Systems and methods for publishing and using images of DNS zone configurations

A system, comprising:

• at least one processor;
• and
• memory, storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
• detecting that a zone domain name system (DNS) server associated with a zone is unavailable;
• in response to detecting that the zone DNS server is unavailable:
• retrieving, from a repository, an image file comprising a set of DNS records associated with the zone DNS server,
• storing the image file on an image DNS server of the system, and
• transmitting, to a higher-level DNS server, an indication that the image DNS server is a DNS server for the zone;
• receiving, from a DNS resolver, an indication of a requested domain name in the zone;
• and
• in response to receiving the indication of the requested domain name:
• identifying, in the image file on the image DNS server, an IP address based on the requested domain name, and
• transmitting, to the DNS resolver, the IP address.

A method performed at an image server system, the method comprising:

• detecting that a zone domain name system (DNS) server associated with a zone is unavailable;
• and
• in response to detecting that the zone DNS server is unavailable:
• retrieving, from a repository, an image file comprising a set of DNS records associated with the zone DNS server,
• retrieving a signed zone-signing key (ZSK) associated with an image DNS server of the image server system, wherein the signed ZSK is cryptographically signed by a key-signing key (KSK) associated with the zone DNS server,
• storing the image file and the signed ZSK on the image DNS server, and
• transmitting, to a higher-level DNS server, an indication that the image DNS server is a DNS server for the zone;
• after storing the image file and the signed ZSK on the image DNS server, determining that a first DNS record of the set of DNS records needs to be cryptographically signed;
• in response to the determination that the first DNS record needs to be cryptographically signed, cryptographically signing the first DNS record with the signed ZSK;
• and
• transmitting the cryptographically signed first DNS record to a DNS resolver.