the threshold.

[0036] In addition to ensuring that assigned network addresses for a specific domain are distributed in a non-overlapping manner and further ensuring that the number of matching network addresses with regard to another domain are not above a threshold, in another embodiment, the service provider 106 can select portions of the selected network addresses from each subdivision such that there is further no overlap in the portions of the selected network addresses that are not typically considered significant for purposes of routing. Specifically, in one embodiment, the network addresses can corresponds to a number of bits that are divided into octets having unique values. For example, a 16-bit network address can be represented in the form of xx.xx.xx.xx in which each xx pair is an octet. Likewise, a 24-bit network address can be represented in the form of yy.yy.yy.yy-yy.yy in which each yy pair represented by four bits. In accordance with network routing principles, a portion of the network address is utilized for network routing (e.g., the first 2 or 3 octets) and is generally referred to as the “most significant portion of the network address” or the “network portion of the network address.” The remaining - 11 CA 02816612 2015-03-31 portion of the network address (e.g., the last octet) is not considered to be significant for purposes of network routing and is generally referred to as the “non-significant portion of the network address” or the “host portion of the network address.” One skilled in the relevant art will appreciate that the number of octets in a network address that are considered “significant” or “non-significant” may vary according to the specific network protocol being utilized, the configuration of network routing equipment, and other criteria. Accordingly, the example

- 11AÇ * i*2f Ifiê I ? 3ί*1 ΜΊΑ JO

WO 2012/071282

PCT/LS201Î/061486 number of octets utilized to illustrate the difference between the significant and non-significant portions of a network address are illustrative in nature and should not be construed as limiting.

[0037] For purposes of network routing, network addresses are considered to be non-overlapping or non-matching so long as the significant portions of the network addresses do not exactly match, regardless of whether there are one or more matching octets. The non-significant portions of the network address aie effectively ignored for purposes of network routing. Accordingly, in this embodiment, the service provider 106 can select different values for the non-significant portions of the selected network addresses for a specific domain such that there is also no overlap the non-significant portions of the selected network address for a specific domain do not exactly match, even if there is some partial matching.

[0038] With reference to the previous example, if we assume that four network addresses are selected and the non-significant portion of the network addresses correspond to the last octet in the network address, the non-significant portion of the network addresses can be subdivided into four ranges of values such there is no overlap in the assigned values for the least most significant bits. Continuing with this example, the last octet has a range of 256 total potential values. Since each domain is illustratively associated with four network addresses, the potential values of the last octet can be divided into ranges of values of 1-63, 64-127, 128-191, and 192-255. Accordingly, the value of the last octet for the first assigned network address would be picked from the range of 1-63; the value of the last octet for the second assigned network address would be picked from the range of 64-127; the value of the last octet for the third assigned network address would be picked from the range of 128-191; and the value of the last octet for the fourth assigned network address would be picked from the range of 192-255. Thus, in this embodiment, the resulting assigned network addresses wOuId be completely non-overlapping with regard to not only the significant portions of the network addresses but also with regard to the non-overlapping portions of the network addresses,

[0039] in the event that a number of DNS queries exceed a threshold, such due to a DNS query based attack or due to a spike in requests, the service provider 106 can selectively filter DNS queries from one or more selected network address. If the “excessive” DNS queries are targeted toward a specific content provider, the service provider 106 may be able to maintain some DNS query functionality by filtering out less than all the assigned subdivisions for the targeted domain. Additionally, the service provider 106 can also

-12r * i»2f ins 17 3i»i xritjo

WO 2O12/V71282

PCT/US201Î/061486 mitigate the impact of such excessive DNS queries to the request routing services provided to other non-targeted content providers by filtering out some or all of the assigned subdivisions for the targeted domain or by limiting the processing of DNS queries to a targeted domain to specific physical computing devices. Still further, the service provider 106 can forward some portion of the DNS queries to different points of presence or DNS server components to help mitigate the impact of the number of DNS queries.

[0040] Illustratively, upon the optional identification of appropriate storage component 140, 144, 148 of the network storage provider 110 and the registration for request routing functionality with the service provider 106, the content provider 104 can, in one embodiment as will be further described below in reference to FIGURES 4 and 5A and 5B, begin to process DNS requests for content generated on behalf of the client computing devices 102. Specifically, in accordance with DNS routing principles, a client computing device DNS query corresponding to a resource identifier would eventually be resolved by identifying a network address corresponding to either the origin server component 114 and associated storage component 116 or storage component 140,144,148 of the network storage provider 110 by a DNS nameserver associated with the service provider 106.

