| Next revision | Previous revision |
| provenance:design:dns [2026/08/27 22:46] – New provenance page for design:dns: population rule, fold with residue and the Rapid7 guard, all hand-read verdicts, 29 quote needles, every external check with its output, rejected probes, judgement calls. Review log to follow. Authored by Claude. karel.kubicek.claude | provenance:design:dns [2026/08/27 23:21] (current) – Add review pass 5 (generic). Purge the retracted pre-fix run, which had survived in four places in this log after being fixed on the page — the section now states no verdict counts of its own and records instead what three runs showed: identical 46 and no karel.kubicek.claude |
|---|
| | Content page | [[design:dns]], created 2026-08-27 | | | Content page | [[design:dns]], created 2026-08-27 | |
| | Report script | ''scripts/report_dns.mjs'' | | | Report script | ''scripts/report_dns.mjs'' | |
| | Fold | ''scripts/dns_fold.mjs'' (84 self-tests) | | | Fold | ''scripts/dns_fold.mjs'' (85 self-tests) | |
| | Figure/quote check | ''scripts/verify_dns_figures.mjs'' | | | Figure/quote check | ''scripts/verify_dns_figures.mjs'' | |
| | External checks | ''scripts/external_checks_dns.sh'' + ''scripts/dnschk/*.py'' | | | External checks | ''scripts/external_checks_dns.sh'' + ''scripts/dnschk/*.py'' | |
| === design:dns — every figure with its denominator === | === design:dns — every figure with its denominator === |
| corpus 5859 papers, 7 venues, 2010–2026. Contracts: OK. | corpus 5859 papers, 7 venues, 2010–2026. Contracts: OK. |
| dns_fold self-tests: 84/84 pass. | dns_fold self-tests: 85/85 pass. |
| |
| --- A. POPULATION --- | --- A. POPULATION --- |
| |
| [query-tool] union 60 papers corpus-wide, 60 of them in DNSPOP — IN population | [query-tool] union 60 papers corpus-wide, 60 of them in DNSPOP — IN population |
| 18 papers 6 spellings dig / drill / nslookup / host | 18 papers 6 spellings dig / drill / nslookup / tor-resolve |
| 15 papers 12 spellings DNS libraries (dnspython, ldns, miekg/dns, getdns) | 16 papers 13 spellings DNS libraries (dnspython, ldns, miekg/dns, getdns) |
| 13 papers 2 spellings ZDNS | 13 papers 2 spellings ZDNS |
| 7 papers 1 spellings DNS fingerprinting (fpdns) | 7 papers 1 spellings DNS fingerprinting (fpdns) |
| 1 papers 1 spellings Open Resolver Project | 1 papers 1 spellings Open Resolver Project |
| |
| [custom] union 35 papers corpus-wide, 35 of them in DNSPOP — IN population | [custom] union 34 papers corpus-wide, 34 of them in DNSPOP — IN population |
| 35 papers 35 spellings home-grown DNS code | 34 papers 34 spellings home-grown DNS code |
| |
| [scanner-generic] union 156 papers corpus-wide, 38 of them in DNSPOP — reported only, NOT in the population rule | [scanner-generic] union 156 papers corpus-wide, 38 of them in DNSPOP — reported only, NOT in the population rule |
| |
| [vantage-platform] union 77 papers corpus-wide, 24 of them in DNSPOP — reported only, NOT in the population rule | [vantage-platform] union 77 papers corpus-wide, 24 of them in DNSPOP — reported only, NOT in the population rule |
| 77 papers 7 spellings RIPE Atlas | 75 papers 6 spellings RIPE Atlas |
| | 2 papers 1 spellings MobileAtlas |
| | |
| | --- E2. FAMILY DETAIL FOR THE FAMILIES THE PAGE DESCRIBES IN PROSE --- |
| | |
| | DNS fingerprinting (fpdns): 7 papers |
| | by year: 2018:1 2023:3 2024:3 |
| | by spelling: fpdns x7 |
| | in DNSPOP: 7, of which IMC: 0 |
| | |
| | DNSViz and DNSSEC validators: 3 papers |
| | by year: 2014:1 2023:1 2025:1 |
| | by spelling: DNSViz x2 | Extended DNSSEC Validator x1 | DNSSEC-downgrade tool x1 |
| | in DNSPOP: 3, of which IMC: 1 |
| | |
| | dig / drill / nslookup / tor-resolve: 18 papers |
| | by year: 2010:2 2015:2 2019:4 2020:2 2021:4 2023:1 2024:1 2025:2 |
| | by spelling: dig x12 | nslookup x2 | Dig x1 | host name matching tool x1 | drill x1 | tor-resolve x1 |
| | in DNSPOP: 18, of which IMC: 7 |
| | |
| | RIPE Atlas: 75 papers |
| | by year: 2015:4 2016:6 2017:7 2018:10 2019:5 2020:10 2021:5 2022:7 2023:5 2024:5 2025:6 2026:5 |
| | by spelling: RIPE Atlas x72 | RIPE Atlas API x2 | RIPE Atlas REST API x1 | RIPE Atlas streaming API x1 | RIPE Atlas measurement platform x1 | RIPE Atlas probes x1 |
| | in DNSPOP: 24, of which IMC: 21 |
| | |
| | MobileAtlas: 2 papers |
| | by year: 2023:1 2025:1 |
| | by spelling: MobileAtlas x2 |
| | in DNSPOP: 0, of which IMC: 0 |
| |
| Sum of family paper counts is NOT the union: a paper naming BIND and Unbound is in both rows. | Sum of family paper counts is NOT the union: a paper naming BIND and Unbound is in both rows. |
| 113 adjacent:registry-metadata — WHOIS / RDAP | 113 adjacent:registry-metadata — WHOIS / RDAP |
| 112 scanner-generic — ZMap / XMap | 112 scanner-generic — ZMap / XMap |
| 77 vantage-platform — RIPE Atlas | 75 vantage-platform — RIPE Atlas |
| 52 adjacent:registry-metadata — Public Suffix List / TLD lists | 52 adjacent:registry-metadata — Public Suffix List / TLD lists |
| 50 offtopic:speech — speech recognition / synthesis | 50 offtopic:speech — speech recognition / synthesis |
| 2 adjacent:categorisation — OpenDNS/Umbrella as a categoriser | 2 adjacent:categorisation — OpenDNS/Umbrella as a categoriser |
| 2 offtopic:blocklist — NextDNS blocklist | 2 offtopic:blocklist — NextDNS blocklist |
| | 2 vantage-platform — MobileAtlas |
| 1 offtopic:misc — Graphviz DOT | 1 offtopic:misc — Graphviz DOT |
| 1 adjacent:geolocation — RIPE IPmap | 1 adjacent:geolocation — RIPE IPmap |
| ECS (EDNS Client Subnet) 1/510 3/768 11/1437 3/1955 2/1185 20 | ECS (EDNS Client Subnet) 1/510 3/768 11/1437 3/1955 2/1185 20 |
| DNSCurve / DNSCrypt 0/510 1/768 8/1437 2/1955 1/1185 12 | DNSCurve / DNSCrypt 0/510 1/768 8/1437 2/1955 1/1185 12 |
| | DoC (DNS over CoAP) 0/510 0/768 0/1437 0/1955 0/1185 0 |
| | (bare CoAP, for contrast) 0/510 2/768 4/1437 7/1955 7/1185 20 |
| |
| Same sweeps restricted to DNSPOP (the papers that are actually about DNS): | Same sweeps restricted to DNSPOP (the papers that are actually about DNS): |
| ECS (EDNS Client Subnet) 1/16 2/39 9/76 3/74 1/39 16 | ECS (EDNS Client Subnet) 1/16 2/39 9/76 3/74 1/39 16 |
| DNSCurve / DNSCrypt 0/16 1/39 8/76 1/74 1/39 11 | DNSCurve / DNSCrypt 0/16 1/39 8/76 1/74 1/39 11 |
| | DoC (DNS over CoAP) 0/16 0/39 0/76 0/74 0/39 0 |
| | (bare CoAP, for contrast) 0/16 0/39 0/76 1/74 0/39 1 |
| |
| --- H. WHAT A DNS PAPER SAYS ABOUT ITS OWN METHOD --- | --- H. WHAT A DNS PAPER SAYS ABOUT ITS OWN METHOD --- |
| ethics.notifiedAffectedParties 147 / 241 61.0% | ethics.notifiedAffectedParties 147 / 241 61.0% |
| ethics.regulatorContact 132 / 241 54.8% | ethics.regulatorContact 132 / 241 54.8% |
| | |
| | ethics, DNS population vs the whole empirical corpus: |
| | ethics.reviewOutcome DNS 72/241 29.9% corpus 1728/5118 33.8% |
| | ethics.harmMitigation DNS 186/241 77.2% corpus 3186/5118 62.3% |
| | ethics.notifiedAffectedParties DNS 147/241 61.0% corpus 2354/5118 46.0% |
| | ethics.regulatorContact DNS 132/241 54.8% corpus 2129/5118 41.6% |
| | |
| | ethics.robotsTxt over the crawled population: 53 / 1120 = 4.7% |
| | |
| | amplification/reflection full-text probe over DNSPOP: 58 / 244 |
| | of which say so in the title or slug: 15 |
| | open-resolver full-text probe over DNSPOP: 54 / 244 |
| | |
| | --- H2. LLM PROBE OVER DNSPOP (case-sensitive; a hit is not a method) --- |
| | regex: /\b(?:LLM|large language model|GPT-[345]|ChatGPT|Llama|Gemini|Claude)\b/ |
| | papers: 16 / 244 |
| | by window: 2010–2013 0 2014–2017 0 2018–2021 3 2022–2024 5 2025–2026* 8 |
| | case-INsensitive, for contrast: 19 papers, by window 0/0/3/7/9 |
| | The four roles below are HAND-READ verdicts over all of the case-sensitive hits, |
| | not a further probe. They are listed with their deciding text on the provenance page. |
| | 2020/NDSS/flowprint-semi-supervised-mobile-app-fingerprinting-on-encrypted-network-traffic |
| | 2021/IMC/the-far-side-of-dns-amplification-tracing-the-ddos-attack-ecosystem-from-the-int |
| | 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion |
| | 2022/IMC/investigating-the-impact-of-ddos-attacks-on-dns-infrastructure |
| | 2023/PETS/heads-in-the-clouds-measuring-universities-migration-to-public-clouds-implicatio |
| | 2024/CCS/poster-dohunter-a-feature-fusion-based-llm-for-doh-tunnel-detection |
| | 2024/USENIX/guardians-of-the-galaxy-content-moderation-in-the-interplanetary-file-system |
| | 2024/IEEE-SP/practical-attacks-against-dns-reputation-systems |
| | 2025/USENIX/dns-flare-a-flush-reload-attack-on-dns-forwarders |
| | 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u |
| | 2025/IMC/fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by |
| | 2026/NDSS/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles |
| | 2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr |
| | 2026/USENIX/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web |
| | 2026/WWW/unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma |
| | 2026/WWW/starlink-in-the-wild-multi-perspective-measurements-via-dns |
| | |
| | --- G2. RECORD TYPES AND ADDRESS FAMILY (denominator: DNSPOP) --- |
| | AAAA / IPv6 record 65 / 244 26.6% |
| | CNAME record 75 / 244 30.7% |
| | SVCB or HTTPS resource record 8 / 244 3.3% |
| | NS / delegation 97 / 244 39.8% |
| | PTR / reverse 61 / 244 25.0% |
| | TXT record 24 / 244 9.8% |
| | TC bit / truncation / fallback to TCP 22 / 244 9.0% |
| |
| --- I. MEASURED RESULTS IN THE POPULATION (detection[].prevalence) --- | --- I. MEASURED RESULTS IN THE POPULATION (detection[].prevalence) --- |
| - **A candidate sweep loose enough to catch the real instruments catches everything.** It has to match ''hnsd'', ''ldns'', ''resolvectl'', ''miekg/dns'' and ''gdnsd'', and any regex that loose also matches ''DeepSpeech'' (via %%/ech\b/%%), ''ImageBind'' and ''LanguageBind'' (%%/bind\b/%%), ''TransD'' (%%/nsd\b/%%), ''ATLAS.ti'' and ''MongoDB Atlas'' (%%/atlas/%%), every part-of-speech tagger, and ''Ghost.py'' / ''CyberGhost VPN'' (%%/host\b/%%). Those get named ''offtopic:'' families so the discard is a number, not a silence. | - **A candidate sweep loose enough to catch the real instruments catches everything.** It has to match ''hnsd'', ''ldns'', ''resolvectl'', ''miekg/dns'' and ''gdnsd'', and any regex that loose also matches ''DeepSpeech'' (via %%/ech\b/%%), ''ImageBind'' and ''LanguageBind'' (%%/bind\b/%%), ''TransD'' (%%/nsd\b/%%), ''ATLAS.ti'' and ''MongoDB Atlas'' (%%/atlas/%%), every part-of-speech tagger, and ''Ghost.py'' / ''CyberGhost VPN'' (%%/host\b/%%). Those get named ''offtopic:'' families so the discard is a number, not a silence. |
| - **One brand, several products.** ''OpenDNS'' is a public resolver **and** a website categorisation service, and the corpus uses it both ways. ''NextDNS'' is a resolver and a published blocklist. ''DomainTools'' sells passive DNS and a WHOIS archive. Keyed exceptions run first. | - **One brand, several products.** ''OpenDNS'' is a public resolver **and** a website categorisation service, and the corpus uses it both ways. ''NextDNS'' is a resolver and a published blocklist. ''DomainTools'' sells passive DNS and a WHOIS archive. Keyed exceptions run first. |
| - **A name that cannot be resolved from the name.** Rapid7 Open Data is four datasets under one brand (FDNS, RDNS, SSL certificates, TCP/UDP liveness) and half the corpus tuples say only ''Rapid7'' or ''Rapid7 Sonar''. The Rapid7 family therefore carries a **guard** regex tested against name + the extractor's purpose sentence, requiring %%/dns/i%%. All ten Rapid7 tuples were read by hand and the guard decides all ten the way the reading did: | - **A name that cannot be resolved from the name.** Rapid7 Open Data is four datasets under one brand (FDNS, RDNS, SSL certificates, TCP/UDP liveness) and half the corpus tuples say only ''Rapid7'' or ''Rapid7 Sonar''. The Rapid7 family therefore carries a **guard** regex tested against name + the extractor's purpose sentence, requiring %%/dns/i%%. The candidate regex matches **13 tuples under 11 distinct spellings**; all 13 were read by hand and the guard decides all 13 the way the reading did: |
| |
| ^ Tuple ^ Purpose ^ Guard verdict ^ | ^ Tuple ^ Purpose ^ Guard verdict ^ |
| | Rapid7 (CCS 2016) | "Internet-wide HTTPS and reverse-DNS scan datasets" | included | | | Rapid7 (CCS 2016) | "Internet-wide HTTPS and reverse-DNS scan datasets" | included | |
| | Rapid7 (IMC 2022, iGDB) | "Provide reverse-DNS mappings from IP addresses to hostnames" | included | | | Rapid7 (IMC 2022, iGDB) | "Provide reverse-DNS mappings from IP addresses to hostnames" | included | |
| | Rapid7's passive DNS (NDSS 2019, NDSS 2021) | "Identify enterprise cloud-hosting IP addresses" / "Resolve domains and discover organization-controlled domains" | included | | | Rapid7's passive DNS (NDSS 2019 **and** NDSS 2021, two tuples) | "Identify enterprise cloud-hosting IP addresses" / "Resolve domains and discover organization-controlled domains" | included | |
| | Rapid7 Forward DNS (IMC 2020) | "Collect reverse-DNS and zone-file domains for VPN identification" | included | | | Rapid7 Forward DNS (IMC 2020) | "Collect reverse-DNS and zone-file domains for VPN identification" | included | |
| | Rapid7 Sonar FDNS / RDNS (PoPETs 2021) | "Validated historical CNAME detection completeness" / "Checked historical tracker IP ownership" | included | | | Forward DNS dataset (IMC 2016, //Entropy/IP//) | "Collected actively queried DNS addresses" | included | |
| | | Rapid7 Sonar FDNS / RDNS (PoPETs 2021, two tuples) | "Validated historical CNAME detection completeness" / "Checked historical tracker IP ownership" | included | |
| | Rapid7 sonar.udp (CCS 2022) | "Select open DNS resolvers for comparison" | included | | | Rapid7 sonar.udp (CCS 2022) | "Select open DNS resolvers for comparison" | included | |
| | | Rapid7 (IMC 2022, //iGDB//) | "Provide reverse-DNS mappings from IP addresses to hostnames" | included | |
| |
| **One keyed (name, category) exclusion** that no name regex can make: ''DIG'' with ''category == "program-analysis"'' (IEEE S&P 2024, //Everything is Good for Something//) is a likely-invariant inference engine, purpose //"Likely-invariant inference engine"//, not ''dig(1)''. | **One keyed (name, category) exclusion** that no name regex can make: ''DIG'' with ''category == "program-analysis"'' (IEEE S&P 2024, //Everything is Good for Something//) is a likely-invariant inference engine, purpose //"Likely-invariant inference engine"//, not ''dig(1)''. |
| |
| **Six false positives found by reading the instrument-only list and fixed in the fold**, each of which would have added a non-DNS paper to the population: ''Khost'' (a KVM firmware-rehosting tool, matched a ''khost'' alternative that should never have been there), ''XMLdig-to-CSV converter'' (oscilloscope traces), ''DNSCAN'' (a clustering algorithm in a backdoor-forensics paper), ''USB2SOFT USB 2.0 device SIE'' (matched %%/\bsie\b/%% intended for Farsight's Security Information Exchange), ''Rapid7 NeXpose'', and ''DIG''. | **Seven mis-bucketings found by reading the instrument-only list and the folded family listings, and fixed in the fold**, each of which would have added a non-DNS paper to the population: ''Khost'' (a KVM firmware-rehosting tool, matched a ''khost'' alternative that should never have been there), ''XMLdig-to-CSV converter'' (oscilloscope traces), ''DNSCAN'' (a clustering algorithm in a backdoor-forensics paper), ''USB2SOFT USB 2.0 device SIE'' (matched %%/\bsie\b/%% intended for Farsight's Security Information Exchange), ''Rapid7 NeXpose'', and ''DIG''. A seventh, ''"Miek Gieben's DNS implementation"'', was landing in the home-grown family via a generic %%/dns.*implementation/%% alternative when it is in fact ''miekg/dns'', the Go library; that moved home-grown from 35 papers to **34** and DNS libraries from 15 to **16**, and it is why the page's home-grown claim is worded as "almost no two called it the same thing" rather than as a clean 35/35. |
| |
| ==== Fold residue, in full ==== | ==== Fold residue, in full ==== |
| ===== Quotes and per-paper figures ===== | ===== Quotes and per-paper figures ===== |
| |
| ''scripts/verify_dns_figures.mjs'' checks every literal per-paper figure and every quoted sentence against ''paper.cols.txt'' with whitespace collapsed, smart quotes folded and dashes normalised. **29 needles, 0 not found.** Unedited output: | ''scripts/verify_dns_figures.mjs'' checks every literal per-paper figure and every quoted sentence against ''paper.cols.txt'' with whitespace collapsed, smart quotes folded and dashes normalised. **31 needles, 0 not found** (30 located in ''paper.cols.txt'', 1 in ''paper.pdf'' only — see the box below). Unedited output: |
