Survey on key technologies for protective DNS service

The domain name system (DNS) is a naming service for Internet resources that provides the function of converting from domain names to IP addresses. It serves as the entry point for users to access Internet applications and is also the key point for client-side security threat perception and mitigation. Common DNS abuses and related security threats on the client side include phishing, malware, and other attacks based on DNS. The protective DNS (PDNS) service leverages the existing DNS protocol and architecture to detect and mitigate threats by analyzing DNS queries, thereby protecting users against potential security threads at the source. Currently, a systematic introduction and research on PDNS service in academia and industry is lacking. The existing work, application status, and architecture and functions of PDNS were systematically sorted out. The key technologies associated with PDNS, including DNS-related threat mitigation, DNS anomaly detection, threat intelligence management, and data storage and management technology, were reviewed. The issues and challenges faced by PDNS were analyzed, and future development trends and research directions for PDNS were proposed.