[0041] Turning now to FIGURE 4, in accordance with one embodiment once the service provider 106 has begun processing request routing functionality on behalf of the content provider, a client computing device 102 issues a DNS query for the content provider domain (e.g,, “contentprovider.com”). Illustratively, the client computing device 102, such as through a browser software application, issues a DNS query for the content provider domain that first results in the identification of a DNS server authoritative to the and the “com” portions of the domain. After partially resolving the domain according to the and “com” portions of the domain, the client computing device 102 then issues another DNS query for the URL that results in “.contentprovider” portion of the domain. The issuance of DNS queries corresponding to the and the “com” portions of a domain are well known and have not been illustrated.

[0042] In an illustrative embodiment, the identification of the identification of a DNS server authoritative to the “contentprovider” corresponds to one of the assigned IP addresses of a DNS server associated with the service provider 106. In one embodiment, the IP address is a specific network address unique to DNS server component(s) of a specific POP associated with the service provider 106. In another embodiment, the IP address can be shared by one or more POPs associated with the service provider 106, which may be geographically or logically distributed. In this embodiment, a DNS query to the shared IP

-13CA 02816612 2015-03-31 address utilizes a one-to-many network routing schema, such as anycast, such a specific POP will receive the request as a function of network topology. For example, in an anycast implementation, a DNS query issued by a client computing device 102 to a shared IP address will arrive at a DNS server component of the service provider 106 logically having the shortest network topology distance, often referred to as network hops, from the client computing device. The network topology distance does not necessarily correspond to geographic distance. However, in some embodiments, the network topology distance can be inferred to be the shortest network distance between a client computing device 102 and a service provider POP.

{0043] As illustrated in FIGURE 4, a DNS server component of the service provider 106 obtains the DNS query and can resolve the DNS query by providing a network address, such as an IP address, of a component for providing the request content. For example, the receiving DNS server component may provide an IP address of a Web server that can provide a requested Web page. In another example, the DNS server may provider an IP address of a cache component that may provide a request resource or file. In an alternative embodiment, the DNS server component may also provide alternative identifiers, such as canonical names (“CNAMES”) that can be used to refine request routing processing, in the example illustrated in FIGURE 4, it is assumed that the DNS query transmitted by the client computing device 102 can be processed.

[0044] Turning now to FIGURES 5A and 5B, in other embodiments, the service provider 106 may obtain a number of DNS queries for a domain such that the number of DNS queries exceeds a threshold. As illustrated in FIGURE 5A, exceeded threshold may be indicative of a DNS-based network attack in which multiple client computing devices 102 attempt to overload a content provider domain with DNS queries. The exceeded threshold may also be indicative of spikes in content requests or correspond to a number of DNS queries that exceeds agreed upon service levels. In one aspect, the multiple DNS queries may be directed to one of the specific assigned network addresses of the DNS server components processing DNS queries on behalf of the content provider 104, In another aspect, the multiple DNS queries may be directed to all the specific assigned network addresses for the content provider 104. Stilt further, in another aspect, the multiple DNS queries may not be targeted only to a specific content provider domain and may indicative of a larger, network based attack.

- 14CA 02816612 2015-03-31 (0045] In order to mitigate the impact of the DNS queries that have exceeded a threshold (or will exceed a threshold), the service provider 106 can begin causing the selective filtering at least portions of the DNS queries directed to one or more of the assigned network addresses. Specifically, in one embodiment, the service provider 106 can issue commands or utilize routing protocols that cause DNS queries to be filtered in the communication network 108 prior to being received by the service provider 106. For example, the service provider 106 can utilize a null route injection for identified network addresses that networking equipment, such as routers, to prevent the forwarding of the DNS queries.