| |
| <code> | <code> |
| ok 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the | ok [.cols] 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the |
| 259 of the 3,047 ASes (8.5%) that we inspect exhibit DNS interception behavior | 259 of the 3,047 ASes (8.5%) that we inspect exhibit DNS interception behavior |
| ok 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the | ok [.cols] 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the |
| 148,478 residential and cellular IP addresses | 148,478 residential and cellular IP addresses |
| ok 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement | ok [.cols] 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement |
| that 37% of IPs across 56% ASes measured show some change in censorship behavior depending on source port and local source IP | that 37% of IPs across 56% ASes measured show some change in censorship behavior depending on source port and local source IP |
| ok 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement | ok [.cols] 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement |
| This behavior is frequently all-or-nothing | This behavior is frequently all-or-nothing |
| ok 2017/USENIX/global-measurement-of-dns-manipulation | ok [.cols] 2017/USENIX/global-measurement-of-dns-manipulation |
| 41,778 responses (0.31%) as manipulated, spread across 58 countries | 41,778 responses (0.31%) as manipulated, spread across 58 countries |
| ok 2017/USENIX/global-measurement-of-dns-manipulation | ok [.cols] 2017/USENIX/global-measurement-of-dns-manipulation |
| 1,408 domains | 1,408 domains |
| ok 2017/USENIX/global-measurement-of-dns-manipulation | ok [.cols] 2017/USENIX/global-measurement-of-dns-manipulation |
| 13,594,683 DNS responses | 13,594,683 DNS responses |
| ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates | ok [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates |
| 17 TLS proxy vendors in 52 countries | 17 TLS proxy vendors in 52 countries |
| ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates | ok [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates |
| 55 ASes in 26 countries with ISP-level DNS manipulation | 55 ASes in 26 countries with ISP-level DNS manipulation |
| ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates | ok [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates |
| previous work using consistency-based heuristics is inaccurate, allowing for 72.45% false positives in the cases detected as DNS manipulation | previous work using consistency-based heuristics is inaccurate, allowing for 72.45% false positives in the cases detected as DNS manipulation |
| ok 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement | ok [.cols] 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement |
| 90K lookups per second when using an external recursive resolver | 90K lookups per second when using an external recursive resolver |
| ok 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement | ok [.cols] 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement |
| solves 50M domains in 10 minutes | solves 50M domains in 10 minutes |
| ok 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion | ok [.cols] 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion |
| we detected a total of 10,474 websites (eTLD+1) that used at least one of the trackers | we detected a total of 10,474 websites (eTLD+1) that used at least one of the trackers |
| ok 2010/IMC/comparing-dns-resolvers-in-the-wild | ok [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild |
| fer in terms of subnets for approximately 2, 000 out of our | fer in terms of subnets for approximately 2, 000 out of our |
| ok 2010/IMC/comparing-dns-resolvers-in-the-wild | ok [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild |
| 10, 000 host names. In half of these cases, the returned IP | 10, 000 host names. In half of these cases, the returned IP |
| ok 2010/IMC/comparing-dns-resolvers-in-the-wild | ok [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild |
| addresses even belong to di | addresses even belong to di |
| ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers | ok [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers |
| 3382 out of 4147 resolvers in the CDN dataset send 100% of their A and AAAA queries with an ECS option | 3382 out of 4147 resolvers in the CDN dataset send 100% of their A and AAAA queries with an ECS option |
| ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers | ok [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers |
| 103 recursive resolvers, or over half of all recursive resolvers we could study | 103 recursive resolvers, or over half of all recursive resolvers we could study |
| ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers | ok [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers |
| don't control caching based on scope at all | don't control caching based on scope at all |
| ok 2015/IMC/going-wild-large-scale-classification-of-open-dns-resolvers | ok [.cols] 2015/IMC/going-wild-large-scale-classification-of-open-dns-resolvers |
| find up to 20 million open resolvers in the weekly IPv4 scans | find up to 20 million open resolvers in the weekly IPv4 scans |
| ok 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli | ok [.cols] 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli |
| In over 99 % of observed cases | In over 99 % of observed cases |
| ok 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli | ok [.cols] 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli |
| DDR-compliant clients may fail to upgrade to DoE due to | DDR-compliant clients may fail to upgrade to DoE due to |
| ok 2021/IMC/home-is-where-the-hijacking-is-understanding-dns-interception-by-residential-rou | ok [.cols] 2021/IMC/home-is-where-the-hijacking-is-understanding-dns-interception-by-residential-rou |
| occurrences of such trans- 3 parent interception | occurrences of such trans- 3 parent interception |
| ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective | ok [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective |
| domains with high accuracy in closed and open world settings, using 124 times less data than attacks on HTTPS flows | domains with high accuracy in closed and open world settings, using 124 times less data than attacks on HTTPS flows |
| ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective | ok [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective |
| We can identify resolvers | We can identify resolvers |
| ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective | ok [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective |
| with 95% accuracy | with 95% accuracy |
| WEAK NEEDLE 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective: "with 95% accuracy" — short enough to match by accident | WEAK NEEDLE 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective: "with 95% accuracy" — short enough to match by accident |
| ok 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers | ok [PDF only] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers |
| 59.9% | 73% of all participants reported having heard of DNS before the survey |
| ok 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers | ok [.cols] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers |
| 79.4% | ipants who reported having heard of DNS, only 59.9% had |
| ok 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u | ok [.cols] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers |
| | 85 (79.4%) had the default |
| | ok [.cols] 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u |
| naive LLM-based prompt engineering | naive LLM-based prompt engineering |
| ok 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u | ok [.cols] 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u |
| concrete, verifiably correct fixes | concrete, verifiably correct fixes |
| |
| 30 needles checked, 0 not found, 0 papers unreadable. | 31 needles checked, 0 not found, 0 papers unreadable. |
| |
| --- QUOTES THE PAGE NORMALISES (source spelling -> page spelling) --- | --- QUOTES THE PAGE NORMALISES (source spelling -> page spelling) --- |
| |
| --- FIGURES ON THE PAGE THAT ARE NOT FROM A CITED PAPER --- | --- FIGURES ON THE PAGE THAT ARE NOT FROM A CITED PAPER --- |
| 5,859 / 1,120 / 1,622 / 930 / 5,118 | population, venue, year, study-shape and web-slice counts |
| <- corpus contracts; report_dns.mjs section A asserts them | <- report_dns.mjs sections A-D |
| 108 / 202 / 66 / 244 / 136 / 14 / 82 / 1,218 / 5,855 | composite venue shares stated in prose |
| <- report_dns.mjs section A | <- report_dns.mjs section B |
| venue and year tables | instrument family counts, spelling counts, per-family year detail |
| <- report_dns.mjs sections B and C | <- report_dns.mjs sections E and E2 |
| 186 / 40 / 76.2% / 16.4% / 33.6% / 5.1% | fold residue, candidate-tuple count, fold self-test count |
| <- report_dns.mjs sections A and D | <- report_dns.mjs section F and `node scripts/dns_fold.mjs` |
| instrument family counts (65/62/60/35/29/3/1/156/77/38/24) | |
| <- report_dns.mjs section E | |
| tool spelling counts and the 35/35 home-grown figure | |
| <- report_dns.mjs section E | |
| 976 candidate tuples, 2 unmapped, 84 self-tests | |
| <- report_dns.mjs section F, dns_fold.mjs | |
| encrypted-DNS per-window probe counts | encrypted-DNS per-window probe counts |
| <- report_dns.mjs section G | <- report_dns.mjs section G |
| 124/103/124, 50.8%/42.2%/50.8%, 120/46/40/35/3, 49.2% | reporting-gap, vantage-bucket, ethics and amplification figures |
| <- report_dns.mjs section H | <- report_dns.mjs section H |
| ethics 186/147/132/72 of 241 | LLM probe counts, case-sensitive and case-insensitive |
| <- report_dns.mjs section H | <- report_dns.mjs section H2 |
| 16 LLM papers, 0/0/3/5/8 | the 7 lab-rig papers |
| <- report_dns.mjs probe rerun; the four roles are hand-read | <- the LAB_RIG hand map in report_dns.mjs, which the report cross-checks |
| 4.7% robots.txt of 1,120 | robots.txt reporting rate for the crawled population |
| <- data/extract/OVERVIEW.md, "Where the field goes quiet" | <- data/extract/OVERVIEW.md, "Where the field goes quiet" |
| 7 lab-rig papers | every resolver-run figure: verdict tallies, both summary denominators, TTLs |
| <- LAB_RIG hand map in report_dns.mjs | <- out/dns/resolver_run.txt and resolver_run.json, from pages/resolver_disagreement.py |
| 28 / 75 / 25 / 100 / 46 / 1 / 37.3% / 61.3% / 1.3% | the Tranco list id |
| <- pages/resolver_disagreement.py run, out/dns/resolver_run.txt | <- tranco-list.eu, fetched 2026-08-27; recorded in the provenance page |
| Tranco list id 46W9X | RFC numbers, dates, statuses and obsoleted-by |
| <- tranco-list.eu, fetched 2026-08-27 | <- external_checks_dns.sh, RFC block |
| RFC numbers, dates, statuses, RFC 8499 obsoleted by 9499 | tool versions, release and push dates, archived state, git tags |
| <- rfc-editor.org JSON index via external_checks_dns.sh | <- external_checks_dns.sh, GitHub/PyPI/Go-proxy blocks |
| ZDNS v2.1.1 2026-05-28; zmap push 2026-08-24; massdns v1.1.0 2024-03-09 push 2026-04-15 | vendor state: Farsight resolution, dnsdb.info and Rapid7 redirect targets, dataset dates |
| <- GitHub API via external_checks_dns.sh | <- external_checks_dns.sh, Farsight and Rapid7 blocks |
| dnspython 2.8.0 2025-09-07; DNSViz v0.11.1 2025-04-21; dnscrypt-proxy 2.1.18 2026-07-18; miekg/dns push 2026-08-19 | Firefox trr prefs and the DoH provider records |
| <- GitHub API and PyPI via external_checks_dns.sh | <- external_checks_dns.sh, Firefox blocks |
| farsightsecurity.com does not resolve; dnsdb.info 104.244.14.71 -> domaintools.com/platform | the APNIC DDR figures and the ANRW Crossref record |
| <- external_checks_dns.sh | <- external_checks_dns.sh, APNIC and ANRW blocks |
| Rapid7 sonar.fdns_v2 2026-08-23, sonar.rdns_v2 2026-08-26 | |
| <- opendata.rapid7.com parsed by external_checks_dns.sh | This block names artefacts, not values. Run the named artefact for the number. |
| network.trr.mode value 0; 5 DoH provider records; Cloudflare autoDefault | |
| <- StaticPrefList.yaml and Mozilla Remote Settings via external_checks_dns.sh | |
| </code> | </code> |
| |
| | "95% resolver accuracy and 100% client accuracy" | "We built classifiers to distinguish resolver and client based on the TLS record length. We can identify resolvers with 95% accuracy, and we get no errors (100% accuracy) when identif[ying]…" — the 100% is the **client**, not the resolver; the page no longer pairs them | | | "95% resolver accuracy and 100% client accuracy" | "We built classifiers to distinguish resolver and client based on the TLS record length. We can identify resolvers with 95% accuracy, and we get no errors (100% accuracy) when identif[ying]…" — the 100% is the **client**, not the resolver; the page no longer pairs them | |
| | "DNS manipulation … 17 TLS proxy vendors in 52 countries and ISP-level manipulation in 26 countries" | two separate sentences: "CERTainty identifies 17 TLS proxy vendors in 52 countries" and "CERTainty also detects 55 ASes in 26 countries with ISP-level DNS manipulation" | | | "DNS manipulation … 17 TLS proxy vendors in 52 countries and ISP-level manipulation in 26 countries" | two separate sentences: "CERTainty identifies 17 TLS proxy vendors in 52 countries" and "CERTainty also detects 55 ASes in 26 countries with ISP-level DNS manipulation" | |
| | | "73% reported having heard of DNS" (Nisenoff et al., USENIX Security 2023) | **In the PDF, absent from ''paper.cols.txt''.** See the note below — this one is a checker bug, not a source problem, and it was caught by a reviewer. | |
| |
| The fourth is the one to remember: the extraction had fused two findings into one sentence, and quoting it would have invented a claim the paper does not make. | The fourth is the one to remember: the extraction had fused two findings into one sentence, and quoting it would have invented a claim the paper does not make. |
| | |
| | <WRAP important> |
| | **''paper.cols.txt'' can be missing content the PDF has, and checking only ''.cols'' scores a faithful quote as a fabrication.** Nisenoff et al.'s //"73% of all participants reported having heard of DNS before the survey"// is verbatim in ''paper.pdf'' and is **not in ''paper.cols.txt'' at all**; the only "73" near "heard of DNS" in the ''.cols'' rendering is the string "Firefox 73", a browser version number in a settings table. Working only from ''.cols'', this run concluded the figure was unverifiable and **removed it from the page**. The citations reviewer said it was in the paper; a ''pypdf'' re-extraction settled it in the reviewer's favour, the figure is back on the page as a verbatim quote, and ''verify_dns_figures.mjs'' now **falls back to ''pypdf'' for any needle that misses against ''.cols''** and labels the route it was found by. One of the 31 needles is ''PDF only''. Without that fallback the whole quote check was one rendering away from a false negative on every quote it examined. |
| | </WRAP> |
| |
| **One figure was dropped, not rewritten.** The extraction reports "49 out of 220 intercepted probes" for Randall et al. (IMC 2021). Neither number could be located in ''paper.cols.txt'' by any probe tried. The page quotes the paper's own abstract claim ("over 200 occurrences of such transparent interception") instead and makes no 49/220 claim. | **One figure was dropped, not rewritten.** The extraction reports "49 out of 220 intercepted probes" for Randall et al. (IMC 2021). Neither number could be located in ''paper.cols.txt'' by any probe tried. The page quotes the paper's own abstract claim ("over 200 occurrences of such transparent interception") instead and makes no 49/220 claim. |
| |
| == run date (UTC) | == run date (UTC) |
| 2026-08-27T22:24:29Z | 2026-08-27T23:18:41Z |
| |
| == RFCs the page names: status, obsoleted-by, updated-by | == RFCs the page names: status, obsoleted-by, updated-by |
| RFC7858 May 2016 PROPOSED STANDARD obs_by=- upd_by=RFC8310 Specification for DNS over Transport Layer Security (TLS | RFC7858 May 2016 PROPOSED STANDARD obs_by=- upd_by=RFC8310 Specification for DNS over Transport Layer Security (TLS |
| RFC7871 May 2016 INFORMATIONAL obs_by=- upd_by=- Client Subnet in DNS Queries | RFC7871 May 2016 INFORMATIONAL obs_by=- upd_by=- Client Subnet in DNS Queries |
| | RFC8310 March 2018 PROPOSED STANDARD obs_by=- upd_by=- Usage Profiles for DNS over TLS and DNS over DTLS |
