A deep dive into DNS behavior and query failures

Abstract

The Domain Name System (DNS) is fundamental to the operation of the Internet. Providing an up-to-date view of DNS behavior in-the-wild is thus important for various Internet stakeholders. Among the behavioral characteristics, failure is one of the most import aspects, because failures within DNS can have a dramatic impact on the wider Internet, most notably preventing access to any services dependent on domain names (e.g. web, mobile apps). In this paper, we perform a large study into DNS activity, covering 3B queries in total. We first examine DNS behavior from different perspectives including DNS query types, use of recursive resolvers, TTLs and hosting infrastructures, aiming at providing an up-to-date view of DNS. We then focus on DNS query failures. We find that 13.5% of DNS queries fail, and this leads us to explore the root causes. We observe significant differences between IPv4 and IPv6 lookups, biased failure distribution across domains, the great impact of recursive resolvers and malicious domains on query failures. We also discuss the implications of our findings and provide a handful of recommendations.