(0046] With reference to FIGURE 5B, in addition to the filtering of DNS queries in the communication network 108, the service provider 106 can utilize router access control lists to Filter, or otherwise block, DNS queries directed to one or more of the assigned network address subdivisions or zones that are received at the service provider. If the DNS queries associated with the exceeded threshold are targeted to a particular subdivision or zone, the service provider 106 can further filter the excessive DNS queries to the targeted network address. If the DNS queries associated with the exceeded threshold are targeted to a larger number of subdivisions or zones, the service provider 106 can filter all the targeted domains to effectively stop queries.

[0047] Alternatively, the service provider can filter a percentage of zones in an effort to maintain a percentage DNS query processing functionality. For example, if a content provider 104 has been associated with a DNS server component for each of four zones, the service provider 106 can filter half of the assigned network addresses to maintain operation of the request routing functionality at least at a fifty percent level. As illustrated in FIGURE 5B, by filtering only certain network address zones, at least some portion of DNS queries for the “targeted” content provider or other content providers, such as by client computing device 102Z can continued to be processed. Additionally, the service provider 106 can configure one or more specific DNS server components to process any remaining DNS queries that have not been filtered in the communication network 108 or by the service provider. Still further, the server provider 106 can forward at least a portion of the non-filtered DNS queries to other DNS server components that may be better suited to process the non-filtered DNS queries or to distribute the load at a specific POP.

- 15CA 02816612 2015-03-31

100481 With reference now to FIGURE 6, one embodiment of a routine 600 implemented by a service provider 106 for managing registration of content provider 104 will be described. One skilled in the relevant art will appreciate that actions/steps outlined for routine 600 may be implemented by one or many computing devîces/components that are associated with the service provider 106, such as a DNS query processing component or a point of presence associated with the sendee provider. Accordingly, routine 600 has been logically associated as being generally performed by the service provider 106, and thus the following illustrative embodiments should not be construed as limiting.

[00491 At block 602, the service provider 106 obtains a request for providing DNS request routing services on behalf of a content provider 104. illustratively, the request for providing DNS request routing services may be facilitated through a registration API in which the content provider specifies information necessary for the service provider 106 to begin hosting DNS name server functionality on behalf of the content provider. The transmission of the registration API (and associated information) may be an automatic process corresponding to an exchange of information between computing devices without need for administrator, or other human interaction. Alternatively, the transmission of the registration API (and associated information) may be an automatic, manual, or semi-manual process in which an administrator specifies at least a portion of the information necessary for the service provider 106 to begin hosting DNS name server functionality on behalf of the content provider.

[0050] At block 604, the service provider 106 determines a number of assignable network address subdivisions or zones. As previously described, in one embodiment, the service provider 106 may maintain two or more ranges of DNS server network addresses that can be assigned to content providers. Illustratively, the sendee provider can maintain a pool of available network addresses that correspond to the DNS server components that can be assigned to a content provider. Accordingly, the sendee provider 106 can organize the pool into two or more ranges of network addresses in which each range of network addresses corresponds to a subdivision or zone. As explained above, the service provider 106 can further select network addresses from the subdivisions to ensure that, for a specific domain, at least the significant portions of the set of assigned network addresses will not have any exactly matching values, regardless of whether is at least some common values.

- 16CA 02816612 2015-03-31

[0051J At block 606, the first network address subdivision is selected as a current network address subdivision and at block 608, the service provider 106 assigns a network address from the current network address subdivision. In an illustrative embodiment, in addition to the selection of a unique network address from the range of network addresses associated with the current network address subdivision, block 608 can also correspond to the service provider 106 selecting a value for the non-significant portion of the selected network addresses such that for a specific domain, at least the non-significant portions of the set of assigned network addresses also will not have any exactly matching values. One skilled in the relevant art will appreciate that the non-significant portions of the set of assigned network addresses will not be considered matching solely because some portion of the network addresses have common values. Still further, block 608 can also correspond to the service provider 106 conducting additional processing such that for two domains, regardless of ownership, the set of assigned network addresses (either significant portions or a combination of significant and non-significant portions) will have more than a threshold number of exactly matching network addresses. Additionally, the service provider 106 can also conduct some type of conflict resolution such that the assigned network address would not conflict with a previously assigned network address for any domain that would be considered a parent domain, a child domain, a sibling domain, etc. In such embodiment, the pool of available network addresses may be filtered to remove any potentially conflicting network addresses.