| RFC8484 October 2018 PROPOSED STANDARD obs_by=- upd_by=- DNS Queries over HTTPS (DoH) | RFC8484 October 2018 PROPOSED STANDARD obs_by=- upd_by=- DNS Queries over HTTPS (DoH) |
| RFC8499 January 2019 BEST CURRENT PRACTICE obs_by=RFC9499 upd_by=- DNS Terminology | RFC8499 January 2019 BEST CURRENT PRACTICE obs_by=RFC9499 upd_by=- DNS Terminology |
| RFC9250 May 2022 PROPOSED STANDARD obs_by=- upd_by=- DNS over Dedicated QUIC Connections | RFC9250 May 2022 PROPOSED STANDARD obs_by=- upd_by=- DNS over Dedicated QUIC Connections |
| RFC9276 August 2022 BEST CURRENT PRACTICE obs_by=- upd_by=- Guidance for NSEC3 Parameter Settings | RFC9276 August 2022 BEST CURRENT PRACTICE obs_by=- upd_by=- Guidance for NSEC3 Parameter Settings |
| | RFC9460 November 2023 PROPOSED STANDARD obs_by=- upd_by=- Service Binding and Parameter Specification via the DNS |
| RFC9462 November 2023 PROPOSED STANDARD obs_by=- upd_by=- Discovery of Designated Resolvers | RFC9462 November 2023 PROPOSED STANDARD obs_by=- upd_by=- Discovery of Designated Resolvers |
| RFC9463 November 2023 PROPOSED STANDARD obs_by=- upd_by=- DHCP and Router Advertisement Options for the Discovery | RFC9463 November 2023 PROPOSED STANDARD obs_by=- upd_by=- DHCP and Router Advertisement Options for the Discovery |
| RFC9499 March 2024 BEST CURRENT PRACTICE obs_by=- upd_by=- DNS Terminology | RFC9499 March 2024 BEST CURRENT PRACTICE obs_by=- upd_by=- DNS Terminology |
| | RFC9520 December 2023 PROPOSED STANDARD obs_by=- upd_by=- Negative Caching of DNS Resolution Failures |
| RFC9539 February 2024 EXPERIMENTAL obs_by=- upd_by=- Unilateral Opportunistic Deployment of Encrypted Recursi | RFC9539 February 2024 EXPERIMENTAL obs_by=- upd_by=- Unilateral Opportunistic Deployment of Encrypted Recursi |
| | RFC9567 April 2024 PROPOSED STANDARD obs_by=- upd_by=- DNS Error Reporting |
| | RFC9606 June 2024 PROPOSED STANDARD obs_by=- upd_by=- DNS Resolver Information |
| | RFC9848 March 2026 PROPOSED STANDARD obs_by=- upd_by=- Bootstrapping TLS Encrypted ClientHello with DNS Service |
| | RFC9953 March 2026 PROPOSED STANDARD obs_by=- upd_by=- DNS over CoAP (DoC) |
| |
| == GitHub repositories: archived state, last push, latest release | == GitHub repositories: archived state, last push, latest release |
| PowerDNS/pdns archived=False pushed=2026-08-27 stars=4456 | PowerDNS/pdns archived=False pushed=2026-08-27 stars=4456 |
| no GitHub release object: Not Found | no GitHub release object: Not Found |
| CZ-NIC/knot-resolver archived=False pushed=2026-08-27 stars=460 | CZ-NIC/knot-resolver archived=False pushed=2026-08-27 stars=461 |
| no GitHub release object: Not Found | no GitHub release object: Not Found |
| imp/dnsmasq archived=False pushed=2026-03-16 stars=389 | imp/dnsmasq archived=False pushed=2026-03-16 stars=389 |
| DNS-OARC/dnsperf archived=True pushed=2026-02-04 stars=478 | DNS-OARC/dnsperf archived=True pushed=2026-02-04 stars=478 |
| latest release v2.14.0 on 2024-01-18 | latest release v2.14.0 on 2024-01-18 |
| | DNSCrypt/dnscrypt-proxy archived=False pushed=2026-08-27 stars=13605 |
| | latest release 2.1.18 on 2026-07-18 |
| | |
| | == miekg/dns has no GitHub Release object but DOES have semver tags |
| | git tags: ['v1.1.73', 'v1.1.72', 'v1.1.70', 'v1.1.69', 'v1.1.68'] |
| | go module proxy @latest: {"Version":"v1.1.73","Time":"2026-08-19T05:07:32Z","Origin":{"VCS":"git","URL":"https://github.com/miekg/dns","Hash":"d854399da1ee385b432e8b07f79e53bbfc1ab1b0","Ref":"refs/tags/v1.1.73"}} |
| | |
| | == Android Private DNS transport: Google's own announcement |
| | e devices. DNS-over-HTTP/3 (DoH3) support was released as part of a Google Play system update , so by the time you’re reading this, Android devices from Android 11 onwards 1 will use DoH3 instead of DoT for well-known 2 DNS servers which support it. Which DNS service you are using is unaffected by this change; only the transport will be upgraded. In th |
| | |
| | == ANRW 2026 DDR paper (not in the seven-venue corpus), doi 10.1145/3822163.3827932 |
| | The Illusion of DDR Deployment |
| | Yevheniya Nosyk; Andrzej Duda; Maciej Korczynski |
| | Proceedings of the 2026 Applied Networking Research Workshop [[2026, 7, 20]] |
| | |
| | == APNIC DDR write-up by the ANRW authors (the figures the page quotes) |
| | ok By Yevheniya Nosyk on 2 Sep 2025 |
| | ok Andrzej Duda and Maciej Korczy |
| | ok 321k DDR-enabled open resolvers |
| | ok 80.8% of DDR-enabled resolvers designating dns.google |
| | ok Cloudflare came second at 12.4% |
| | ok 97.4% of DDR-enabled resolvers |
| |
| == PyPI: dnspython | == PyPI: dnspython |
| 200 https://www.dnsdb.info/ | 200 https://www.dnsdb.info/ |
| |
| == Rapid7 Open Data: are the FDNS/RDNS studies still published, and when last | == Rapid7 Open Data: where does the cited host redirect to, and is the data current |
| | 200 https://opendata.rapid7.com/ -> https://sonardata.rapid7.com/ |
| | 200 https://opendata.rapid7.com/sonar.fdns_v2/ -> https://sonardata.rapid7.com/sonar.fdns_v2/ |
| | 200 https://opendata.rapid7.com/sonar.rdns_v2/ -> https://sonardata.rapid7.com/sonar.rdns_v2/ |
| /sonar.fdns_v2/ Forward DNS (FDNS) last=08/23/2026 | /sonar.fdns_v2/ Forward DNS (FDNS) last=08/23/2026 |
| /sonar.rdns_v2/ Reverse DNS (RDNS) last=08/26/2026 | /sonar.rdns_v2/ Reverse DNS (RDNS) last=08/26/2026 |
| farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known | farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known |
| www.farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known | www.farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known |
| dnsdb.info A= 104.244.14.71 | dnsdb.info A= 104.244.14.64 |
| 200 https://www.dnsdb.info/ -> https://www.domaintools.com/platform | 200 https://www.dnsdb.info/ -> https://www.domaintools.com/platform |
| 200 https://www.domaintools.com/products/farsight-dnsdb/ -> https://www.domaintools.com/platform | 200 https://www.domaintools.com/products/farsight-dnsdb/ -> https://www.domaintools.com/platform |
| * **Source-address check on the reply.** It accepts a datagram only from the address it queried, and rejects a transaction-ID mismatch. This does not defend against an on-path forger — nothing at this layer does — but it stops a stray answer being recorded as that resolver's. | * **Source-address check on the reply.** It accepts a datagram only from the address it queried, and rejects a transaction-ID mismatch. This does not defend against an on-path forger — nothing at this layer does — but it stops a stray answer being recorded as that resolver's. |
| * **''no-A-record'' is a separate verdict from ''insufficient''.** The first draft merged them and reported "25% insufficient", which hid the actual finding: those 25 names have no A record at the apex, which is a property of the zone and the most common way a list-driven crawl loses rows silently. | * **''no-A-record'' is a separate verdict from ''insufficient''.** The first draft merged them and reported "25% insufficient", which hid the actual finding: those 25 names have no A record at the apex, which is a property of the zone and the most common way a list-driven crawl loses rows silently. |
| * **Two summaries, and the script says which to quote.** Summary A over all names mixes "resolvers disagree" (28/100) with "there was nothing to disagree about" (25/100). Summary B over the 75 comparable names gives 37.3%. Quoting 28% would understate the disagreement by hiding it behind the no-answer rate. | * **Two summaries, and the script says which to quote.** Summary A over all names mixes "resolvers did not all agree" with "there was nothing to disagree about" (25 of 100). Summary B is over the 75 comparable names. Quoting the summary-A share would understate the disagreement by hiding it behind the no-answer rate. The values are in the run output below and are deliberately not restated here: the first version of this bullet restated the **pre-fix** classifier's numbers, and they survived the fix that retracted them. |
| |
| ==== The run behind the page's numbers ==== | ==== The run behind the page's numbers ==== |
| |
| Tranco top 100, list ID ''46W9X'', fetched from ''tranco-list.eu'' on 2026-08-27. Three public resolvers over Do53/UDP from a single European vantage point. Two consecutive runs against the same list gave **identical** verdict counts (46 identical / 1 same-/24 / 28 disjoint / 25 no-A-record), which is reassuring but is not a stability claim — it is two runs, minutes apart, from one place. | Tranco top 100, list ID ''46W9X'', fetched from ''tranco-list.eu'' on 2026-08-27. Three public resolvers over Do53/UDP from a single European vantage point. |
| |
| The %%<code>%% block on the page is generated by ''scripts/build_dns_codeblock.mjs'' from ''out/dns/resolver_run.txt'', with a mechanical abridgement rule (two header lines, the ''google.com'' stanza with address lists cut after two entries, both summary blocks). It is regenerated rather than pasted, because the first draft pasted an **earlier** run's TTLs under a **later** run's timestamp — the exact failure the builder now prevents. | **Three runs, and what moved between them.** The list was run three times over about ninety minutes: twice under the original (buggy) classifier, then again after the pairwise fix, then again after the script gained TC-bit handling. ''identical'' came back **46** in every run and ''no-A-record'' **25** in every run, so ''not identical'' was **29** in every run. The split of those 29 moved — 28 disjoint and 1 same-/24 under the buggy all-at-once intersection, then 21 partial / 8 disjoint, then 19 partial / 10 disjoint — as CDN mappings churned under the measurement. That is why the page quotes **not identical** as its headline and treats the partial-versus-disjoint split as illustrative rather than as a result. It is also why this section states no verdict counts of its own: they belong in the run output below, which is regenerated from the script. |
| | |
| | The %%<code>%% block on the page is generated by ''scripts/build_dns_codeblock.mjs'' from ''out/dns/resolver_run.txt'', with a mechanical abridgement rule (two header lines, the **first ''disjoint'' stanza** with address lists cut after two entries, both summary blocks). It is regenerated rather than pasted, because the first draft pasted an **earlier** run's TTLs under a **later** run's timestamp — the exact failure the builder now prevents. |
| |
| Full run output: | Full run output: |
| <code> | <code> |
| # resolvers: Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) | # resolvers: Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) |
| # names: 100 run at 2026-08-27T22:31:01Z | # names: 100 run at 2026-08-27T23:17:26Z |
| |
| google.com -> disjoint | google.com -> partial |
| Google NOERROR 12.3 ms ttl=209 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 | Google NOERROR 13.1 ms ttl=126 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139 |
| Cloudflare NOERROR 9.8 ms ttl=15 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139 | Cloudflare NOERROR 9.8 ms ttl=287 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139 (2nd query TTL 278: served from cache) |
| Quad9 NOERROR 14.7 ms ttl=135 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139 | Quad9 NOERROR 14.4 ms ttl=278 192.178.183.100, 192.178.183.101, 192.178.183.102, 192.178.183.113, 192.178.183.138, 192.178.183.139 (2nd query TTL 185: served from cache) |
| |
| cloudflare.com -> identical | cloudflare.com -> identical |
| Google NOERROR 11.4 ms ttl=257 104.16.132.229, 104.16.133.229 | Google NOERROR 12.7 ms ttl=300 104.16.132.229, 104.16.133.229 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.8 ms ttl=300 104.16.132.229, 104.16.133.229 (2nd query TTL 137: served from cache) | Cloudflare NOERROR 8.0 ms ttl=37 104.16.132.229, 104.16.133.229 |
| Quad9 NOERROR 14.5 ms ttl=87 104.16.132.229, 104.16.133.229 (2nd query TTL 38: served from cache) | Quad9 NOERROR 16.0 ms ttl=141 104.16.132.229, 104.16.133.229 (2nd query TTL 137: served from cache) |
| |
| gstatic.com -> disjoint | gstatic.com -> partial |
| Google NOERROR 10.3 ms ttl=257 172.217.208.120, 172.217.208.94 (2nd query TTL 257: unchanged) | Google NOERROR 25.0 ms ttl=300 172.217.208.120, 172.217.208.94 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.0 ms ttl=218 74.125.29.120, 74.125.29.94 | Cloudflare NOERROR 9.7 ms ttl=200 172.217.208.120, 172.217.208.94 (2nd query TTL 169: served from cache) |
| Quad9 NOERROR 13.9 ms ttl=54 142.251.13.120, 142.251.13.94 | Quad9 NOERROR 14.5 ms ttl=149 142.251.14.120, 142.251.14.94 (2nd query TTL 141: served from cache) |
| |
| facebook.com -> disjoint | facebook.com -> partial |
| Google NOERROR 13.1 ms ttl=60 157.240.17.35 (2nd query TTL 17: served from cache) | Google NOERROR 13.4 ms ttl=60 157.240.17.35 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 8.7 ms ttl=6 157.240.17.35 | Cloudflare NOERROR 10.2 ms ttl=38 157.240.17.35 (2nd query TTL 23: served from cache) |
| Quad9 NOERROR 14.0 ms ttl=29 157.240.0.35 (2nd query TTL 29: unchanged) | Quad9 NOERROR 14.9 ms ttl=21 157.240.253.35 |
| |
| microsoft.com -> disjoint | microsoft.com -> partial |
| Google NOERROR 9.6 ms ttl=1714 150.171.110.56 | Google NOERROR 13.5 ms ttl=505 150.171.110.56 (2nd query TTL 475: served from cache) |
| Cloudflare NOERROR 9.3 ms ttl=363 150.171.110.56 | Cloudflare NOERROR 10.8 ms ttl=2455 150.171.110.56 (2nd query TTL 1180: served from cache) |
| Quad9 NOERROR 15.4 ms ttl=335 150.171.109.101 (2nd query TTL 305: served from cache) | Quad9 NOERROR 15.7 ms ttl=201 150.171.109.101 |
| |
| googleapis.com -> disjoint | googleapis.com -> disjoint |
| Google NOERROR 10.6 ms ttl=69 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 9: served from cache) | Google NOERROR 39.5 ms ttl=300 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 164: served from cache) |
| Cloudflare NOERROR 9.8 ms ttl=272 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 170: served from cache) | Cloudflare NOERROR 10.1 ms ttl=172 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 |
| Quad9 NOERROR 13.9 ms ttl=265 142.251.13.103, 142.251.13.104, 142.251.13.105, 142.251.13.106, 142.251.13.147, 142.251.13.99 (2nd query TTL 69: served from cache) | Quad9 NOERROR 14.3 ms ttl=165 192.178.183.103, 192.178.183.104, 192.178.183.105, 192.178.183.106, 192.178.183.147, 192.178.183.99 |
| |
| amazonaws.com -> identical | amazonaws.com -> identical |
| Google NOERROR 11.6 ms ttl=884 15.197.250.250, 166.117.149.112 (2nd query TTL 884: unchanged) | Google NOERROR 10.6 ms ttl=802 15.197.250.250, 166.117.149.112 (2nd query TTL 246: served from cache) |
| Cloudflare NOERROR 10.9 ms ttl=791 15.197.250.250, 166.117.149.112 (2nd query TTL 791: unchanged) | Cloudflare NOERROR 9.8 ms ttl=747 15.197.250.250, 166.117.149.112 (2nd query TTL 709: served from cache) |
| Quad9 NOERROR 13.5 ms ttl=281 15.197.250.250, 166.117.149.112 | Quad9 NOERROR 13.9 ms ttl=171 15.197.250.250, 166.117.149.112 (2nd query TTL 169: served from cache) |
| |
| youtube.com -> disjoint | youtube.com -> disjoint |
| Google NOERROR 16.4 ms ttl=300 172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93 (2nd query TTL 300: unchanged) | Google NOERROR 20.6 ms ttl=300 172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.0 ms ttl=222 172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93 (2nd query TTL 60: served from cache) | Cloudflare NOERROR 8.9 ms ttl=111 192.178.170.136, 192.178.170.190, 192.178.170.91, 192.178.170.93 |
| Quad9 NOERROR 14.6 ms ttl=107 142.251.127.136, 142.251.127.190, 142.251.127.91, 142.251.127.93 (2nd query TTL 107: unchanged) | Quad9 NOERROR 15.0 ms ttl=154 142.251.13.136, 142.251.13.190, 142.251.13.91, 142.251.13.93 (2nd query TTL 154: unchanged) |
| |
| apple.com -> identical | apple.com -> identical |
| Google NOERROR 9.8 ms ttl=847 17.253.144.10 (2nd query TTL 847: unchanged) | Google NOERROR 10.9 ms ttl=760 17.253.144.10 (2nd query TTL 760: unchanged) |
| Cloudflare NOERROR 9.4 ms ttl=430 17.253.144.10 | Cloudflare NOERROR 8.7 ms ttl=617 17.253.144.10 |
| Quad9 NOERROR 14.8 ms ttl=591 17.253.144.10 (2nd query TTL 591: unchanged) | Quad9 NOERROR 14.7 ms ttl=216 17.253.144.10 |
| |
| gtld-servers.net -> no-A-record | gtld-servers.net -> no-A-record |
| Google NOERROR 10.4 ms ttl=- (no A record) | Google NOERROR 22.6 ms ttl=- (no A record) |
| Cloudflare NOERROR 26.5 ms ttl=- (no A record) | Cloudflare NOERROR 59.2 ms ttl=- (no A record) |
| Quad9 NOERROR 25.6 ms ttl=- (no A record) | Quad9 NOERROR 20.0 ms ttl=- (no A record) |
| |
| akamai.net -> no-A-record | akamai.net -> no-A-record |
| Google NOERROR 9.7 ms ttl=- (no A record) | Google NOERROR 17.0 ms ttl=- (no A record) |
