With the widespread application of large language models (LLMs), their advantages in context analysis and semantic inferencing are becoming increasingly prominent, and we are attempting to introduce them into the realm of DNS repair. As is well known, DNS, as the core of Internet infrastructure, has complex policies and a fragile system, where even a small misconfiguration can lead to catastrophic service failures. Especially in large-scale networks, analyzing detected errors and generating repair solutions often requires operators to invest a significant amount of time and effort. This paper proposes a scalable framework, DNSHolmes, designed to leverage LLMs for generating DNS configuration repair solutions. Specifically, this method first addresses the numerous potential root causes in large-scale errors by abstracting them into a small number of State Equivalence Classes (SECs). It then adopts a deterministic finite automaton (DFA) to compute a Critical Path Graph (CPG) for each class, precisely isolating the minimal set of records responsible for the failure. Crucially, the CPG serves as a focused, verifiable context for a Large Language Model (LLM), guiding it to generate accurate patches while overcoming the fundamental context-length limitations that help LLM with effective repair reasoning. Our evaluation on large-scale public datasets and a real-world campus network demonstrates that DNSHolmes can reduce operational effort by 78.4% and achieve efficient repair in large-scale DNS configuration.

DNS misconfiguration can result in severe social and financial consequences. Existing DNS configuration verification tools employ a centralized architecture, where all zone files are collected for verification. This architecture faces significant scalability issues (e.g., the verifier becoming the performance bottleneck and not supporting incremental verification). Inspired by the recent proposal of distributed data plane verification and the resemblance between the network data plane and DNS configuration, we propose to rearchitect DNS configuration verification with a distributed design. Our key insight is that by analyzing the query processing behavior of each DNS zone file in parallel and stitching the results in a symbolic way, we can substantially scale up the verification of DNS configuration. Evaluation shows that an up to 9.51× speed up on a dataset with over 410,000 resource records while having small overhead.