[0052] At decision block 610, a test is conducted to determine whether additional network subdivisions exist, if so, at block 612, the service provider 106 selects a next network address subdivision as the current network address subdivision and the routine 600 proceeds to block 608 to select another network address for the current subdivision. With reference to the previous example, the routine 600 can repeat to assign a network address for each of the remaining three network address subdivision ranges and values for the non-significant portions of the network address (e.g., ranges of 64-127, 128-191, and 192-254 for the last octet of the assigned network addresses). Additionally, the routine 600 can provide the additional conflict resolution or other limitation techniques, described above, to filter out network addresses that should not be assigned to the content provider. However, in an alternative embodiment, the service provider 106 may not necessarily assign network addresses from all the available network address subdivisions or zones.

- 17CA 02816612 2015-03-31

[0053] Once ail the network addresses have been assigned, at block 614, the service provider 106 transmits assigned network addresses in response to the request for DNS sendee hosting. Based on the identified network addresses, the content provider can delegate the identified domain to the assigned network addresses. One skilled in the relevant art will appreciate that upon delegation of the assigned network addresses (or DNS name server names), the service provider 106 can host the DNS name server components on different computing devices in a manner that each physical computing device can correspond to one subdivision or zone or less than all the subdivisions or zones. At block 616, the routine 600 ends.

[0O54J With reference now to FIGURE 7, one embodiment of a routine 700 implemented by the service provider 106 for processing DNS requests will be described. Similar to FIGURE 6, one skilled in the relevant art will appreciate that actions/steps outlined for routine 700 may be implemented by one or many computing devices/components that are associated with the service provider 106. Accordingly, routine 700 has been logically associated as being generally performed by the service provider 106, and thus the following illustrative embodiments should not be construed as limiting.

[0055] At block 702, the service provider 106 obtains one or more DNS queries from client computing devices 102. illustratively, the DNS queries are described as originating from separate client computing devices 102. However, at least some portion of the DNS queries may be transmitted by the same client computing device 102 or from some other component configured in a manner to generate multiple DNS queries. Additionally, in an alternative embodiment, the sendee provider 106 may receive an indication as to the number of DNS queries being transmitted without actual receipt of the DNS queries by the service provider.

[0056] At block 704, the service provider 106 associates the DNS queries with a set of DNS queries that have exceeded a threshold. As previously described, the exceeded threshold may be indicative of a DNS-based network attack in which multiple client computing devices 102 attempt to overload a content provider domain with DNS queries. The exceeded threshold may also be indicative of spikes in content requests or correspond to a number of DNS queries that exceeds agreed upon service levels. In one aspect, the multiple DNS queries may be directed to a specific assigned network address for the content provider 104, In another aspect, the multiple DNS queries may be directed to all the specific assigned network addresses for the content provider 104. Still further, in another aspect, the multiple DNS queries may not be - 18CA 02816612 2015-03-31 targeted only to a specific content provider domain and may be indicative of a larger, network based attack. One skilled in the relevant art will appreciate that the association of the DNS queries may also be determined by criteria other than the number of DNS queries, such as by the source of the DNS query (e.g., from a known bad actor or IP address) or based on signature mapping of the DNS query (e.g,, known identification information in the DNS query).

[0057] At block 706, the service provider 106 determines network address attributes of the DNS queries that have exceeded the threshold (e.g., the DNS query⁷ attack”). In one aspect, the service provider 106 may identify all the specific network addresses that have been targeted. In another aspect, the service provider 106 may determine a percentage of targeted network addresses to attempt to block or filter. At decision block 708, a test is conducted to determine whether to filter the received DNS queries. As previously described,

- 18AWO 2912/071282

PCT/LS2011/061486

C * r*2f ifif. I7 <ιΊ1 JO the service provider 106 may attempt to filter all DNS queries to a particular network address if only a portion of the network addresses associated with a content provider are targeted or based on a determination that the service provider request routing services would be compromised. In another example, if multiple network addresses are targeted the service provider 106 may determine to filter a percentage of the network address to maintain some request routing functionality on behalf of the content provider 104.