| Cloudflare NOERROR 9.5 ms ttl=- (no A record) | Cloudflare NOERROR 9.9 ms ttl=- (no A record) |
| Quad9 NOERROR 15.2 ms ttl=- (no A record) | Quad9 NOERROR 14.8 ms ttl=- (no A record) |
| |
| instagram.com -> disjoint | instagram.com -> partial |
| Google NOERROR 15.7 ms ttl=60 157.240.17.174 (2nd query TTL 21: served from cache) | Google NOERROR 14.0 ms ttl=60 157.240.17.174 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 12.1 ms ttl=58 157.240.17.174 (2nd query TTL 45: served from cache) | Cloudflare NOERROR 10.9 ms ttl=4 157.240.17.174 |
| Quad9 NOERROR 16.2 ms ttl=35 157.240.253.174 (2nd query TTL 35: unchanged) | Quad9 NOERROR 15.4 ms ttl=33 157.240.253.174 (2nd query TTL 33: unchanged) |
| |
| mail.ru -> identical | mail.ru -> identical |
| Google NOERROR 11.8 ms ttl=26 185.180.201.1, 89.221.239.1, 90.156.232.4 (2nd query TTL 26: unchanged) | Google NOERROR 62.4 ms ttl=60 185.180.201.1, 89.221.239.1, 90.156.232.4 (2nd query TTL 53: served from cache) |
| Cloudflare NOERROR 11.3 ms ttl=14 185.180.201.1, 89.221.239.1, 90.156.232.4 (2nd query TTL 14: unchanged) | Cloudflare NOERROR 10.0 ms ttl=13 185.180.201.1, 89.221.239.1, 90.156.232.4 |
| Quad9 NOERROR 15.4 ms ttl=1 185.180.201.1, 89.221.239.1, 90.156.232.4 | Quad9 NOERROR 13.9 ms ttl=11 185.180.201.1, 89.221.239.1, 90.156.232.4 |
| |
| ezviz7.com -> no-A-record | ezviz7.com -> no-A-record |
| Google NOERROR 172.4 ms ttl=- (no A record) | Google NOERROR 340.7 ms ttl=- (no A record) |
| Cloudflare NOERROR 11.2 ms ttl=- (no A record) | Cloudflare NOERROR 11.6 ms ttl=- (no A record) |
| Quad9 NOERROR 15.8 ms ttl=- (no A record) | Quad9 NOERROR 243.7 ms ttl=- (no A record) |
| |
| fbcdn.net -> disjoint | fbcdn.net -> partial |
| Google NOERROR 11.6 ms ttl=19 157.240.17.35 (2nd query TTL 19: unchanged) | Google NOERROR 14.0 ms ttl=60 157.240.17.35 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 9.8 ms ttl=9 157.240.17.35 (2nd query TTL 8: served from cache) | Cloudflare NOERROR 9.9 ms ttl=42 157.240.17.35 (2nd query TTL 42: unchanged) |
| Quad9 NOERROR 15.5 ms ttl=3 157.240.0.35 | Quad9 NOERROR 14.7 ms ttl=32 157.240.0.35 (2nd query TTL 30: served from cache) |
| |
| twitter.com -> disjoint | twitter.com -> partial |
| Google NOERROR 10.8 ms ttl=65 162.159.140.229 | Google NOERROR 11.6 ms ttl=249 172.66.0.227 (2nd query TTL 120: served from cache) |
| Cloudflare NOERROR 9.3 ms ttl=169 172.66.0.227 (2nd query TTL 168: served from cache) | Cloudflare NOERROR 9.6 ms ttl=263 162.159.140.229 (2nd query TTL 203: served from cache) |
| Quad9 NOERROR 15.0 ms ttl=104 151.101.66.146 (2nd query TTL 76: served from cache) | Quad9 NOERROR 13.9 ms ttl=236 162.159.140.229 |
| |
| dzen.ru -> identical | dzen.ru -> identical |
| Google NOERROR 9.8 ms ttl=238 95.163.218.220 (2nd query TTL 238: unchanged) | Google NOERROR 9.7 ms ttl=450 95.163.218.220 |
| Cloudflare NOERROR 9.3 ms ttl=102 95.163.218.220 (2nd query TTL 31: served from cache) | Cloudflare NOERROR 9.1 ms ttl=29 95.163.218.220 (2nd query TTL 29: unchanged) |
| Quad9 NOERROR 15.3 ms ttl=472 95.163.218.220 (2nd query TTL 64: served from cache) | Quad9 NOERROR 16.1 ms ttl=308 95.163.218.220 (2nd query TTL 24: served from cache) |
| |
| linkedin.com -> identical | linkedin.com -> identical |
| Google NOERROR 9.9 ms ttl=237 130.211.32.14 | Google NOERROR 14.6 ms ttl=300 130.211.32.14 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.5 ms ttl=107 130.211.32.14 (2nd query TTL 66: served from cache) | Cloudflare NOERROR 9.4 ms ttl=237 130.211.32.14 |
| Quad9 NOERROR 15.3 ms ttl=29 130.211.32.14 | Quad9 NOERROR 15.0 ms ttl=139 130.211.32.14 |
| |
| domaincontrol.com -> identical | domaincontrol.com -> identical |
| Google NOERROR 27.8 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) | Google NOERROR 25.7 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) |
| Cloudflare NOERROR 16.8 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) | Cloudflare NOERROR 18.5 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) |
| Quad9 NOERROR 16.5 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) | Quad9 NOERROR 17.6 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged) |
| |
| googlevideo.com -> disjoint | googlevideo.com -> disjoint |
| Google NOERROR 17.0 ms ttl=300 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 258: served from cache) | Google NOERROR 17.7 ms ttl=300 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.5 ms ttl=58 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 (2nd query TTL 22: served from cache) | Cloudflare NOERROR 9.9 ms ttl=121 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 (2nd query TTL 121: unchanged) |
| Quad9 NOERROR 16.1 ms ttl=292 192.178.183.103, 192.178.183.104, 192.178.183.105, 192.178.183.106, 192.178.183.147, 192.178.183.99 (2nd query TTL 56: served from cache) | Quad9 NOERROR 14.8 ms ttl=152 142.251.14.103, 142.251.14.104, 142.251.14.105, 142.251.14.106, 142.251.14.147, 142.251.14.99 |
| |
| office.com -> identical | office.com -> identical |
| Google NOERROR 15.6 ms ttl=10 13.107.6.156 (2nd query TTL 10: unchanged) | Google NOERROR 11.2 ms ttl=2 13.107.6.156 |
| Cloudflare NOERROR 11.1 ms ttl=8 13.107.6.156 (2nd query TTL 5: served from cache) | Cloudflare NOERROR 10.2 ms ttl=7 13.107.6.156 |
| Quad9 NOERROR 14.9 ms ttl=5 13.107.6.156 | Quad9 NOERROR 15.5 ms ttl=6 13.107.6.156 (2nd query TTL 5: served from cache) |
| |
| googletagmanager.com -> disjoint | googletagmanager.com -> disjoint |
| Google NOERROR 10.8 ms ttl=258 172.217.208.97 (2nd query TTL 258: unchanged) | Google NOERROR 24.7 ms ttl=300 172.217.208.97 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.9 ms ttl=261 74.125.29.97 (2nd query TTL 178: served from cache) | Cloudflare NOERROR 10.7 ms ttl=271 74.125.29.97 (2nd query TTL 271: unchanged) |
| Quad9 NOERROR 15.8 ms ttl=50 142.251.20.97 (2nd query TTL 12: served from cache) | Quad9 NOERROR 15.5 ms ttl=23 192.178.183.97 |
| |
| hicloudcam.com -> no-A-record | hicloudcam.com -> no-A-record |
| Google NOERROR 11.1 ms ttl=- (no A record) | Google NOERROR 319.1 ms ttl=- (no A record) |
| Cloudflare NOERROR 607.2 ms ttl=- (no A record) | Cloudflare NOERROR 520.8 ms ttl=- (no A record) |
| Quad9 NOERROR 238.1 ms ttl=- (no A record) | Quad9 NOERROR 240.3 ms ttl=- (no A record) |
| |
| live.com -> identical | live.com -> identical |
| Google NOERROR 9.4 ms ttl=3285 204.79.197.212 (2nd query TTL 2887: served from cache) | Google NOERROR 13.1 ms ttl=104 204.79.197.212 |
| Cloudflare NOERROR 9.9 ms ttl=233 204.79.197.212 | Cloudflare NOERROR 9.8 ms ttl=2662 204.79.197.212 (2nd query TTL 2662: unchanged) |
| Quad9 NOERROR 14.4 ms ttl=2035 204.79.197.212 | Quad9 NOERROR 14.9 ms ttl=2914 204.79.197.212 (2nd query TTL 2914: unchanged) |
| |
| akamaiedge.net -> no-A-record | akamaiedge.net -> no-A-record |
| Google NOERROR 9.8 ms ttl=- (no A record) | Google NOERROR 10.0 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.4 ms ttl=- (no A record) | Cloudflare NOERROR 10.5 ms ttl=- (no A record) |
| Quad9 NOERROR 15.0 ms ttl=- (no A record) | Quad9 NOERROR 15.1 ms ttl=- (no A record) |
| |
| amazon.com -> identical | amazon.com -> identical |
| Google NOERROR 11.8 ms ttl=635 98.82.161.185, 98.87.170.71, 98.87.170.74 (2nd query TTL 245: served from cache) | Google NOERROR 10.7 ms ttl=158 98.82.161.185, 98.87.170.71, 98.87.170.74 |
| Cloudflare NOERROR 9.9 ms ttl=92 98.82.161.185, 98.87.170.71, 98.87.170.74 | Cloudflare NOERROR 9.7 ms ttl=504 98.82.161.185, 98.87.170.71, 98.87.170.74 (2nd query TTL 492: served from cache) |
| Quad9 NOERROR 15.0 ms ttl=671 98.82.161.185, 98.87.170.71, 98.87.170.74 | Quad9 NOERROR 16.1 ms ttl=759 98.82.161.185, 98.87.170.71, 98.87.170.74 (2nd query TTL 506: served from cache) |
| |
| akadns.net -> no-A-record | akadns.net -> no-A-record |
| Google NOERROR 11.2 ms ttl=- (no A record) | Google NOERROR 20.1 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.9 ms ttl=- (no A record) | Cloudflare NOERROR 10.9 ms ttl=- (no A record) |
| Quad9 NOERROR 16.2 ms ttl=- (no A record) | Quad9 NOERROR 15.9 ms ttl=- (no A record) |
| |
| azure.com -> identical | azure.com -> identical |
| Google NOERROR 10.3 ms ttl=3559 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1200: served from cache) | Google NOERROR 9.7 ms ttl=1261 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| Cloudflare NOERROR 10.1 ms ttl=2214 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2111: served from cache) | Cloudflare NOERROR 9.2 ms ttl=2975 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2955: served from cache) |
| Quad9 NOERROR 16.4 ms ttl=1893 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1886: served from cache) | Quad9 NOERROR 13.8 ms ttl=2722 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2722: unchanged) |
| |
| bing.com -> identical | bing.com -> identical |
| Google NOERROR 10.4 ms ttl=2729 150.171.27.10, 150.171.28.10 | Google NOERROR 10.1 ms ttl=3542 150.171.27.10, 150.171.28.10 (2nd query TTL 691: served from cache) |
| Cloudflare NOERROR 9.8 ms ttl=606 150.171.27.10, 150.171.28.10 | Cloudflare NOERROR 10.7 ms ttl=2911 150.171.27.10, 150.171.28.10 (2nd query TTL 2719: served from cache) |
| Quad9 NOERROR 14.6 ms ttl=2570 150.171.27.10, 150.171.28.10 | Quad9 NOERROR 14.7 ms ttl=533 150.171.27.10, 150.171.28.10 |
| |
| github.com -> same-/24 | github.com -> partial |
| Google NOERROR 15.7 ms ttl=60 140.82.121.4 (2nd query TTL 60: unchanged) | Google NOERROR 18.2 ms ttl=60 140.82.121.3 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 10.8 ms ttl=30 140.82.121.3 (2nd query TTL 30: unchanged) | Cloudflare NOERROR 9.7 ms ttl=1 140.82.121.4 |
| Quad9 NOERROR 14.2 ms ttl=57 140.82.121.3 (2nd query TTL 10: served from cache) | Quad9 NOERROR 14.0 ms ttl=51 140.82.121.4 (2nd query TTL 23: served from cache) |
| |
| wikipedia.org -> disjoint | wikipedia.org -> partial |
| Google NOERROR 10.5 ms ttl=19 185.15.58.224 | Google NOERROR 11.3 ms ttl=167 185.15.58.224 |
| Cloudflare NOERROR 9.4 ms ttl=70 185.15.58.224 (2nd query TTL 22: served from cache) | Cloudflare NOERROR 10.6 ms ttl=57 185.15.58.224 |
| Quad9 NOERROR 15.7 ms ttl=91 185.15.59.224 (2nd query TTL 79: served from cache) | Quad9 NOERROR 17.1 ms ttl=63 185.15.59.224 (2nd query TTL 49: served from cache) |
| |
| whatsapp.net -> disjoint | whatsapp.net -> partial |
| Google NOERROR 10.4 ms ttl=18 157.240.17.60 | Google NOERROR 14.3 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 11.0 ms ttl=58 157.240.17.60 (2nd query TTL 8: served from cache) | Cloudflare NOERROR 10.7 ms ttl=40 157.240.17.60 (2nd query TTL 40: unchanged) |
| Quad9 NOERROR 14.2 ms ttl=14 157.240.0.60 | Quad9 NOERROR 15.0 ms ttl=27 157.240.0.60 (2nd query TTL 27: unchanged) |
| |
| apple-dns.net -> no-A-record | apple-dns.net -> no-A-record |
| Google NOERROR 11.4 ms ttl=- (no A record) | Google NOERROR 10.0 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.9 ms ttl=- (no A record) | Cloudflare NOERROR 9.6 ms ttl=- (no A record) |
| Quad9 NOERROR 15.4 ms ttl=- (no A record) | Quad9 NOERROR 14.5 ms ttl=- (no A record) |
| |
| fastly.net -> identical | fastly.net -> identical |
| Google NOERROR 10.3 ms ttl=2605 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 (2nd query TTL 2605: unchanged) | Google NOERROR 11.5 ms ttl=2039 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 (2nd query TTL 633: served from cache) |
| Cloudflare NOERROR 11.8 ms ttl=2680 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 | Cloudflare NOERROR 10.6 ms ttl=3494 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 (2nd query TTL 1394: served from cache) |
| Quad9 NOERROR 16.0 ms ttl=396 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 | Quad9 NOERROR 16.2 ms ttl=1732 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 |
| |
| googleusercontent.com -> disjoint | googleusercontent.com -> disjoint |
| Google NOERROR 40.6 ms ttl=300 192.178.170.132 (2nd query TTL 300: unchanged) | Google NOERROR 38.9 ms ttl=300 192.178.170.132 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 11.4 ms ttl=109 74.125.29.132 (2nd query TTL 33: served from cache) | Cloudflare NOERROR 11.2 ms ttl=108 74.125.29.132 |
| Quad9 NOERROR 15.0 ms ttl=254 142.251.127.132 (2nd query TTL 98: served from cache) | Quad9 NOERROR 14.9 ms ttl=300 142.251.20.132 (2nd query TTL 178: served from cache) |
| |
| appsflyersdk.com -> disjoint | appsflyersdk.com -> disjoint |
| Google NOERROR 19.6 ms ttl=60 3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48 (2nd query TTL 60: unchanged) | Google NOERROR 17.5 ms ttl=60 3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 11.4 ms ttl=60 3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48 (2nd query TTL 60: unchanged) | Cloudflare NOERROR 11.4 ms ttl=60 108.139.243.111, 108.139.243.112, 108.139.243.114, 108.139.243.9 (2nd query TTL 60: unchanged) |
| Quad9 NOERROR 14.0 ms ttl=19 18.238.243.45, 18.238.243.46, 18.238.243.57, 18.238.243.93 | Quad9 NOERROR 18.5 ms ttl=60 13.226.244.111, 13.226.244.60, 13.226.244.76, 13.226.244.9 (2nd query TTL 60: unchanged) |
| |
| doubleclick.net -> disjoint | doubleclick.net -> partial |
| Google NOERROR 18.9 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged) | Google NOERROR 16.2 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 10.1 ms ttl=234 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 45: served from cache) | Cloudflare NOERROR 9.2 ms ttl=268 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 268: unchanged) |
| Quad9 NOERROR 14.4 ms ttl=248 142.251.14.100, 142.251.14.101, 142.251.14.102, 142.251.14.113, 142.251.14.138, 142.251.14.139 | Quad9 NOERROR 14.1 ms ttl=90 192.178.183.100, 192.178.183.101, 192.178.183.102, 192.178.183.113, 192.178.183.138, 192.178.183.139 (2nd query TTL 90: unchanged) |
| |
| aaplimg.com -> no-A-record | aaplimg.com -> no-A-record |
| Google NOERROR 11.1 ms ttl=- (no A record) | Google NOERROR 13.4 ms ttl=- (no A record) |
| Cloudflare NOERROR 12.0 ms ttl=- (no A record) | Cloudflare NOERROR 10.0 ms ttl=- (no A record) |
| Quad9 NOERROR 14.4 ms ttl=- (no A record) | Quad9 NOERROR 15.2 ms ttl=- (no A record) |
| |
| microsoftonline.com -> no-A-record | microsoftonline.com -> no-A-record |
| Google NOERROR 10.6 ms ttl=- (no A record) | Google NOERROR 12.3 ms ttl=- (no A record) |
| Cloudflare NOERROR 8.6 ms ttl=- (no A record) | Cloudflare NOERROR 9.9 ms ttl=- (no A record) |
| Quad9 NOERROR 15.2 ms ttl=- (no A record) | Quad9 NOERROR 14.9 ms ttl=- (no A record) |
| |
| netflix.com -> disjoint | netflix.com -> partial |
| Google NOERROR 13.3 ms ttl=60 52.214.181.141, 54.170.196.176, 54.246.79.9 (2nd query TTL 60: unchanged) | Google NOERROR 16.1 ms ttl=60 52.214.181.141, 54.170.196.176, 54.246.79.9 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 13.0 ms ttl=56 52.214.181.141, 54.170.196.176, 54.246.79.9 (2nd query TTL 56: unchanged) | Cloudflare NOERROR 11.7 ms ttl=58 18.200.8.190, 54.155.246.232, 54.73.148.110 (2nd query TTL 8: served from cache) |
| Quad9 NOERROR 15.0 ms ttl=56 18.200.8.190, 54.155.246.232, 54.73.148.110 (2nd query TTL 56: unchanged) | Quad9 NOERROR 15.0 ms ttl=44 18.200.8.190, 54.155.246.232, 54.73.148.110 (2nd query TTL 37: served from cache) |
| |
| office.net -> no-A-record | office.net -> no-A-record |
| Google NOERROR 10.5 ms ttl=- (no A record) | Google NOERROR 11.2 ms ttl=- (no A record) |
| Cloudflare NOERROR 11.9 ms ttl=- (no A record) | Cloudflare NOERROR 10.8 ms ttl=- (no A record) |
| Quad9 NOERROR 13.9 ms ttl=- (no A record) | Quad9 NOERROR 15.2 ms ttl=- (no A record) |
| |
| trafficmanager.net -> no-A-record | trafficmanager.net -> no-A-record |
| Google NOERROR 13.2 ms ttl=- (no A record) | Google NOERROR 12.7 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.1 ms ttl=- (no A record) | Cloudflare NOERROR 10.1 ms ttl=- (no A record) |
| Quad9 NOERROR 14.5 ms ttl=- (no A record) | Quad9 NOERROR 14.4 ms ttl=- (no A record) |
| |
| gandi.net -> identical | gandi.net -> identical |
| Google NOERROR 33.5 ms ttl=600 217.70.185.65 (2nd query TTL 600: unchanged) | Google NOERROR 36.2 ms ttl=600 217.70.185.65 (2nd query TTL 600: unchanged) |
| Cloudflare NOERROR 10.2 ms ttl=559 217.70.185.65 (2nd query TTL 559: unchanged) | Cloudflare NOERROR 23.5 ms ttl=600 217.70.185.65 (2nd query TTL 600: unchanged) |
| Quad9 NOERROR 14.4 ms ttl=559 217.70.185.65 (2nd query TTL 558: served from cache) | Quad9 NOERROR 40.3 ms ttl=600 217.70.185.65 (2nd query TTL 217: served from cache) |
| |
| sharepoint.com -> identical | sharepoint.com -> identical |
