Domain name system (dns) security

A system, comprising:

• a computing system of a domain name system (“DNS”), comprising:
• at least one first processor;
• and
• a first non-transitory computer readable medium communicatively coupled to the at least one first processor, the first non-transitory computer readable medium having stored thereon computer software comprising a first set of instructions that, when executed by the at least one first processor, causes the computing system to:
• receive a first user datagram protocol (“UDP”)-based DNS request, the first UDP-based DNS request comprising a source address and a query for a destination DNS record associated with at least one of a destination device in a network, a destination entity associated with the destination device, or a destination domain associated with the destination device or the destination entity;
• in response to receiving the first UDP-based DNS request, send a UDP-based response message to the source address, the UDP-based response message comprising an empty payload portion and a header portion containing truncate (“TC”) flag that is set;
• when a first transmission control protocol (“TCP”)-based DNS request corresponding to the first UDP-based DNS request is received from the source address within a first predetermined period, send, to the source address, a TCP-based response message comprising an answer to the query for the destination DNS record;
• and
• when a TCP-based DNS request corresponding to the first UDP-based DNS request is not received from the source address within the first predetermined period, cause UDP-based DNS requests from the source address to be blocked.

A method, comprising:

• receiving, by a computing system of a domain name system (“DNS”), a first user datagram protocol (“UDP”)-based DNS request, the first UDP-based DNS request comprising a source address and a query for a destination DNS record associated with at least one of a destination device in a network, a destination entity associated with the destination device, or a destination domain associated with the destination device or the destination entity;
• in response to receiving the first UDP-based DNS request, sending, by the computing system, a UDP-based response message to the source address, the UDP-based response message comprising an empty payload portion and a header portion containing a truncate (“TC”) flag that is set;
• when a first transmission control protocol (“TCP”)-based DNS request corresponding to the first UDP-based DNS request is not received from the source address within a first predetermined period, causing, by the computing system, one or more second UDP-based DNS requests from the source address to be blocked, the one or more second UDP-based DNS requests comprising the first UDP-based DNS request;
• when a first TCP-based DNS request corresponding to the first UDP-based DNS request is received from the source address within the first predetermined period, allowing, by the computing system and within a second predetermined period after receiving the first TCP-based DNS request, at least the first UDP-based DNS request from the source address to be processed, by sending, to the source address, at least a TCP-based response message comprising an answer to the query for the destination DNS record;
• receiving, by the computing system and from the source address, one or more third UDP-based DNS requests, after the second predetermined period;
• analyzing, by the computing system and using a machine learning model, the one or more third UDP-based DNS requests, to determine whether or not to block the one or more third UDP-based DNS requests;
• and
• performing, by the computing system, one or more DNS tasks based on the analysis.