[0058] If the service provider 106 determines to filter the DNS queries, at block 710, the service provider filters, or otherwise blocks, the DNS queries. In one embodiment, the service provider 106 may utilize a communication or routing protocol to cause network-based equipment, such as routers, to filter all DNS queries corresponding to an identified IP address prior to being received by the service provider. As previously described, an example of such a routing protocol would be the utilization of null route injunction command/information. In another embodiment, the service provider 106 can filter the DNS queries as they aie received by the service provider network. For example, the service provider can utilize router access control lists that can be configured to block requests to specific network addresses as the requests are received by the routers. Alternatively, if the service provider 106 determines not to filter, the service provider, through a receiving DNS server component, processes the received DNS query. As previously described, the service provider can configure specific hardware computing devices to be responsive to any non-blocked network addresses. In a further embodiment, the service provider 106 can also direct DNS queries targeted to one or more assigned network addresses to specific DNS components within the service provider network. For example, the service provider 106 can forward one or more DNS queries via the communication network, such as a communication tunnel. At block 714, the routine 700 ends.

[0059] Clauses:

Clause 1. A method for managing DNS queries comprising:

obtaining, by a service provider, a request for hosting DNS query services for an identifiable domain;

determining, by the service provider, a number of assignable network address subdivisions, wherein each network address subdivision corresponds to a proportional division of available network addresses for service provider DNS server components; assigning, by the service provider, a network address in each of the determined network address subdivisions, wherein the a set of assigned network addresses from each subdivision for the identifiable domain are not matching; and

-19WO 2U12/W71282

PCT/LÎS2011/D61486 transmitting, by the service provider, the assigned network address for each determined network address subdivision, wherein DNS server components corresponding to the assigned network addresses will be delegated to be authoritative to respond to DNS queries for the identified domain.

Clause 2. The method as recited in Clause 1, wherein each network address subdivision corresponds to one of four ranges of available network addresses for service provider DNS server components.

Clause 3. The method as recited in Clause 2, wherein the four ranges of available network addresses are evenly distributed.

Clause 4. The method as recited in Clause 1, wherein assigning the network address in each of the determined network address subdivisions includes selecting a network address from each determined network address subdivision such that the significant portion of the assigned networks addresses do not match.

Clause 5. The method as recited in Clause 1, wherein assigning the network address in each of the determined network address subdivisions further includes preventing the assignment of network addresses that results in the matching of a threshold number of significant portions of the assigned network addresses between the identifiable domain and other domains.

Clause 6. The method as recited in Clause 5, wherein the threshold number of network addresses is defined such that between the identifiable domain and the other domains, there is at least one significant portion of the assigned network addresses that does not match.

Clause 7. The method as recited in Clause 1, wherein assigning fhe network address in each of the determined network address subdivision includes performing conflict resolution removing one or more network addresses not available to be assigned due to domain based conflicts.

-20WO 2012/071282

PCT/ES201Î/061486

Clause 8. The method as recited in Clause 1, wherein assigning the network address in each of the determined network address subdivision includes assigning a uniquely named DNS server that has been previously associated with the identified network address.

Clause 9. The method as recited in Clause 1, wherein assigning the network address in each of the determined network address subdivisions includes selecting a non significant portion of each assigned network address such that a threshold number of the non significant portions of the network addresses for the identifiable domain are not matching.

Clause 10. The method as recited in Clause 9, wherein the threshold number of non matching non significant portions of network addresses includes all the assigned network addresses such that for the identifiable domain, none of the non significant portions of all the assigned network addresses match.

Clause 11. The method as recited in Clause 1, wherein the network addresses correspond to Internet protocol network addresses.

Clause 12. A method for managing DNS queries comprising:

obtaining a request for hosting DNS query services for an identifiable domain;

assigning a set of DNS servers for hosting the DNS query services, wherein each DNS server in the set of DNS servers is selected from defined network address zones, wherein the defined network address zones correspond to a division of assignable network addresses for service provider DNS servers; and causing the DNS server components corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identified domain,

Clause 13. The method as recited in Clause 12 further comprising determining a number of network address zones.

Clause 14. The method as recited in Clause 13, wherein the number of network address zones corresponds to a proportional distribution of available network addresses.

Clause 15. The method as recited in Clause 12, wherein assigning a set of DNS servers for hosting the DNS query services includes selecting a network address from each

-21C * IlW 17 3111 <|H-30

WO 2012/971282

PCT/US2011/061486 determined network address network address zones such that the significant portion of the assigned networks addresses for the identifiable domain are not matching.