| Google NOERROR 10.2 ms ttl=1132 13.107.136.10, 13.107.138.10 (2nd query TTL 1132: unchanged) | Google NOERROR 10.0 ms ttl=1250 13.107.136.10, 13.107.138.10 (2nd query TTL 1087: served from cache) |
| Cloudflare NOERROR 9.4 ms ttl=1247 13.107.136.10, 13.107.138.10 | Cloudflare NOERROR 10.4 ms ttl=2067 13.107.136.10, 13.107.138.10 (2nd query TTL 2067: unchanged) |
| Quad9 NOERROR 14.5 ms ttl=1604 13.107.136.10, 13.107.138.10 (2nd query TTL 1276: served from cache) | Quad9 NOERROR 15.1 ms ttl=2089 13.107.136.10, 13.107.138.10 (2nd query TTL 2020: served from cache) |
| |
| digicert.com -> identical | digicert.com -> identical |
| Google NOERROR 10.0 ms ttl=65 45.60.121.229, 45.60.131.229 (2nd query TTL 19: served from cache) | Google NOERROR 12.3 ms ttl=233 45.60.121.229, 45.60.131.229 (2nd query TTL 110: served from cache) |
| Cloudflare NOERROR 10.9 ms ttl=288 45.60.121.229, 45.60.131.229 (2nd query TTL 169: served from cache) | Cloudflare NOERROR 8.8 ms ttl=36 45.60.121.229, 45.60.131.229 (2nd query TTL 36: unchanged) |
| Quad9 NOERROR 15.2 ms ttl=144 45.60.121.229, 45.60.131.229 | Quad9 NOERROR 14.3 ms ttl=38 45.60.121.229, 45.60.131.229 |
| |
| youtu.be -> disjoint | youtu.be -> partial |
| Google NOERROR 12.8 ms ttl=259 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93 (2nd query TTL 259: unchanged) | Google NOERROR 24.7 ms ttl=300 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.4 ms ttl=39 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93 | Cloudflare NOERROR 10.4 ms ttl=66 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93 (2nd query TTL 47: served from cache) |
| Quad9 NOERROR 15.4 ms ttl=118 142.251.127.136, 142.251.127.190, 142.251.127.91, 142.251.127.93 | Quad9 NOERROR 14.8 ms ttl=98 142.250.154.136, 142.250.154.190, 142.250.154.91, 142.250.154.93 |
| |
| wordpress.org -> identical | wordpress.org -> identical |
| Google NOERROR 11.2 ms ttl=440 66.6.42.252 (2nd query TTL 379: served from cache) | Google NOERROR 10.8 ms ttl=73 66.6.42.252 (2nd query TTL 73: unchanged) |
| Cloudflare NOERROR 16.6 ms ttl=600 66.6.42.252 (2nd query TTL 519: served from cache) | Cloudflare NOERROR 9.5 ms ttl=328 66.6.42.252 (2nd query TTL 134: served from cache) |
| Quad9 NOERROR 14.9 ms ttl=404 66.6.42.252 (2nd query TTL 60: served from cache) | Quad9 NOERROR 15.1 ms ttl=52 66.6.42.252 |
| |
| skype.com -> identical | skype.com -> identical |
| Google NOERROR 10.4 ms ttl=2344 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Google NOERROR 10.3 ms ttl=183 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| Cloudflare NOERROR 9.9 ms ttl=1704 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Cloudflare NOERROR 9.5 ms ttl=26 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| Quad9 NOERROR 15.8 ms ttl=952 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Quad9 NOERROR 14.1 ms ttl=1825 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| |
| cloud.microsoft -> identical | cloud.microsoft -> identical |
| Google NOERROR 10.9 ms ttl=127 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Google NOERROR 9.1 ms ttl=97 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 97: unchanged) |
| Cloudflare NOERROR 10.9 ms ttl=165 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Cloudflare NOERROR 10.0 ms ttl=155 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| Quad9 NOERROR 15.3 ms ttl=129 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 75: served from cache) | Quad9 NOERROR 13.3 ms ttl=157 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 |
| |
| goo.gl -> disjoint | goo.gl -> disjoint |
| Google NOERROR 23.8 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged) | Google NOERROR 25.2 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 11.0 ms ttl=28 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139 | Cloudflare NOERROR 8.8 ms ttl=280 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139 (2nd query TTL 280: unchanged) |
| Quad9 NOERROR 15.1 ms ttl=26 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139 | Quad9 NOERROR 15.5 ms ttl=29 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139 (2nd query TTL 29: unchanged) |
| |
| cloudfront.net -> no-A-record | cloudfront.net -> no-A-record |
| Google NOERROR 12.3 ms ttl=- (no A record) | Google NOERROR 12.4 ms ttl=- (no A record) |
| Cloudflare NOERROR 11.1 ms ttl=- (no A record) | Cloudflare NOERROR 11.5 ms ttl=- (no A record) |
| Quad9 NOERROR 15.0 ms ttl=- (no A record) | Quad9 NOERROR 17.0 ms ttl=- (no A record) |
| |
| googledomains.com -> identical | googledomains.com -> identical |
| Google NOERROR 30.2 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged) | Google NOERROR 32.6 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 17.1 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged) | Cloudflare NOERROR 23.8 ms ttl=300 216.239.32.29 (2nd query TTL 60: served from cache) |
| Quad9 NOERROR 17.5 ms ttl=259 216.239.32.29 | Quad9 NOERROR 26.7 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged) |
| |
| x.com -> disjoint | x.com -> partial |
| Google NOERROR 12.2 ms ttl=25 172.66.0.227 | Google NOERROR 9.7 ms ttl=75 172.66.0.227 (2nd query TTL 74: served from cache) |
| Cloudflare NOERROR 10.6 ms ttl=33 162.159.140.229 | Cloudflare NOERROR 9.4 ms ttl=104 162.159.140.229 (2nd query TTL 103: served from cache) |
| Quad9 NOERROR 15.1 ms ttl=183 162.159.140.229 (2nd query TTL 87: served from cache) | Quad9 NOERROR 15.1 ms ttl=143 162.159.140.229 (2nd query TTL 89: served from cache) |
| |
| tiktok.com -> disjoint | tiktok.com -> disjoint |
| Google NOERROR 19.3 ms ttl=20 2.21.22.17, 2.21.22.56 (2nd query TTL 20: unchanged) | Google NOERROR 23.7 ms ttl=20 2.21.22.17, 2.21.22.56 (2nd query TTL 20: unchanged) |
| Cloudflare NOERROR 10.3 ms ttl=16 23.55.104.30, 23.55.104.31, 23.55.104.38, 23.61.250.102, 23.61.250.104, 23.61.250.117, 23.61.250.119, 23.61.250.81 (2nd query TTL 16: unchanged) | Cloudflare NOERROR 10.3 ms ttl=13 104.109.250.146, 104.109.250.172 (2nd query TTL 13: unchanged) |
| Quad9 NOERROR 13.9 ms ttl=15 104.126.37.123, 104.126.37.153, 104.126.37.179, 104.126.37.185 (2nd query TTL 15: unchanged) | Quad9 NOERROR 14.5 ms ttl=1 23.36.162.199, 23.36.162.207, 23.36.162.209, 23.36.162.213, 23.36.162.214, 23.36.162.215, 23.36.162.219, 23.36.162.221 (2nd query TTL 1: unchanged) |
| |
| pinterest.com -> identical | pinterest.com -> identical |
| Google NOERROR 12.0 ms ttl=444 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 | Google NOERROR 12.0 ms ttl=316 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 (2nd query TTL 316: unchanged) |
| Cloudflare NOERROR 9.5 ms ttl=415 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 (2nd query TTL 328: served from cache) | Cloudflare NOERROR 10.0 ms ttl=308 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 |
| Quad9 NOERROR 14.0 ms ttl=426 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 | Quad9 NOERROR 14.2 ms ttl=169 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 |
| |
| icloud.com -> identical | icloud.com -> identical |
| Google NOERROR 9.2 ms ttl=438 17.253.144.10 (2nd query TTL 436: served from cache) | Google NOERROR 9.6 ms ttl=45 17.253.144.10 |
| Cloudflare NOERROR 9.5 ms ttl=322 17.253.144.10 (2nd query TTL 322: unchanged) | Cloudflare NOERROR 9.5 ms ttl=493 17.253.144.10 (2nd query TTL 415: served from cache) |
| Quad9 NOERROR 15.0 ms ttl=296 17.253.144.10 | Quad9 NOERROR 14.4 ms ttl=278 17.253.144.10 (2nd query TTL 94: served from cache) |
| |
| whatsapp.com -> disjoint | whatsapp.com -> partial |
| Google NOERROR 24.6 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged) | Google NOERROR 11.9 ms ttl=36 157.240.17.60 |
| Cloudflare NOERROR 9.4 ms ttl=20 157.240.17.60 | Cloudflare NOERROR 10.9 ms ttl=16 157.240.17.60 |
| Quad9 NOERROR 15.9 ms ttl=16 157.240.0.60 (2nd query TTL 15: served from cache) | Quad9 NOERROR 17.0 ms ttl=21 157.240.0.60 (2nd query TTL 4: served from cache) |
| |
| roblox.com -> identical | roblox.com -> identical |
| Google NOERROR 11.9 ms ttl=39 128.116.5.3 | Google NOERROR 20.6 ms ttl=31 128.116.5.3 (2nd query TTL 20: served from cache) |
| Cloudflare NOERROR 11.0 ms ttl=17 128.116.5.3 (2nd query TTL 2: served from cache) | Cloudflare NOERROR 11.7 ms ttl=20 128.116.5.3 |
| Quad9 NOERROR 15.7 ms ttl=51 128.116.5.3 (2nd query TTL 24: served from cache) | Quad9 NOERROR 15.2 ms ttl=45 128.116.5.3 (2nd query TTL 41: served from cache) |
| |
| yahoo.com -> identical | yahoo.com -> identical |
| Google NOERROR 12.2 ms ttl=1121 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 (2nd query TTL 1121: unchanged) | Google NOERROR 10.0 ms ttl=400 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 (2nd query TTL 105: served from cache) |
| Cloudflare NOERROR 9.1 ms ttl=40 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 | Cloudflare NOERROR 9.2 ms ttl=587 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 (2nd query TTL 587: unchanged) |
| Quad9 NOERROR 15.6 ms ttl=273 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 | Quad9 NOERROR 16.4 ms ttl=724 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 (2nd query TTL 200: served from cache) |
| |
| windowsupdate.com -> no-A-record | windowsupdate.com -> no-A-record |
| Google NOERROR 9.6 ms ttl=- (no A record) | Google NOERROR 11.5 ms ttl=- (no A record) |
| Cloudflare NOERROR 9.1 ms ttl=- (no A record) | Cloudflare NOERROR 11.0 ms ttl=- (no A record) |
| Quad9 NOERROR 15.7 ms ttl=- (no A record) | Quad9 NOERROR 14.7 ms ttl=- (no A record) |
| |
| cloudflare.net -> identical | cloudflare.net -> identical |
| Google NOERROR 14.1 ms ttl=300 104.16.208.90, 104.17.156.85 (2nd query TTL 300: unchanged) | Google NOERROR 16.7 ms ttl=300 104.16.208.90, 104.17.156.85 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 9.4 ms ttl=259 104.16.208.90, 104.17.156.85 | Cloudflare NOERROR 11.6 ms ttl=91 104.16.208.90, 104.17.156.85 |
| Quad9 NOERROR 13.6 ms ttl=102 104.16.208.90, 104.17.156.85 (2nd query TTL 102: unchanged) | Quad9 NOERROR 15.2 ms ttl=38 104.16.208.90, 104.17.156.85 |
| |
| gvt1.com -> no-A-record | gvt1.com -> no-A-record |
| Google NOERROR 24.1 ms ttl=- (no A record) | Google NOERROR 42.9 ms ttl=- (no A record) |
| Cloudflare NOERROR 9.7 ms ttl=- (no A record) | Cloudflare NOERROR 11.0 ms ttl=- (no A record) |
| Quad9 NOERROR 14.4 ms ttl=- (no A record) | Quad9 NOERROR 15.6 ms ttl=- (no A record) |
| |
| googlesyndication.com -> disjoint | googlesyndication.com -> partial |
| Google NOERROR 10.3 ms ttl=259 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 | Google NOERROR 25.6 ms ttl=300 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 10.5 ms ttl=38 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 | Cloudflare NOERROR 19.4 ms ttl=300 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 (2nd query TTL 300: unchanged) |
| Quad9 NOERROR 15.4 ms ttl=77 142.251.20.103, 142.251.20.104, 142.251.20.105, 142.251.20.106, 142.251.20.147, 142.251.20.99 (2nd query TTL 77: unchanged) | Quad9 NOERROR 25.5 ms ttl=300 142.251.110.103, 142.251.110.104, 142.251.110.105, 142.251.110.106, 142.251.110.147, 142.251.110.99 (2nd query TTL 300: unchanged) |
| |
| msn.com -> identical | msn.com -> identical |
| Google NOERROR 10.7 ms ttl=131 204.79.197.219 | Google NOERROR 12.2 ms ttl=1507 204.79.197.219 (2nd query TTL 523: served from cache) |
| Cloudflare NOERROR 10.1 ms ttl=3474 204.79.197.219 (2nd query TTL 3474: unchanged) | Cloudflare NOERROR 11.5 ms ttl=2504 204.79.197.219 (2nd query TTL 687: served from cache) |
| Quad9 NOERROR 14.7 ms ttl=2249 204.79.197.219 (2nd query TTL 1844: served from cache) | Quad9 NOERROR 15.9 ms ttl=717 204.79.197.219 (2nd query TTL 717: unchanged) |
| |
| spotify.com -> identical | spotify.com -> identical |
| Google NOERROR 12.3 ms ttl=4 35.186.224.24 | Google NOERROR 10.3 ms ttl=131 35.186.224.24 (2nd query TTL 130: served from cache) |
| Cloudflare NOERROR 9.7 ms ttl=108 35.186.224.24 | Cloudflare NOERROR 9.8 ms ttl=87 35.186.224.24 |
| Quad9 NOERROR 16.0 ms ttl=18 35.186.224.24 | Quad9 NOERROR 15.2 ms ttl=171 35.186.224.24 (2nd query TTL 162: served from cache) |
| |
| windows.net -> identical | windows.net -> identical |
| Google NOERROR 11.3 ms ttl=166 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 16: served from cache) | Google NOERROR 12.0 ms ttl=48 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 48: unchanged) |
| Cloudflare NOERROR 10.4 ms ttl=1314 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1314: unchanged) | Cloudflare NOERROR 9.0 ms ttl=2033 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2033: unchanged) |
| Quad9 NOERROR 15.4 ms ttl=3208 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 3206: served from cache) | Quad9 NOERROR 15.3 ms ttl=632 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 632: unchanged) |
| |
| ntp.org -> identical | ntp.org -> identical |
| Google NOERROR 10.8 ms ttl=346 204.93.207.22, 209.148.110.246 (2nd query TTL 346: unchanged) | Google NOERROR 10.0 ms ttl=1158 204.93.207.22, 209.148.110.246 |
| Cloudflare NOERROR 9.8 ms ttl=2645 204.93.207.22, 209.148.110.246 (2nd query TTL 2645: unchanged) | Cloudflare NOERROR 11.1 ms ttl=3461 204.93.207.22, 209.148.110.246 (2nd query TTL 3461: unchanged) |
| Quad9 NOERROR 15.0 ms ttl=1861 204.93.207.22, 209.148.110.246 (2nd query TTL 1560: served from cache) | Quad9 NOERROR 15.4 ms ttl=2375 204.93.207.22, 209.148.110.246 |
| |
| adobe.com -> disjoint | adobe.com -> disjoint |
| Google NOERROR 17.9 ms ttl=20 92.123.27.153, 92.123.27.160, 92.123.27.170 (2nd query TTL 20: unchanged) | Google NOERROR 17.3 ms ttl=20 92.123.27.153, 92.123.27.168, 92.123.27.169 (2nd query TTL 20: unchanged) |
| Cloudflare NOERROR 10.2 ms ttl=15 2.20.245.174, 2.20.245.187 (2nd query TTL 15: unchanged) | Cloudflare NOERROR 11.5 ms ttl=3 23.36.163.27, 23.50.131.121 (2nd query TTL 2: served from cache) |
| Quad9 NOERROR 15.5 ms ttl=3 2.19.126.138, 2.19.126.158 | Quad9 NOERROR 15.6 ms ttl=11 2.19.126.138, 2.19.126.158 (2nd query TTL 6: served from cache) |
| |
| myfritz.net -> identical | myfritz.net -> identical |
| Google NOERROR 11.5 ms ttl=7939 212.42.244.100 | Google NOERROR 10.8 ms ttl=5152 212.42.244.100 |
| Cloudflare NOERROR 26.2 ms ttl=86400 212.42.244.100 (2nd query TTL 86400: unchanged) | Cloudflare NOERROR 26.1 ms ttl=86400 212.42.244.100 (2nd query TTL 86400: unchanged) |
| Quad9 NOERROR 16.1 ms ttl=27929 212.42.244.100 | Quad9 NOERROR 15.2 ms ttl=40413 212.42.244.100 (2nd query TTL 31027: served from cache) |
| |
| pv-cdn.net -> no-A-record | pv-cdn.net -> no-A-record |
| Google NOERROR 11.5 ms ttl=- (no A record) | Google NOERROR 12.4 ms ttl=- (no A record) |
| Cloudflare NOERROR 11.1 ms ttl=- (no A record) | Cloudflare NOERROR 10.7 ms ttl=- (no A record) |
| Quad9 NOERROR 14.8 ms ttl=- (no A record) | Quad9 NOERROR 14.1 ms ttl=- (no A record) |
| |
| wa.me -> disjoint | wa.me -> partial |
| Google NOERROR 13.5 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged) | Google NOERROR 20.9 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 9.4 ms ttl=50 157.240.17.60 (2nd query TTL 50: unchanged) | Cloudflare NOERROR 9.8 ms ttl=49 157.240.17.60 (2nd query TTL 49: unchanged) |
| Quad9 NOERROR 15.0 ms ttl=49 157.240.0.60 (2nd query TTL 49: unchanged) | Quad9 NOERROR 14.1 ms ttl=21 157.240.0.60 |
| |
| cdninstagram.com -> no-A-record | cdninstagram.com -> no-A-record |
| Google NOERROR 15.0 ms ttl=- (no A record) | Google NOERROR 13.2 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.1 ms ttl=- (no A record) | Cloudflare NOERROR 10.5 ms ttl=- (no A record) |
| Quad9 NOERROR 15.7 ms ttl=- (no A record) | Quad9 NOERROR 13.6 ms ttl=- (no A record) |
| |
| nginx.org -> disjoint | nginx.org -> partial |
| Google NOERROR 9.7 ms ttl=46 52.58.199.22 | Google NOERROR 10.0 ms ttl=9 3.125.197.172 (2nd query TTL 9: unchanged) |
| Cloudflare NOERROR 10.4 ms ttl=51 3.125.197.172 (2nd query TTL 13: served from cache) | Cloudflare NOERROR 9.6 ms ttl=19 52.58.199.22 |
| Quad9 NOERROR 13.9 ms ttl=35 3.125.197.172 (2nd query TTL 7: served from cache) | Quad9 NOERROR 16.5 ms ttl=18 3.125.197.172 |
| |
| akam.net -> no-A-record | akam.net -> no-A-record |
| Google NOERROR 31.3 ms ttl=- (no A record) | Google NOERROR 47.6 ms ttl=- (no A record) |
| Cloudflare NOERROR 12.9 ms ttl=- (no A record) | Cloudflare NOERROR 10.7 ms ttl=- (no A record) |
| Quad9 NOERROR 21.2 ms ttl=- (no A record) | Quad9 NOERROR 17.0 ms ttl=- (no A record) |
| |
| tiktokcdn.com -> no-A-record | tiktokcdn.com -> no-A-record |
| Google NOERROR 10.6 ms ttl=- (no A record) | Google NOERROR 9.7 ms ttl=- (no A record) |
| Cloudflare NOERROR 8.9 ms ttl=- (no A record) | Cloudflare NOERROR 9.2 ms ttl=- (no A record) |
