Who are querying for me? Measuring the dependency and centralization in recursive resolution

Abstract

In the DNS resolution, a recursive resolver receives requests from clients and queries the authoritative name servers to resolve domain names. In real networks, some recursive resolvers work as the ingress resolvers, which receive client requests but rely on egress resolvers to communicate with authoritative name servers. This dependency on egress resolvers introduces two issues. First, the failure of egress resolvers can delay or disrupt the resolution of ingress resolvers. Second, dependency centralization constrains the DNS system to a limited number of resolvers and organizations, exposing the system to higher risks of availability issues and cascading failures. Understanding the dependencies and centralization of recursive resolvers is essential for comprehending the DNS ecosystem.

In this work, we investigate the recursive resolution implemented by open resolvers in IPv4 address space to quantify their dependencies. We propose a set of approaches to identify egress resolvers and third-party providers on which open resolvers depend, and we analyze the degree of dependency centralization from multiple perspectives. Our measurements reveal that open resolvers in the wild exhibit widespread and highly concentrated dependencies. Specifically, more than 1.7 million open resolvers depend on about 147,000 egress resolvers. 90% of open resolvers are influenced by 8.41% of egress resolvers, and 36.82% of open resolvers rely on only one egress resolver to perform resolution. Egress resolvers from third-party providers can influence more than 44.40% of the open resolvers. Our work demonstrates that dependencies in recursive resolution are concentrated on a small number of egress resolvers and third-party providers, significantly reducing DNS redundancy and threatening system availability.