Clause 16. The method as recited in Clause 15 further comprising selecting a non significant portion of each assigned network address such that a threshold number of the non significant portions of the network addresses for the identifiable domain are not matching.

Clause 17. The method as recited in Clause 16, wherein selecting the non significant portion of each assigned network address corresponds to selecting the non significant portions of the network addresses from unique values corresponding to a non overlapping range of potential values.

Clause 18. The method as recited in Clause 17, wherein the range of values corresponds to the number of zones.

Clause 19. The method as recited in Clause 12, wherein causing the DNS server components corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identified domain includes transmitting the assigned network address for each of the set of DNS servers.

Clause 20, The method as recited in Clause 12, wherein causing the DNS server components corresponding to the assigned network addresses to be authoritative to respond to DNS queries for the identified domain includes transmitting a name associated with the assigned network address for each of the set of DNS servers, the name associated with the assigned network address previously configured with the assigned network addresses.

Clause 21. A method for managing DNS queries comprising:

determining, at a service provider, whether DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider;

determining, at the service provider, whether to filter the one or more DNS queries based on the threshold number of DNS queries; and causing, at the service provider, the selective filtering of at least one of the one or more DNS queries based on the determination, wherein the selective filtering of the at least

-22C * ifif· 17 τηι mu. jo

WO 2012/071282

PCT/liS2«limi486 one or more DNS queries corresponds to the selective filtering of DNS queries based on assigned network addresses for the DNS server authoritative for the identified domain.

Clause 22. The method as recited in Clause 21, wherein causing the filtering of at least one of the one or more DNS queries based on the determination includes causing the filtering of at least one or more DNS queries based on access control lists.

Clause 23, The method as recited in Clause 21, wherein causing the filtering of at least one of the one or more DNS queries based on the determination includes transmitting a request to filter one or more DNS queries for domains in which service provider DNS servers are authoritative.

Clause 24. The method as recited in Clause 21, wherein determining whether to filter the one or more DNS queries based on the associated set of DNS queries includes determining whether to filter based on a percentage of DNS queries allowed to be processed.

Clause 25. The method as recited in Clause 21, wherein the range of available service provider network addresses corresponds to a plurality of network address zones such that each network address zone is defined according to a division of available network addresses for service provider DNS server components.

Clause 26. The method as recited in Clause 21 further comprising obtaining, at the service provider, at least a portion of the one or more DNS queries associated with the identifiable domain.

Clause 27. The method as recited in Clause 21 further comprising: determining, at the service provider, whether DNS queries associated with a different identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider; and determining, by the service provider, not to filter the one or more DNS queries associated with a different identifiable domain, wherein the determination corresponds to a percentage of DNS queries allowed to be processed.

-23Ç * i*2f Ifif. 17 7ί*1 <|H-JO

WO 2U12/W7I282

PCT/LIS 2011/1361486

Clause 28. The method as recited in Clause 21, wherein causing the filtering of at least one of the one or more DNS queries based on the determination includes causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

Clause 29, The method as recited in Clause 28, wherein causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers includes forwarding the at least one of the one or more DNS queries to the alternative set of DNS servers.

Clause 30. A system for DNS query processing comprising:

an interface component for obtaining registration information at a service provider for registering one or more content providers with the service provider, the registration corresponding to hosting at least of portion of request routing functionality associated with one or more resources provided by the content provider a DNS query processing component operable to:

determine whether DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider;

determine whether to filter the one or more DNS queries based on the threshold number of DNS queries; and cause the filtering of at least one of the one or more DNS queries based on the determination.

Clause 31, The system as recited in Clause 30 further comprising a network, point of presence associated with the service provider, wherein the network point of presence includes a DNS server component that receives a DNS query from client computing devices, wherein the DNS server in the first network point of presence is operable to filter DNS queries based on access control lists.

Clause 32. The system as recited in Clause 30, wherein the DNS query processing component selectively filters the DNS queries causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

Clause 33. The system as recited in Clause 32, wherein the DNS query processing component causes at least one of the one or more DNS queries to be answered by an

-24Ç * i*2f Ifiê I ? 3ί*1 <01.30

WO 2012/071282

PCT/LS201Î/061486 alternative set of DNS servers by forwarding the at least one of the one or more DNS queries to the alternative set of DNS servers.

