DNS is hierarchical and extensively cached along a resolver chain, which limits some failure scenarios and allows limited recovery. Each DNS resolver may happen

DNS is hierarchical and extensively cached along a resolver chain, which limits some failure scenarios and allows limited recovery. Each DNS resolver may happen to have some cached entries still good and unexpired. Therefore you could probably recover some known-good IP addresses. This presupposes that a previous cache poisoning attack did not occur or ruin your cache. Alternative recursive DNS resolvers like Google's 8.8.8.8 (which gets the award for being the most-memorable) and OpenDNS, DNS Advantage, etc. are an option, but they are decidedly downstream of rootservers so they may have been affected. There exists a non-ICANN-run collection of DNS nameservers [1] (based out of Europe) which are normally synchronized with the ICANN root, but can be operated independently. If, for some reason, the rootservers become unavailable for an extended amount of time, others may move to establish rootservers, but every downstream DNS resolver will still be configured to depend on the rootservers [1]. Reconfiguring these relationships is a fundamentally human process (as opposed to a machine process), so it will occur out-of-band; then once trust is established the downstream servers will point to the rootservers' static IPs as it is currently done [2]. [1] https://en.wikipedia.org/wiki/Open_Root_Server_Network https://en.wikipedia.org/wiki/Open_Root_Server_Network [2] http://www.internic.net/domain/named.root http://www.internic.net/domain/named.root