Measuring the Centrality of DNS Infrastructure in the Wild
Source abstract
Abstract
The centralization of the global DNS ecosystem may accelerate the creation of an oligopoly market, thereby, increasing the risk of a single point of failure and network traffic manipulation. Earlier studies have revealed the level of centralization in terms of the market share of public DNS services and DNS traffic seen by major CDN providers. However, the level of centralization in the infrastructure of the DNS Ecosystem is not well understood. In this paper, we present a novel and lightweight measurement approach that effectively discovers resolver pools from a single probing point. We conduct an Internet-wide active measurement on the client-side as well as the server-side DNS infrastructure to assess the level of DNS centralization in terms of the supporting infrastructure. Our measurement results show that the DNS infrastructure is much more centralized than previously believed. Over 90% of forwarding resolvers are backed by less than 5% (4071) of indirect resolvers. Merely 0.45% (12,679) of all name servers across 1138 gTLDs, operated by just 10 DNS providers, provide authoritative domain resolution service for 48.5% (more than 100 million) of domain names. We also investigated several leading DNS providers in IP infrastructure, load distribution, and service geo-distribution. The findings of our measurements provide novel insights into the centrality of the DNS infrastructure, which will help the Internet community promote the understanding of the DNS ecosystem.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: IPv6, Mobility, Handover, Networks, Security · Caching and Content Delivery · Wireless Networks and Protocols
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
Funding
National Key Research and Development Program of China
References (39)
Show source-provided references
1. Arkko, J., Trammell, B., Nottingham, M., Huitema, C., Thomson, M., Tantsura, J., and Ten Oever, N. (2023, March 10). Considerations on Internet Consolidation and the Internet Architecture. Technical Report, Internet Draft. Available online: https://tools.ietf.org/html/draft-arkko-iab-internet.
2. (2023, April 09). DNS Resolver Centrality. Available online: https://blog.apnic.net/2019/09/23/dns-resolver-centrality/.
3. Consolidation in the DNS resolver market–how much, how fast, how dangerous?10.1080/23738871.2020.1722191 ↗
4. Moura, G.C., Castro, S., Hardaker, W., Wullink, M., and Hesselman, C. (2020, January 27–29). Clouding up the Internet: How centralized is DNS traffic becoming?. Proceedings of the ACM Internet Measurement Conference, Virtual Event.10.1145/3419394.3423625 ↗
5. (2021, December 11). Consolidation in the Internet Economy. Available online: https://future.internetsociety.org/2019/.
6. (2021, December 11). Akamai Edge DNS Causes Massive Outage 2021. Available online: https://constellix.com/news/akamai-edge-dns-causes-massive-outage-2021.
7. (2021, December 11). Numerous Lessons We Can Learn from the Facebook Outage and Its Mistakes. Available online: https://circleid.com/posts/20211007-numerous-lessons-we-can-learn-from-the-facebook-outage-and-its-mistakes.
8. (2022, May 11). EU Wants to Build Its Own DNS Infrastructure with Built-In Filtering Capabilities. Available online: https://therecord.media/eu-wants-to-build-its-own-dns-infrastructure-with-built-in-filtering-capabilities/.
9. Passive observations of a large DNS service: 2.5 years in the life of Google
10. Allman, M. (November, January 31). Comments on dns robustness. Proceedings of the Internet Measurement Conference 2018, Boston, MA, USA.10.1145/3278532.3278541 ↗
11. Park, J., Khormali, A., Mohaisen, M., and Mohaisen, A. (2019, January 24–27). Where are you taking me? Behavioral analysis of open dns resolvers. Proceedings of the 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), IEEE, Portland, OR, USA.10.1109/DSN.2019.00057 ↗
12. Papagiannaki, K., Gummadi, P.K., and Partridge, C. (2013, January 23–25). On measuring the client-side DNS infrastructure. Proceedings of the 2013 Internet Measurement Conference, IMC 2013, Barcelona, Spain.
13. Dagon, D., Lee, C., Lee, W., and Provos, N. (2008, January 10–13). Corrupted DNS resolution paths: The rise of a malicious resolution authority. Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, CA, USA.
14. Alzoubi, H.A., Rabinovich, M., and Spatscheck, O. (2013, January 13–17). The anatomy of LDNS clusters: Findings and implications for web content delivery. Proceedings of the 22nd International Conference on World Wide Web, Rio de Janeiro, Brazil.10.1145/2488388.2488397 ↗
15. Kührer, M., Hupperich, T., Bushart, J., Rossow, C., and Holz, T. (2015, January 28–30). Going wild: Large-scale classification of open DNS resolvers. Proceedings of the 2015 Internet Measurement Conference, Tokyo, Japan.10.1145/2815675.2815683 ↗
16. Pearce, P., Jones, B., Li, F., Ensafi, R., Feamster, N., Weaver, N., and Paxson, V. (2017, January 16–18). Global measurement of DNS manipulation. Proceedings of the 26th USENIX Security Symposium (USENIX Security 17), Vancouver, BC, Canada.
17. Liu, B., Lu, C., Duan, H., Liu, Y., Li, Z., Hao, S., and Yang, M. (2018, January 15–17). Who is answering my queries: Understanding and characterizing interception of the DNS resolution path. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA.10.1145/3340301.3341122 ↗
18. Mao, Z.M., Cranor, C.D., Douglis, F., Rabinovich, M., Spatscheck, O., and Wang, J. (2002, January 10–15). A Precise and Efficient Evaluation of the Proximity Between Web Clients and Their Local DNS Servers. Proceedings of the USENIX Annual Technical Conference, General Track, Berkeley, CA, USA.
19. Reexamining DNS from a global recursive resolver perspective10.1109/TNET.2014.2358637 ↗
20. Al-Dalky, R., and Schomp, K. (2018, January 26–27). Characterization of collaborative resolution in recursive DNS resolvers. Proceedings of the International Conference on Passive and Active Network Measurement, Berlin, Germany.10.1007/978-3-319-76481-8_11 ↗
21. Hao, S., Wang, H., Stavrou, A., and Smirni, E. (2015, January 10–13). On the DNS deployment of modern web services. Proceedings of the 2015 IEEE 23rd International Conference on Network Protocols (ICNP), IEEE, San Francisco, CA, USA.10.1109/ICNP.2015.37 ↗
22. Akiwate, G., Savage, S., Voelker, G.M., and Claffy, K.C. (2021, January 2–4). Risky BIZness: Risks Derived from Registrar Name Management. Proceedings of the 21st ACM Internet Measurement Conference, Virtual Event.10.1145/3487552.3487816 ↗
23. Arkko, J. (2019). Centralised Architectures in Internet Infrastructure. IETF Internet Draft, Available online: https://datatracker.ietf.org/doc/html/draft-arkko-arch-infrastructure-centralisation-00.
24. (2022, May 11). DNS Resolver Centrality. Available online: https://labs.apnic.net/presentations/store/2021-09-10-hknog-resolver-centrality.pdf.
25. (2022, May 11). Internet Centrality. Available online: https://labs.apnic.net/presentations/store/2021-07-19-centrality.pdf.
26. (2022, May 11). Opinion: CDNs and Centrality. Available online: https://blog.apnic.net/2021/07/02/opinion-cdns-and-centrality/.
27. Shue, C.A., Kalafut, A.J., and Gupta, M. (2007, January 24–26). The web is smaller than it seems. Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement, San Diego, CA, USA.10.1145/1298306.1298324 ↗
28. Zembruzki, L., Jacobs, A.S., Landtreter, G.S., Granville, L.Z., and Moura, G.C. (2020, January 15–17). Measuring Centralization of DNS Infrastructure in the Wild. Proceedings of the International Conference on Advanced Information Networking and Applications, Caserta, Italy.10.1007/978-3-030-44041-1_76 ↗
29. Dell’Amico, M., Bilge, L., Kayyoor, A., Efstathopoulos, P., and Vervier, P.A. (2017, January 4–8). Lean on me: Mining internet service dependencies from large-scale dns data. Proceedings of the 33rd Annual Computer Security Applications Conference, Orlando, FL, USA.10.1145/3134600.3134637 ↗
30. Kashaf, A., Sekar, V., and Agarwal, Y. (2020, January 27–29). Analyzing third party service dependencies in modern web services: Have we learned from the mirai-dyn incident?. Proceedings of the ACM Internet Measurement Conference, Virtual Event.10.1145/3419394.3423664 ↗
31. (2022, May 11). Public DNS Server List. Available online: https://public-dns.info/.
32. Durumeric, Z., Wustrow, E., and Halderman, J.A. (2013, January 14–16). ZMap: Fast Internet-wide Scanning and Its Security Applications. Proceedings of the 22nd USENIX Security Symposium (USENIX Security 13), Washington, DC, USA.
33. Wan, G., Izhikevich, L., Adrian, D., Yoshioka, K., Holz, R., Rossow, C., and Durumeric, Z. (2020, January 27–29). On the Origin of Scanning: The Impact of Location on Internet-Wide Scans. Proceedings of the IMC ’20: ACM Internet Measurement Conference, Virtual Event.10.1145/3419394.3424214 ↗
34. (2021, December 11). ZDNS. Available online: https://github.com/zmap/zdns.
35. (2021, December 11). Maxmind. Available online: https://www.maxmind.com/en/home.
36. Geographies of global Internet censorship10.1007/s10708-010-9393-3 ↗
37. (2022, May 11). Google Public Dns Resolver Pool. Available online: https://www.gstatic.com/ipranges/publicdns.json.
38. (2021, December 11). Centralized Zone Data Service. Available online: https://czds.icann.org/home.
39. (2021, December 11). The International Incident—Gaining Control of a .int Domain Name with DNS Trickery. Available online: https://thehackerblog.com/the-international-incident-gaining-control-of-a-int-domain-name-with-dns-trickery/index.html.