Research on Unexpected DNS Response from Open DNS Resolvers

Abstract

As the backbone of the domain name system (DNS), DNS resolvers are essential to the Internet. Nowadays, the measurement of DNS resolvers, especially open DNS resolvers, has become a research focus. Previous research works show that DNS responses returned from some open DNS resolvers are not expected for clients and the Internet. We call these DNS responses ‘unexpected DNS responses’. Research on unexpected DNS responses is beneficial to the research, usage and management of open DNS resolvers. This paper explores unexpected DNS responses returned from open DNS resolvers in terms of identification and classification to better understand the behaviours of open DNS resolvers. First, an identification method is proposed to identify all kinds of DNS responses from each section of DNS messages. Second, a classification method is proposed to classify unexpected DNS responses by their influences on clients and the Internet. Furthermore, an efficient identification and classification method is proposed to simplify the above process. Among about 9 million responding open DNS resolvers in the experiments on the IPv4 address space, about 40% return unexpected DNS responses. Experimental results show that the proposed methods can identify and classify all kinds of DNS responses returned from open DNS resolvers.