| Quad9 NOERROR 14.7 ms ttl=- (no A record) | Quad9 NOERROR 14.0 ms ttl=- (no A record) |
| |
| chatgpt.com -> identical | chatgpt.com -> identical |
| Google NOERROR 29.4 ms ttl=300 104.18.32.47, 172.64.155.209 (2nd query TTL 300: unchanged) | Google NOERROR 28.5 ms ttl=300 104.18.32.47, 172.64.155.209 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 10.5 ms ttl=36 104.18.32.47, 172.64.155.209 (2nd query TTL 35: served from cache) | Cloudflare NOERROR 9.3 ms ttl=254 104.18.32.47, 172.64.155.209 (2nd query TTL 253: served from cache) |
| Quad9 NOERROR 15.4 ms ttl=93 104.18.32.47, 172.64.155.209 | Quad9 NOERROR 14.6 ms ttl=135 104.18.32.47, 172.64.155.209 (2nd query TTL 135: unchanged) |
| |
| zoom.us -> identical | zoom.us -> identical |
| Google NOERROR 17.6 ms ttl=60 170.114.52.2 (2nd query TTL 60: unchanged) | Google NOERROR 13.1 ms ttl=60 170.114.52.2 (2nd query TTL 60: unchanged) |
| Cloudflare NOERROR 10.2 ms ttl=39 170.114.52.2 | Cloudflare NOERROR 10.3 ms ttl=20 170.114.52.2 |
| Quad9 NOERROR 14.4 ms ttl=47 170.114.52.2 | Quad9 NOERROR 14.7 ms ttl=22 170.114.52.2 |
| |
| tiktokv.com -> disjoint | tiktokv.com -> disjoint |
| Google NOERROR 10.5 ms ttl=12 104.126.37.129, 104.126.37.138, 104.126.37.139, 104.126.37.145, 104.126.37.153, 104.126.37.160, 104.126.37.161, 104.126.37.168, 104.126.37.185 (2nd query TTL 12: unchanged) | Google NOERROR 10.4 ms ttl=8 104.126.37.128, 104.126.37.129, 104.126.37.131, 104.126.37.153, 104.126.37.155, 104.126.37.161, 104.126.37.179, 104.126.37.184, 104.126.37.186 (2nd query TTL 7: served from cache) |
| Cloudflare NOERROR 8.8 ms ttl=11 23.55.104.13, 23.55.104.23, 23.55.104.34, 23.55.104.35, 23.55.104.41, 23.55.104.45, 23.55.104.50, 23.55.104.57, 23.55.104.6 | Cloudflare NOERROR 9.4 ms ttl=8 2.21.22.27, 2.21.22.34, 2.21.22.40, 2.21.22.41, 2.21.22.56, 2.21.22.58, 2.21.22.8, 23.10.249.81, 23.10.249.82 (2nd query TTL 3: served from cache) |
| Quad9 NOERROR 14.9 ms ttl=14 2.18.64.13, 2.18.64.16, 2.18.64.17, 2.18.64.21, 2.18.64.22, 2.18.64.28, 2.18.64.32, 2.18.64.35, 2.18.64.4 | Quad9 NOERROR 15.5 ms ttl=12 2.20.142.129, 2.20.142.136, 2.20.142.144, 2.20.142.160, 92.122.215.2, 92.122.215.59, 92.122.215.72, 92.122.215.73, 92.122.215.93 (2nd query TTL 11: served from cache) |
| |
| vimeo.com -> identical | vimeo.com -> identical |
| Google NOERROR 10.7 ms ttl=481 162.159.128.61, 162.159.138.60 | Google NOERROR 11.5 ms ttl=397 162.159.128.61, 162.159.138.60 (2nd query TTL 397: unchanged) |
| Cloudflare NOERROR 9.5 ms ttl=785 162.159.128.61, 162.159.138.60 (2nd query TTL 785: unchanged) | Cloudflare NOERROR 10.5 ms ttl=799 162.159.128.61, 162.159.138.60 (2nd query TTL 799: unchanged) |
| Quad9 NOERROR 24.7 ms ttl=469 162.159.128.61, 162.159.138.60 | Quad9 NOERROR 15.5 ms ttl=523 162.159.128.61, 162.159.138.60 (2nd query TTL 153: served from cache) |
| |
| edgekey.net -> no-A-record | edgekey.net -> no-A-record |
| Google NOERROR 10.4 ms ttl=- (no A record) | Google NOERROR 11.3 ms ttl=- (no A record) |
| Cloudflare NOERROR 11.2 ms ttl=- (no A record) | Cloudflare NOERROR 10.5 ms ttl=- (no A record) |
| Quad9 NOERROR 17.3 ms ttl=- (no A record) | Quad9 NOERROR 15.3 ms ttl=- (no A record) |
| |
| baidu.com -> identical | baidu.com -> identical |
| Google NOERROR 12.7 ms ttl=600 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 104: served from cache) | Google NOERROR 10.5 ms ttl=502 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 502: unchanged) |
| Cloudflare NOERROR 10.7 ms ttl=232 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 201: served from cache) | Cloudflare NOERROR 10.7 ms ttl=264 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 |
| Quad9 NOERROR 15.8 ms ttl=111 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 | Quad9 NOERROR 15.4 ms ttl=268 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 268: unchanged) |
| |
| cloudflare-dns.com -> identical | cloudflare-dns.com -> identical |
| Google NOERROR 15.4 ms ttl=300 104.16.248.249, 104.16.249.249 (2nd query TTL 300: unchanged) | Google NOERROR 17.8 ms ttl=300 104.16.248.249, 104.16.249.249 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 10.3 ms ttl=276 104.16.248.249, 104.16.249.249 (2nd query TTL 276: unchanged) | Cloudflare NOERROR 9.5 ms ttl=84 104.16.248.249, 104.16.249.249 |
| Quad9 NOERROR 16.0 ms ttl=148 104.16.248.249, 104.16.249.249 | Quad9 NOERROR 14.7 ms ttl=51 104.16.248.249, 104.16.249.249 |
| |
| gvt2.com -> no-A-record | gvt2.com -> no-A-record |
| Google NOERROR 13.2 ms ttl=- (no A record) | Google NOERROR 18.7 ms ttl=- (no A record) |
| Cloudflare NOERROR 12.9 ms ttl=- (no A record) | Cloudflare NOERROR 17.9 ms ttl=- (no A record) |
| Quad9 NOERROR 16.5 ms ttl=- (no A record) | Quad9 NOERROR 15.7 ms ttl=- (no A record) |
| |
| yandex.net -> identical | yandex.net -> identical |
| Google NOERROR 12.6 ms ttl=590 213.180.204.242 (2nd query TTL 590: unchanged) | Google NOERROR 11.8 ms ttl=54 213.180.204.242 (2nd query TTL 54: unchanged) |
| Cloudflare NOERROR 10.7 ms ttl=244 213.180.204.242 | Cloudflare NOERROR 10.2 ms ttl=547 213.180.204.242 (2nd query TTL 547: unchanged) |
| Quad9 NOERROR 19.3 ms ttl=257 213.180.204.242 | Quad9 NOERROR 15.1 ms ttl=6 213.180.204.242 (2nd query TTL 6: unchanged) |
| |
| windows.com -> identical | windows.com -> identical |
| Google NOERROR 10.5 ms ttl=3535 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1892: served from cache) | Google NOERROR 10.3 ms ttl=2705 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 623: served from cache) |
| Cloudflare NOERROR 9.4 ms ttl=1604 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Cloudflare NOERROR 10.1 ms ttl=2600 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2420: served from cache) |
| Quad9 NOERROR 15.1 ms ttl=21 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 | Quad9 NOERROR 15.2 ms ttl=2531 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 107: served from cache) |
| |
| root-servers.net -> no-A-record | root-servers.net -> no-A-record |
| Google NOERROR 24.2 ms ttl=- (no A record) | Google NOERROR 18.6 ms ttl=- (no A record) |
| Cloudflare NOERROR 13.3 ms ttl=- (no A record) | Cloudflare NOERROR 10.1 ms ttl=- (no A record) |
| Quad9 NOERROR 15.3 ms ttl=- (no A record) | Quad9 NOERROR 15.6 ms ttl=- (no A record) |
| |
| openai.com -> identical | openai.com -> identical |
| Google NOERROR 12.0 ms ttl=28 104.18.33.45, 172.64.154.211 (2nd query TTL 28: unchanged) | Google NOERROR 10.1 ms ttl=1 104.18.33.45, 172.64.154.211 (2nd query TTL 1: unchanged) |
| Cloudflare NOERROR 10.3 ms ttl=53 104.18.33.45, 172.64.154.211 | Cloudflare NOERROR 8.3 ms ttl=60 104.18.33.45, 172.64.154.211 (2nd query TTL 26: served from cache) |
| Quad9 NOERROR 14.0 ms ttl=23 104.18.33.45, 172.64.154.211 | Quad9 NOERROR 14.6 ms ttl=5 104.18.33.45, 172.64.154.211 (2nd query TTL 5: unchanged) |
| |
| gwfb.net -> no-A-record | gwfb.net -> no-A-record |
| Google NOERROR 10.6 ms ttl=- (no A record) | Google NOERROR 402.9 ms ttl=- (no A record) |
| Cloudflare NOERROR 543.7 ms ttl=- (no A record) | Cloudflare NOERROR 762.9 ms ttl=- (no A record) |
| Quad9 NOERROR 243.3 ms ttl=- (no A record) | Quad9 NOERROR 261.2 ms ttl=- (no A record) |
| |
| ytimg.com -> no-A-record | ytimg.com -> no-A-record |
| Google NOERROR 19.2 ms ttl=- (no A record) | Google NOERROR 29.8 ms ttl=- (no A record) |
| Cloudflare NOERROR 8.3 ms ttl=- (no A record) | Cloudflare NOERROR 9.8 ms ttl=- (no A record) |
| Quad9 NOERROR 16.0 ms ttl=- (no A record) | Quad9 NOERROR 14.2 ms ttl=- (no A record) |
| |
| workers.dev -> identical | workers.dev -> identical |
| Google NOERROR 14.5 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 300: unchanged) | Google NOERROR 13.6 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 12.2 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 300: unchanged) | Cloudflare NOERROR 13.0 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 257: served from cache) |
| Quad9 NOERROR 16.1 ms ttl=82 104.18.12.15, 104.18.13.15 | Quad9 NOERROR 18.7 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 160: served from cache) |
| |
| qq.com -> identical | qq.com -> identical |
| Google NOERROR 12.6 ms ttl=594 113.108.81.189, 123.150.76.218, 203.205.254.157 | Google NOERROR 229.8 ms ttl=600 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 597: served from cache) |
| Cloudflare NOERROR 14.7 ms ttl=268 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 82: served from cache) | Cloudflare NOERROR 9.6 ms ttl=299 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 299: unchanged) |
| Quad9 NOERROR 17.3 ms ttl=598 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 316: served from cache) | Quad9 NOERROR 15.9 ms ttl=199 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 147: served from cache) |
| |
| opera.com -> identical | opera.com -> identical |
| Google NOERROR 11.0 ms ttl=226 185.26.182.103, 185.26.182.104 | Google NOERROR 22.3 ms ttl=600 185.26.182.103, 185.26.182.104 (2nd query TTL 600: unchanged) |
| Cloudflare NOERROR 11.1 ms ttl=368 185.26.182.103, 185.26.182.104 (2nd query TTL 368: unchanged) | Cloudflare NOERROR 22.1 ms ttl=600 185.26.182.103, 185.26.182.104 (2nd query TTL 600: unchanged) |
| Quad9 NOERROR 29.3 ms ttl=600 185.26.182.103, 185.26.182.104 (2nd query TTL 600: unchanged) | Quad9 NOERROR 14.0 ms ttl=9 185.26.182.103, 185.26.182.104 |
| |
| samsung.com -> identical | samsung.com -> identical |
| Google NOERROR 11.6 ms ttl=98 211.45.27.231 (2nd query TTL 98: unchanged) | Google NOERROR 9.5 ms ttl=155 211.45.27.231 |
| Cloudflare NOERROR 9.8 ms ttl=49 211.45.27.231 (2nd query TTL 32: served from cache) | Cloudflare NOERROR 9.2 ms ttl=176 211.45.27.231 |
| Quad9 NOERROR 16.4 ms ttl=70 211.45.27.231 | Quad9 NOERROR 13.7 ms ttl=125 211.45.27.231 |
| |
| blogspot.com -> disjoint | blogspot.com -> partial |
| Google NOERROR 23.6 ms ttl=300 74.125.29.191 (2nd query TTL 300: unchanged) | Google NOERROR 24.6 ms ttl=300 74.125.29.191 (2nd query TTL 300: unchanged) |
| Cloudflare NOERROR 18.0 ms ttl=300 172.217.208.191 (2nd query TTL 300: unchanged) | Cloudflare NOERROR 16.5 ms ttl=300 74.125.29.191 (2nd query TTL 300: unchanged) |
| Quad9 NOERROR 24.3 ms ttl=300 142.251.20.191 (2nd query TTL 291: served from cache) | Quad9 NOERROR 14.8 ms ttl=28 142.251.20.191 |
| |
| mozilla.org -> identical | mozilla.org -> identical |
| Google NOERROR 10.8 ms ttl=137 35.190.14.201 (2nd query TTL 96: served from cache) | Google NOERROR 10.2 ms ttl=57 35.190.14.201 (2nd query TTL 57: unchanged) |
| Cloudflare NOERROR 12.3 ms ttl=600 35.190.14.201 (2nd query TTL 592: served from cache) | Cloudflare NOERROR 9.3 ms ttl=318 35.190.14.201 (2nd query TTL 17: served from cache) |
| Quad9 NOERROR 15.7 ms ttl=530 35.190.14.201 (2nd query TTL 230: served from cache) | Quad9 NOERROR 14.4 ms ttl=582 35.190.14.201 (2nd query TTL 582: unchanged) |
| |
| nginx.com -> identical | nginx.com -> identical |
| Google NOERROR 10.5 ms ttl=67 159.60.134.0 | Google NOERROR 11.9 ms ttl=123 159.60.134.0 (2nd query TTL 123: unchanged) |
| Cloudflare NOERROR 9.4 ms ttl=349 159.60.134.0 (2nd query TTL 87: served from cache) | Cloudflare NOERROR 10.4 ms ttl=299 159.60.134.0 |
| Quad9 NOERROR 15.1 ms ttl=106 159.60.134.0 | Quad9 NOERROR 16.0 ms ttl=101 159.60.134.0 |
| |
| wordpress.com -> identical | wordpress.com -> identical |
| Google NOERROR 11.0 ms ttl=126 192.0.78.17, 192.0.78.9 | Google NOERROR 9.8 ms ttl=95 192.0.78.17, 192.0.78.9 |
| Cloudflare NOERROR 11.5 ms ttl=68 192.0.78.17, 192.0.78.9 | Cloudflare NOERROR 10.6 ms ttl=51 192.0.78.17, 192.0.78.9 |
| Quad9 NOERROR 14.6 ms ttl=129 192.0.78.17, 192.0.78.9 (2nd query TTL 30: served from cache) | Quad9 NOERROR 16.4 ms ttl=209 192.0.78.17, 192.0.78.9 (2nd query TTL 12: served from cache) |
| |
| edgesuite.net -> no-A-record | edgesuite.net -> no-A-record |
| Google NOERROR 9.4 ms ttl=- (no A record) | Google NOERROR 13.0 ms ttl=- (no A record) |
| Cloudflare NOERROR 10.8 ms ttl=- (no A record) | Cloudflare NOERROR 10.5 ms ttl=- (no A record) |
| Quad9 NOERROR 14.8 ms ttl=- (no A record) | Quad9 NOERROR 15.1 ms ttl=- (no A record) |
| |
| workbox.dk -> no-A-record | workbox.dk -> no-A-record |
| Google NOERROR 12.0 ms ttl=- (no A record) | Google NOERROR 11.9 ms ttl=- (no A record) |
| Cloudflare NOERROR 18.0 ms ttl=- (no A record) | Cloudflare NOERROR 133.7 ms ttl=- (no A record) |
| Quad9 NOERROR 25.6 ms ttl=- (no A record) | Quad9 NOERROR 23.0 ms ttl=- (no A record) |
| |
| yandex.ru -> identical | yandex.ru -> identical |
| Google NOERROR 10.5 ms ttl=132 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 132: unchanged) | Google NOERROR 11.5 ms ttl=360 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 360: unchanged) |
| Cloudflare NOERROR 9.2 ms ttl=49 5.255.255.77, 77.88.44.55, 77.88.55.88 | Cloudflare NOERROR 10.9 ms ttl=521 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 285: served from cache) |
| Quad9 NOERROR 15.7 ms ttl=558 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 530: served from cache) | Quad9 NOERROR 15.2 ms ttl=227 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 95: served from cache) |
| |
| summary A: all 100 names | summary A: all 100 names |
| identical 46 46.0% | identical 46 46.0% |
| same-/24 1 1.0% | partial 19 19.0% |
| disjoint 28 28.0% | disjoint 10 10.0% |
| no-A-record 25 25.0% | no-A-record 25 25.0% |
| |
| summary B: the 75 names where at least two resolvers returned an address | summary B: the 75 names where at least two resolvers returned an address |
| identical 46 61.3% | identical 46 61.3% |
| same-/24 1 1.3% | partial 19 25.3% |
| disjoint 28 37.3% | disjoint 10 13.3% |
| | NOT identical 29 38.7% <- the headline: at least one resolver disagreed with another |
| |
| Summary B is the denominator to quote. Summary A mixes two different | Summary B is the denominator to quote. Summary A mixes two different |
| list has no address to disagree about. | list has no address to disagree about. |
| |
| 'disjoint' means no resolver returned an address any other resolver | 'disjoint' means NO PAIR of resolvers returned an address in common, and |
| returned. If your pipeline resolves names once, through one resolver, | no pair even shared a /24. 'partial' means some pair overlapped and some |
| that is the share of your dataset another resolver would have | pair did not. The number to quote for "how much does my choice of |
| disagreed with entirely -- from this vantage point, at this instant. | resolver matter" is NOT identical: that is the share of your name list |
| | where resolvers did not all agree -- from this vantage point, at this |
| | instant. 'disjoint' alone understates it; quoting 'disjoint' as though |
| | it meant "any disagreement" overstates it. |
| |
| wrote out/dns/resolver_run.json | wrote out/dns/resolver_run.json |
| </code> | </code> |
| |
| The 28 names with disjoint answers: | The names with fully disjoint answers, in the run below: |
| |
| <code> | <code> |
| 28 names | 10 names |
| google.com, gstatic.com, facebook.com, microsoft.com, googleapis.com | googleapis.com, youtube.com, googlevideo.com, googletagmanager.com |
| youtube.com, instagram.com, fbcdn.net, twitter.com, googlevideo.com | googleusercontent.com, appsflyersdk.com, goo.gl, tiktok.com, adobe.com |
| googletagmanager.com, wikipedia.org, whatsapp.net, googleusercontent.com | tiktokv.com |
| appsflyersdk.com, doubleclick.net, netflix.com, youtu.be, goo.gl, x.com | |
| tiktok.com, whatsapp.com, googlesyndication.com, adobe.com, wa.me, nginx.org | |
| tiktokv.com, blogspot.com | |
| </code> | </code> |
| |
| - **The seven lab-rig papers stay in the population.** They used a DNS-specific instrument, which is what the rule says. Removing them would make the rule a judgement. Publishing the count is the compromise. | - **The seven lab-rig papers stay in the population.** They used a DNS-specific instrument, which is what the rule says. Removing them would make the rule a judgement. Publishing the count is the compromise. |
| - **Posters (14 of 244) are not excluded.** The page's headline claims are not reporting-gap rates where poster brevity would bias the result upward; the vantage-location and version figures are, so the poster count is stated next to the population. | - **Posters (14 of 244) are not excluded.** The page's headline claims are not reporting-gap rates where poster brevity would bias the result upward; the vantage-location and version figures are, so the poster count is stated next to the population. |