Clause 34. The system as recited in Clause 30, wherein the DNS query processing component determines whether to filter the one or more DNS queries based on the associated set of DNS queries based on a percentage of DNS queries allowed to be processed.

Clause 35, The system as recited in Clause 30, wherein the range of available seivice provider network addresses corresponds to a plurality of network address zone such that each network address zone is defined according to a division of available network addresses for service provider DNS server components.

Clause 36. The system as recited in Clause 30, wherein the DNS query processing component is further operable to:

obtain one or more additional DNS queries, the additional DNS queries corresponding to the identifiable domain, wherein the DNS server component corresponds to a different assigned network from a range of available service provider network addresses;

associate the one or more DNS queries with the identified set of DNS queries exceeding a threshold number of DNS queries that can be processed by a service provider; and determine not to filter the one or more DNS queries.

[0060] It will be appreciated by those skilled in the art and others that all of the functions described in this disclosure may be embodied in software executed by one or more processors of the disclosed components and mobile communication devices. The software may be persistently stored in any type of non-volatile storage.

[0061] Conditional language, such as, among others, “can,” could, might, or ’’may. unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, w'hile other embodiments do not include, certain features, elements and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.

-25CA 02816612 2015-03-31

[0062] Any process descriptions, elements, or blocks in the flow diagrams described herein and/or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those skilled in the art. It will further be appreciated that the data and/or components described above may be stored on a computer-readable medium and loaded into memory of the computing device using a drive mechanism associated with a computer readable medium storing the computer executable components such as a CD-ROM, DVD-ROM, or network interface further, the component and/or data can be included in a single device or distributed in any manner. Accordingly, générai purpose computing devices may be configured to implement the processes, algorithms, and methodology of the present disclosure with the processing and/or execution of the various data and/or components described above.

[0063] It should be emphasized that many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure and protected by the following claims.

-26CA 2616612 2017-03-29

THE EMBODIMENTS OF THE INVENTION IN WHICH AN EXCLUSIVE PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS:

1. A method for managing DNS queries comprising:

determining, at a service provider, whether DNS queries associated with 5 an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider;

determining, at the sendee provider, whether to filter the one or more DNS queries based on the threshold number of DNS queries; and causing, at the service provider, selective filtering of at least one of the one 10 or more DNS queries based on the determination, wherein the selective filtering of the at least one or more DNS queries corresponds to the selective filtering of DNS queries based on assigned network addresses for the DNS server authoritative for the identified domain and includes causing the filtering of at least one or more DNS queries received at the service provider and directed to one or more assigned network address subdivisions or zones available to the sendee provider based on access control lists.

2. The method as recited in Claim 1, wherein causing the filtering of at least one of the one or more DNS queries based on the determination includes transmitting a request to filter one or more DNS queries for domains in which service provider DNS servers are authoritative.

3. The method as recited in any one of Claims 1 to 2, wherein determining whether to filter the one or more DNS queries based on the associated set of DNS queries includes determining whether to filter based on a percentage of DNS queries allowed to be processed.

-27CA 2616612 2017-03-29

4. The method as recited in any one of Claims 1 to 3, wherein the range of available service provider network addresses corresponds to a plurality of network address zones such that each network address zone is defined according to a division of available network addresses for service provider DNS server components.

5. The method as recited in any one of Claims 1 to 4 further comprising obtaining, at the service provider, at least a portion of the one or more DNS queries associated with the identifiable domain.

6. The method as recited in any one of Claims 1 to 5 further comprising:

determining, at the service provider, whether DNS queries associated with a different identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider; and determining, by the service provider, not to filter the one or more DNS queries associated with a different identifiable domain, wherein the determination corresponds to a percentage of DNS queries allowed to be processed.

7. The method as recited in any one of Claims 1 to 6, wherein causing the filtering of at least one of the one or more DNS queries based on the determination includes causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

8. A system for DNS query processing comprising:

an interface component for obtaining registration information at a sendee provider for registering one or more content providers with the service provider, the registration corresponding to hosting at least of portion of request routing functionality associated with one or more resources provided by the content provider a DNS query processing component operable to: