ICANN flags ISPs sending duplicate DNS queries to several resolvers
in plain words
The internet turns website names into addresses using DNS servers. ICANN, which manages domain names worldwide, found some internet providers ask three different DNS servers for the same answer. ICANN says this is unusual and is still looking into why it happens.
Full summary
ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN's office of the Chief Technology Officer presented the findings on Monday at the organization's annual conference in Bali, Indonesia. The session shared recent data from the Identifier Technology Health Indicators program, which monitors the security, stability and resilience of the domain name A readable internet name made of labels separated by dots. Full definition of domain name system.
The session first looked back at an earlier problem. ICANN principal technologist Maud Durand described a flaw in Chrome, which she called “Chromiods”, that led the browser to generate about half of all DNS Domain Name System The internet's directory that links domain names to computer addresses. Full definition of DNS root server A server that answers for the DNS root zone and points to TLD servers. Full definition of root server traffic in 2020. ICANN and other stakeholders asked Google to fix it, and Durand said Google did so gradually. ICANN's measurements show Chrome's share of DNS root server traffic falling from 45 percent to one percent today.
ICANN has now found a different source of unusual DNS traffic. Some ISPs send each DNS query three times, to Google, to Cloudflare and to another resolver The DNS server that looks up domain names on behalf of users. Full definition of resolver. Durand called this a “belt and suspenders” approach, noting that a single resolver usually keeps services running. Specifying primary and secondary resolvers is good practice, but DNS resolvers are already very resilient, so repeated requests are unusual.
The ISPs send requests over IPv4 and IPv6. For queries that are not cached, about half are repeated within 100 milliseconds, and a further 30 percent are repeated within thirty seconds. Durand said it is hard to know whether this is a bug or a deliberate behaviour, and she offered a personal theory that these providers lack skilled engineers and built a brute-force form of resilience. ICANN is researching the cause.
ICANN regards these ISPs as minor players, but it is concerned that the practice could cause harm if it spreads or is adopted by a large entity. Durand also linked the issue to concentration in DNS services. ICANN estimates that half of internet users could see almost 250 resolver farms in 2020, a figure that is now just under 150. Durand suspects the number of resolver operators is shrinking and that the remaining visible resolvers belong to large tech companies, though she is not sure why.