| | - **Two rhetorical sentences were re-derived and one was wrong.** The draft said "IMC is where this work lives, by a factor of three over the next venue" (true: 13.2% vs 4.3%) and "if you read only the web-measurement venues you are reading the wrong 60%" (**unsupported**). Measuring it: TheWebConf and PoPETs together are **12.3%** of the 244 and IMC, USENIX Security and NDSS together are **70.1%**. The sentence now states those two figures, which ''report_dns.mjs'' section B derives so they are not hand arithmetic beside a table. |
| - **The 2010 Ager result leads failure mode 1 even though it is sixteen years old.** It is the cleanest statement of a property that has not changed, and the script's own run is the current evidence beside it. The page says both. | - **The 2010 Ager result leads failure mode 1 even though it is sixteen years old.** It is the cleanest statement of a property that has not changed, and the script's own run is the current evidence beside it. The page says both. |
| - **''security:tls_certificates'' was not edited.** [[design:automated_measurements]] routes "DNS" to that page and to [[design:ip_classification]]; both routings are now wrong. The parent's routing table was corrected to point here. The TLS page itself says nothing about DNS and needed no change. | - **''security:tls_certificates'' was not edited.** [[design:automated_measurements]] routes "DNS" to that page and to [[design:ip_classification]]; both routings are now wrong. The parent's routing table was corrected to point here. The TLS page itself says nothing about DNS and needed no change. |
| | [[provenance:design:dns]] | created (this page) | | | [[provenance:design:dns]] | created (this page) | |
| | [[literature:bibliography]] | **23** entries appended before ''%%</bibtex>%%'', from a fresh ''?do=export_raw''. Zero key collisions, zero DOI collisions, zero URL collisions, zero title collisions against the 632 live entries. Cache purged afterwards; the page renders **29** references against **29** distinct citekeys with no unresolved warnings. | | | [[literature:bibliography]] | **23** entries appended before ''%%</bibtex>%%'', from a fresh ''?do=export_raw''. Zero key collisions, zero DOI collisions, zero URL collisions, zero title collisions against the 632 live entries. Cache purged afterwards; the page renders **29** references against **29** distinct citekeys with no unresolved warnings. | |
| | [[design]] | DNS row added to the namespace table and the page count corrected | | | [[:design]] | DNS row added to the namespace table and the page count corrected | |
| | [[design:automated_measurements]] | the scan row of the routing table now points at [[design:dns]] for DNS rather than at the TLS and IP pages | | | [[design:automated_measurements]] | the scan row of the routing table now points at [[design:dns]] for DNS rather than at the TLS and IP pages | |
| |
| ===== Review log ===== | ===== Review log ===== |
| |
| Reviews had not been run when this page was first assembled. If you are reading this sentence on the live wiki, the review pass did not happen and the page should be treated accordingly. | Five review passes plus three rounds of self-review. Each reviewer was told explicitly that the author's context |
| | may not be exhaustive, and each was handed the page text, the report script and |
| | its unedited output, the fold, the quote checker and the external checks. |
| | |
| | **Snapshots.** The three focused passes all read the same frozen snapshot, |
| | ''out/dns/review/frozen_design_dns.txt'' (48,440 bytes, the page as published at |
| | revision 1787870384) and ''out/dns/review/frozen_provenance.txt''. Two rounds of |
| | **self-review** corrections were applied to the live page while they were |
| | running (revisions 1787870940 and 1787871092), so a reviewer reporting one of |
| | those is reporting something already fixed — the table below says which. |
| | |
| | ==== Self-review, before the reviewers reported ==== |
| | |
| | Found by re-deriving the page's own framing sentences rather than its tables, |
| | which is where the site's history says unmeasured claims hide. |
| | |
| | ^ Found ^ Verdict ^ |
| | | "if you read only the web-measurement venues you are reading the wrong 60%" — **unsupported**, invented while writing | Fixed. Measured: TheWebConf and PoPETs together are 12.3% of the 244; IMC, USENIX Security and NDSS together are 70.1%. Both are now derived by ''report_dns.mjs'' section B rather than being hand arithmetic beside a table. | |
| | | "the amplification literature in this corpus is large and consistent" — **unmeasured** | Fixed. 58 of 244 match an amplification/reflection probe; 15 say so in the title. Both now printed by the report. | |
| | | "the DNS population is somewhat more ethics-forthcoming than the corpus average" — a comparison with no comparison printed, and **false on one of the four fields** | Fixed. The ethics table now carries the whole-corpus column beside the DNS column, and the sentence says explicitly that ''reviewOutcome'' is **lower** (29.9% vs 33.8%) while the other three are higher. | |
| | | "most papers here answer fewer than half" of the eight-item methods checklist — the schema has a field for only two of the eight | Fixed. The page now says the extraction can measure two of the eight, gives those two rates, and calls the list a standard rather than a measurement. | |
| | | "the single most cited reason a web crawl needs a resolution step" — an unmeasured superlative | Fixed, reworded to a claim about what a request-level measurement cannot see. | |
| | | ''"Miek Gieben's DNS implementation"'' was folding into home-grown code when it is ''miekg/dns'', the Go library | Fixed in ''dns_fold.mjs''; home-grown 35→**34** papers, DNS libraries 15→**16**. The page's home-grown claim was reworded from a clean "35 distinct strings for 35 papers" to "34 distinct strings, only two of them shared, and both of those generic". | |
| | | "Seven of those papers use the software as part of an attack rig" sat under the **resolver-software** ranking, but only **six** of the seven lab-rig papers are in that family — the seventh is a DNSSEC-tool case. A figure that is right about the hand map and wrong about the section it is printed in. | Fixed. The sentence now says six, notes that all six are ''dnsmasq'', and points at the seventh separately. | |
| | | "Both of those slices are provisional years" about the LLM counts 0/0/3/5/8 — the **5** is 2022–2024, which is not provisional | Fixed. Only the 8 is in the provisional window, and the page now says so and says the growth rests on the thinnest years. | |
| | |
| | ==== Pass 1 — citations and quotes (sonnet) ==== |
| | |
| | ^ Finding ^ Verdict ^ |
| | | **The 73% in Nisenoff et al. is real.** This run had removed it after failing to find it in ''paper.cols.txt'' (the only "73" near "heard of DNS" there is the string "Firefox 73"). The reviewer said it was in the paper. | **Accepted — and it exposed a checker bug.** A ''pypdf'' re-extraction has //"73% of all participants reported having heard of DNS before the survey"// verbatim; it is absent from ''.cols'' entirely. The figure is back on the page as a quote, and ''verify_dns_figures.mjs'' now falls back to ''pypdf'' for any needle that misses against ''.cols'' and labels the route. 31 needles, 30 ''.cols'', **1 PDF-only**. Without this the quote check was one rendering away from a false negative on every quote it examined. | |
| | | Five papers are in ''literature:bibliography'' **twice under two keys** — ''fouad2022my''/''fouad2022_cookie'' and ''ahmad2026_ipfp''/''ahmad2026_more'' share a DOI, ''bottger2025_regional''/''boettger2025_regional'' likewise, plus ''lerner2016internet''/''lerner2016_internet'' and ''bouhoula2024automated''/''bouhoula2024_automated'' | **Accepted, out of scope, recorded.** None is cited by this page and all predate it. Filed as the ''dedup-bibliography-duplicate-papers'' work item with the fix and with the observation that a key-string collision check passes on all five — only a DOI and normalised-title scan finds them. | |
| | | ZDNS's two throughput figures come from the same external-resolver sentence (not mixed with the paper's separate internal-recursion figures); Iris's four figures share one sentence; Liu et al.'s two share the abstract sentence; CERTainty's three are correctly kept apart; Siby's 95% (resolver) is correctly not paired with the paper's 100% (client) | Confirmations, no change. These are exactly the numerator/denominator and mirror-image traps the pass was asked to hunt, and the reviewer checked each. | |
| | | ''dao2021_cname'' and ''dimova2021cname'' are two different CNAME-cloaking papers, correctly presented as such | Confirmation, no change. | |
| | | All 29 citekeys resolve; no key, DOI, title or URL collision between the 23 new entries and the 632 pre-existing ones; all ~20 prose attributions and 8 table attributions match their entry's author field; 15 entries spot-checked against Crossref and the venue landing pages | Confirmations, no change. | |
| | |
| | **Declared not checked by this pass:** the fold counts and the venue/year corpus |
| | tables (out of scope for a citations review), and most of the non-paper external |
| | figures beyond the four it re-fetched. |
| | |
| | ==== Pass 2 — figures against the script (sonnet) ==== |
| | |
| | ^ Finding ^ Verdict ^ |
| | | **The published script's ''verdict()'' was wrong, and the page's headline number with it.** It intersected **all** answering resolvers' address sets at once, so with three resolvers, two agreeing exactly and a third differing produced an empty three-way intersection and fell through to ''disjoint'' — contradicting the definition the script prints in its own output and the page repeats. On the committed 100-name run, **17 of the 28** names labelled disjoint had two of three resolvers returning byte-identical addresses. | **Accepted; the most serious finding of the run.** Reproduced independently from the committed JSON before changing anything. ''verdict()'' is now pairwise, with a ''partial'' verdict between ''identical'' and ''disjoint'' and a ''one-answered'' verdict for the case where exactly one resolver returns an address; ''%%--self-test%%'' checks ten cases including ''facebook.com'' and ''wikipedia.org'' from the run that caught it. The measurement was re-run; the page's headline is now **not identical, 29 of 75 (38.7%)**, replacing the published 28 / 37.3%. Per-verdict counts are deliberately not restated here — they are in the run output on this page, and see pass 5 for why the split between ''partial'' and ''disjoint'' is not a stable quantity. The page now says in the open that the first version was wrong and what it got wrong. | |
| | | **"All 7 uses [of fpdns] are pre-2024" is false** — 1 in 2018, 3 in 2023, **3 in 2024**. | Accepted. Reproduced. The row now gives the year breakdown and says what the recent uses are for. The report prints per-year and per-spelling detail for every family the page describes in prose, so this class of sentence is checkable. | |
| | | **''bhaskar2022_many'' does not use RIPE Atlas.** The page said two papers were built on it and named this one; its tools are BreadCrumb, Censys, MaxMind and Go, and its vantage record says //"we send DNS packets from an external measurement vantage point"//. | Accepted, reproduced from the paper's own record. Replaced with four papers that do use it ({[randall2021_home]}, {[moura2019_cache]}, {[aldalky2019_look]}, {[randall2020_trufflehunter]}), and the page now says explicitly that Bhaskar and Pearce do **not** — which is the point, since controlling their own source address is what their result depends on. | |
| | | The DNSViz row was 3 papers, but only **2** use DNSViz; the third is a 2014 use of the //Extended DNSSEC Validator// Firefox extension, and the row printed DNSViz's currency for all three. | Accepted. Row is now 2, with the third named and explained. | |
| | | The **16 LLM papers / 0-0-3-5-8** figure was attributed to ''report_dns.mjs'', which contained no such probe — the regex existed only as prose. And the regex is **case-sensitive**, which is load-bearing: case-insensitively it gives 19 papers and 0/0/3/7/9. | Accepted. The probe is now a section of ''report_dns.mjs'' which prints the regex, both counts, and the list of matching papers; the page says the probe is case-sensitive and gives the case-insensitive contrast. | |
| | | ''dnscrypt-proxy'' 2.1.18 / 2026-07-18 was attributed to ''external_checks_dns.sh'', which did not check that repository. | Accepted. Added to the repository list; the figure is now reproducible from the named script. | |
| | | The ''dig'' family label said "/ host" but **no paper in the corpus names ''host(1)''** — the only "host" string is one paper's own "host name matching tool". | Accepted. Family relabelled to ''dig / drill / nslookup / tor-resolve'' in the fold and on the page, with the spelling breakdown given. | |
| | | ''query()'' called ''settimeout()'' once outside the receive loop, so the timeout restarted on every datagram: a stream of unrelated packets could keep one query alive far past ''%%--timeout%%''. A bad property for a script whose subject is off-path packets. | Accepted. The timeout is now a total deadline recomputed per iteration. Tested against a blackholed resolver: it fails at the stated timeout. | |
| | | Reviewer could not confirm the run is a genuine measurement against the real public resolvers, citing TTLs that rise between a query and its immediate repeat. | **Rejected, with the reason recorded.** A rising TTL on a repeat is ordinary anycast behaviour — the two queries reach different instances of the same public resolver, with independently warmed caches — and it is visible in the run in both directions. The answers are independently checkable and check out (''example.com'' on Cloudflare addresses, three distinct Google ranges for ''gstatic.com'', Akamai returning different addresses per resolver), the per-resolver RTTs are stably ordered across 100 names, and a query to a blackholed address times out rather than returning fabricated data. The caveat is nonetheless worth having on the record, and the page already frames the run as "one machine, one instant" rather than as a claim about the Internet. | |
| | | Confirmations: no drift between the committed outputs and a fresh run of all three scripts; the ''%%<file>%%'' and ''%%<code>%%'' blocks round-trip exactly; every population, venue, year, instrument-family, ethics, reporting-gap and encrypted-DNS figure traces; the poster count, robots.txt rate and fold residue check out; all 30 per-paper figures trace to their sources. | No change. | |
| | |
| | ==== Pass 3 — external currency (sonnet) ==== |
| | |
| | Every finding below was **re-verified independently** before being acted on, because a currency claim is exactly the kind a reviewer can get wrong from memory. |
| | |
| | ^ Finding ^ Verdict ^ |
| | | The DDR "frontier" framing is already contested: **//The Illusion of DDR Deployment//, Nosyk, Duda and Korczyński, ANRW 2026**, argues that resolvers scored as misconfigured DDR are in many cases transparent forwarders. | **Accepted.** Verified against the Crossref record for ''10.1145/3822163.3827932'' — title, all three authors, //Proceedings of the 2026 Applied Networking Research Workshop//, published 2026-07-20. ANRW is not in the corpus, so the "one paper in this corpus" claim stays true, but the page now says the 99% figure's interpretation is disputed and names the paper. The full text is behind an ACM 403 from this host and the page says the characterisation rests on metadata, not on a reading. | |
| | | **"''miekg/dns'' … no tagged releases (pin a commit, not a tag)" is wrong.** The repo publishes no GitHub //Release// objects but does publish semver git tags. | **Accepted.** Verified two ways: ''api.github.com/repos/miekg/dns/tags'' returns ''v1.1.73'' … ''v1.1.68'', and ''proxy.golang.org/github.com/miekg/dns/@latest'' returns ''v1.1.73'', 2026-08-19. The page's own advice would have made a reader's pin **worse**. Corrected, and the distinction between a Release object and a tag is now stated so the next check does not repeat it. | |
| | | **"Android's Private DNS is DoT" is stale.** Since a July 2022 Google Play system update, Android 11+ uses DoH3 for well-known providers. | **Accepted.** Verified against Google's own Security Blog post, fetched and the sentence re-read: //"Android devices from Android 11 onwards will use DoH3 instead of DoT for well-known DNS servers which support it"//. The DoT row now says this, notes DoH3 is neither DoT nor RFC 9250 DoQ, and the check is in ''external_checks_dns.sh''. | |
| | | **RFC 9539** (encrypted **recursive-to-authoritative** DNS, Experimental, Feb 2024) was in the run's own RFC dump and never reached the page. It is a different trust boundary from everything in the protocol table. | **Accepted.** The page now has a paragraph saying the table covers only the stub-to-recursive hop, and that "we measured encrypted DNS" must say which hop. | |
| | | Several 2023–2026 DNS RFCs a "what is current" page should name are missing: **9953** (DNS over CoAP, March 2026), 9460 (SVCB/HTTPS RR), 9567 (DNS Error Reporting), 9520 (negative caching of failures), 9606 (RESINFO), 9848 (ECH bootstrap). | **Partly accepted.** All six verified against the RFC Editor index and added to the external check. **RFC 9953 (DoC) is now a row in the protocol table** with a zero corpus count, because omitting a five-month-old standardised transport from a table headed "what is actually current" is the exact failure this page is about. The other four were **not** added: 9460, 9567, 9520 and 9606 are real and relevant but each would need its own measurement-facing paragraph, and adding six RFC numbers without them would be a reading list, not guidance. Recorded here as the honest reason rather than as an oversight. | |
| | | **''opendata.rapid7.com'' 301s to ''sonardata.rapid7.com''** for every path, including both dataset directories the page cites. | **Accepted.** Verified with ''curl -L -w %{url_effective}'' on three paths. The substantive claim (data still current, updated 2026-08-23 / 2026-08-26) was unchanged. The page now names the new host and the check prints the redirect target. | |
| | | iCloud Private Relay is the largest real-world ODoH deployment, so "not a deployed default" understates it. | **Rejected.** The reviewer's support is a third-party DFIR blog. Apple's own //iCloud Private Relay Overview// PDF 404s and the relevant Apple documentation pages render client-side, so **no primary source for "Private Relay uses ODoH" could be fetched**. Under this project's rule that a load-bearing industry claim needs a primary source, it is not going on the page. If someone finds an Apple document that says it, this is worth adding — it would materially change how the ODoH row reads. | |
| | | Apple's ''DNSSettings'' MDM profile and Windows Server 2025 DoH GA are coverage gaps. | **Rejected as out of scope.** Neither is a wrong claim on the page. The Apple docs page renders client-side and could not be read; the Windows claim was supported by search results rather than a Microsoft document the reviewer fetched. A page about measuring DNS does not need an enterprise-deployment survey. | |
| | | Confirmations: all ten RFC statuses and dates the page names, every tool version, the Farsight domain failing to resolve, the Firefox prefs and the five DoH provider records, and every URL except ''data.caida.org'' (401, already disclosed). | No change. | |
| | |
| | ==== Self-review, round three (after applying passes 1–3) ==== |
| | |
| | ^ Found ^ Verdict ^ |
| | | The DDR tip box's **lead sentence** still said "the one paper that looked says the deployment is broken" while the rest of the box explained that the finding is contested. That is the exact pattern this site's history warns about: the careful version survives three paragraphs down, the prominent sentence loses the hedge. | Fixed. The box now leads with "what it measures is unsettled". | |
| | | The box's footnote credited "the authors' own public write-up" without that write-up having been fetched. | Fixed by fetching it. The APNIC post (Nosyk, 2 September 2025, with Duda and Korczyński) is a better source than the ACM-403 paper and gives quotable figures: //"over 321k DDR-enabled open resolvers"//, Google at 80.8%, top five at 97.4%. Five needles from it are now checked by ''external_checks_dns.sh''. The box also makes the venue point that follows: DDR work in 2025–2026 is in PoPETs, at ANRW and on an operator blog, and this corpus contains **one** of the three. | |
| | | The code-block builder pinned its example to ''google.com''; on the re-run ''google.com'' came back ''partial'' and the block would have illustrated the wrong verdict under a "disjoint" heading. | Fixed before it shipped: the builder now selects the first stanza whose verdict is ''disjoint'', and the page states that rule. | |
| | |
| | ==== Pass 4 — figures re-check, after the fixes (sonnet, re-run of pass 2) ==== |
| | |
| | The pass-2 reviewer was re-run against the corrected page and scripts, as the workflow requires for any reviewer whose findings were acted on. |
| | |
| | ^ Finding ^ Verdict ^ |
| | | **The ''NON_PAPER_FIGURES'' ledger in ''verify_dns_figures.mjs'' was stale in three places, left behind by the very fixes it was checking** — it still said "84 self-tests" (now 85), "35/35 home-grown" (now 34/34), and "28 / 75 / … / 37.3%" for the resolver run, which are the **pre-fix, retracted** verdict numbers. No check broke, because the correct values were independently present via the report; but a ledger whose entire purpose is "which artefact backs this figure" was pointing a future auditor at withdrawn ones. | **Accepted, and fixed at the root rather than patched.** The block now lists **where** each non-corpus figure comes from and never restates its value: a pointer cannot go stale, a copy always will. Two figures then failed the whole-page guard because their values were no longer duplicated anywhere — which is the guard doing its job. The ''robots.txt'' rate is now **derived by ''report_dns.mjs''** instead of being lifted from ''OVERVIEW.md'' (a file the guard does not read), and the ''dnsdb.info'' A record was **removed from the page**: it rotated from ''104.244.14.71'' to ''104.244.14.64'' between two runs an hour apart, which is a poor thing to pin on a page about resolver-dependent answers. | |
| | | **The Rapid7 guard's audit table claimed "all ten tuples were read" when the candidate regex matches 13 tuples under 11 spellings.** The missing row is IMC 2016 //Entropy/IP//, tool name ''"Forward DNS dataset"''. It is classified correctly and the family count (8 papers) is right — but the table was not exhaustive while saying it was. | **Accepted.** Reproduced against the raw extraction: 13 tuples, 11 spellings. The provenance table now has all 13 rows, marks the two rows that cover two tuples each, and the count is corrected in the fold comment, the report comment and the prose. This is the review layer catching an **overstatement of the page's own rigour**, which is exactly what the provenance page is most at risk of. | |
| | | ''verdict()'' fix confirmed correct and complete: 10/10 self-tests, and an independent re-implementation of the documented definitions reclassified all 100 names in the committed JSON with **zero mismatches** (46 / 21 / 8 / 25, 29 of 75 = 38.7%). ''one-answered'' and ''insufficient'' are reachable and simply do not occur in this run. | No change. | |
| | | Total-deadline fix confirmed: ''deadline'' is set once and ''remaining'' recomputed per iteration; a live query to a blackholed TEST-NET-1 address returned at **2.009 s** against a 2.0 s timeout with a useful error string. | No change. | |
| | | Population confirmed unmoved by all four fold edits: A=108, B=202, A∩B=66, **DNSPOP=244**. Every page figure matches a fresh script run; ''%%<file>%%'' and ''%%<code>%%'' blocks round-trip byte-for-byte; the code block's example is confirmed the first ''disjoint'' stanza in the current run. | No change. | |
| | | The ''frozen2'' snapshots no longer match the live page, because self-review round three was applied after they were taken. | Noted, not a defect: ''frozen2'' is by definition the snapshot the reviewers read, and this log records what changed after it. Flagged here so nobody later cites ''frozen2'' as canonical. | |
| | |
| | ==== Pass 5 — generic, no checklist (fable) ==== |
| | |
| | Read the ''frozen2'' snapshots. As on every other page on this site, the generic pass found the worst remaining defect and it was of the predicted kind: a claim that is true nowhere a focused pass would look, and false where two sections meet. |
| | |
| | ^ Finding ^ Verdict ^ |
| | | **The "What to report" section claimed the extraction measures "which resolver", and the provenance page says in bold that it cannot.** The page said the schema "has a field for only the first two" checklist items — //Which resolver// and //Where from// — and gave 50.8% and 42.2%. Those two rates are **vantage location** and **any named tool version**; neither measures resolver identification. A reader would have cited "42.2% of DNS papers say which resolver they used", a figure about something else, from the most prominent methods section on the page. | **Accepted; the most serious finding of this pass.** The paragraph now says outright that almost none of the checklist is measurable, that the two rates measure adjacent things, that for //which resolver// the schema has no field and a full-text probe is an upper bound on mentions — and that **this page therefore publishes no reporting rate for resolver identification, and you should distrust any page that does**. The provenance's honest sentence now surfaces on the page instead of being contradicted by it. | |
| | | **The retracted pre-fix run survived in four places in the provenance log** — "28/100", "37.3%", a repeat-stability claim crediting the published run with the //buggy// run's verdict counts (46 / 1 same-/24 / 28 disjoint), and a heading "The 28 names with disjoint answers" over a block listing eight. | **Accepted.** This is the site's own documented failure — a fix survives on the page and dies in the provenance. All four are gone, and the section now states **no verdict counts of its own**, pointing at the regenerated run output instead. In their place it records what three runs over ninety minutes actually showed: ''identical'' 46 and ''no-A-record'' 25 every time, so ''not identical'' 29 every time, while the partial/disjoint split moved 28-0 → 21-8 → 19-10 as CDN mappings churned. **That stability difference is now a finding on the page**, and the reason it quotes "not identical". | |
| | | The ''NON_PAPER_FIGURES'' ledger and the ''dnsdb.info'' IP (also raised by pass 4). | Already fixed between the frozen2 snapshot and this report; see pass 4. | |
| | | **The DoC row's "0 / 0 / 0 / 0 / 0" was asserted, not probed.** Section G had no CoAP probe. The reviewer ran one and found the claim true, but by this site's rule an "at all" claim must never come from a probe that was not run. | **Accepted.** DoC and a bare-CoAP contrast row are now in section G. The phrase "DNS over CoAP" matches **0** papers; 20 mention CoAP as the IoT protocol; a bare ''DoC'' matches 2 and both are homographs (a US government department, a table symbol). The row now says the zero is a run probe and shows its working. | |
| | | **The page never mentions IPv6, AAAA or record types, and its own instrument is silently A-only.** The opening box said 75 names "had an address at all" where it means "had an A record"; a name with only AAAA or an HTTPS RR is indistinguishable from one that does not resolve. | **Accepted — a real content gap, not just wording.** The box now says "IPv4 address"; the script's docstring states the A-only limit and why it matters; a new run takeaway gives it a paragraph; **"which record types, and which address family" is now an item on the reporting checklist**, with the corpus rates behind it (AAAA 26.6%, CNAME 30.7%, SVCB/HTTPS 3.3% of the 244 — dual-stack is the minority practice here). Section G2 of the report prints them. | |
| | | **The published script ignores the TC bit.** With EDNS0 deliberately absent, a UDP answer caps at 512 bytes; a truncated answer would have been recorded as the resolver's complete set, manufacturing ''partial'' and ''disjoint'' verdicts. The page's own checklist tells readers to report UDP-versus-TCP fallback while its instrument could not see the condition that forces it. | **Accepted.** ''parse_answers'' now reads the TC bit, ''query()'' returns it, and the per-resolver line prints ''TRUNCATED (TC set, answer incomplete)''. The docstring explains why the script flags rather than retries. Zero truncations in the published run — but that is now a measured zero. The checklist item gained the TC question and the corpus rate (9.0% of the 244 mention truncation or TCP fallback at all). | |
| | | ''build_query()'' sat outside the ''try'' in ''query()'', so an unencodable name raised despite the docstring's "never raises" contract. | Accepted, moved inside, tested with an IDN. | |
| | | Cloudflare's 12.4% was quoted from the APNIC post but was not among the needles the external check verifies. | Accepted; it is now the fifth of six APNIC needles and passes. | |
| | | Files table said ''verify_dns_figures.mjs'' checks 29 needles; it checks 31. | Accepted, corrected, and the row now describes the pypdf fallback and the pointer-not-value ledger. | |
| | | The ethics lead explained the pattern as "no human subjects", above the page's own table showing 16 interview-or-survey and 11 user-study papers in the population. | Accepted. Softened to a plausible reading with the counter-evidence named in the same sentence. | |
| | | Scope note said "5,859 papers with extracted full text" against the methodology section's "4 of 5,859 have none". | Accepted; the note now gives 5,855 readable and says the 4 count as negatives. | |
| | | Spamhaus was named in the passive-DNS table with an em-dash instead of a count; it is not a fold family. | Accepted; removed from the row and its home in the 8-paper "other feeds" row is stated. | |
| | | "15 of them say so in the title" — the report says title **or slug**. | Accepted, corrected. | |
| | | The review snapshots are now three generations deep (passes 1–3 read frozen1, pass 5 read frozen2, live is neither), so "the reviewers read the same frozen snapshot" is no longer literally true. | **Accepted as a process finding.** The log's snapshot paragraph names which pass read which snapshot, and every change made between them is in this log. Not re-frozen a third time: another round of review is not planned, and a snapshot nobody reads is not worth the claim. | |
| | | A parked/sentinel A record (''domaincontrol.com'' → 127.0.0.1 from all three) counts as "identical" agreement. | **Rejected as a page change, recorded as a limit.** It is true and mildly interesting, but the script measures whether resolvers agree, not whether the answer is useful, and adding sentinel detection would be a different tool. Noted here so the next person does not rediscover it as a bug. | |
| |
| ===== Files ===== | ===== Files ===== |
| |
| ^ Path ^ What ^ | ^ Path ^ What ^ |
| | ''scripts/dns_fold.mjs'' | The fold. Ordered families, keyed exceptions, one guarded family (Rapid7), 84 self-tests, residue printed by the report. | | | ''scripts/dns_fold.mjs'' | The fold. Ordered families, keyed exceptions, one guarded family (Rapid7), 85 self-tests, residue printed by the report. | |
| | ''scripts/report_dns.mjs'' | Every corpus figure with its denominator. Exits 1 if the corpus contracts or the fold self-tests fail. ''%%--list%%'' ''a|b|bonly|aonly|pop|web'', ''%%--quotes <re>%%''. | | | ''scripts/report_dns.mjs'' | Every corpus figure with its denominator. Exits 1 if the corpus contracts or the fold self-tests fail. ''%%--list%%'' ''a|b|bonly|aonly|pop|web'', ''%%--quotes <re>%%''. | |
| | ''scripts/verify_dns_figures.mjs'' | 29 per-paper needles against ''paper.cols.txt'', plus the non-corpus figure blocks and the normalisation record. | | | ''scripts/verify_dns_figures.mjs'' | 31 per-paper needles against ''paper.cols.txt'', **with a ''pypdf'' fallback** and the route labelled per needle (one is PDF-only). Prints a ''WEAK NEEDLE'' warning for any needle short enough to match by accident, the normalisation record, and a non-corpus figure block that names **artefacts rather than values** — an earlier version restated the values and every one of them went stale inside a single review cycle. | |
| | ''scripts/external_checks_dns.sh'' + ''scripts/dnschk/'' | Every external fact, re-runnable. | | | ''scripts/external_checks_dns.sh'' + ''scripts/dnschk/'' | Every external fact, re-runnable. | |
| | ''scripts/dns_snip.mjs'' | Prints the sentence around a regex in a paper, whitespace collapsed. How the quote rewrites above were made. | | | ''scripts/dns_snip.mjs'' | Prints the sentence around a regex in a paper, whitespace collapsed. How the quote rewrites above were made. | |
