provenance:design:dns
This is an old revision of the document!
Table of Contents
Provenance: Design:DNS
Working notes behind dns: every query, every fold, every quote check, every external fetch, and every call that could reasonably have gone the other way. Corpus-level caveats — the venue funnel, the 2025–2026 provisional years, the extraction's own stability — are on corpus and are not restated here.
This page is a log, not prose. It is for someone checking a number.
The run
| Date | 2026-08-27 |
| Corpus | data/extract/run1/extractions.jsonl, 5,859 papers, 7 venues, 2010–2026 |
| Content page | dns, created 2026-08-27 |
| Report script | scripts/report_dns.mjs |
| Fold | scripts/dns_fold.mjs (84 self-tests) |
| Figure/quote check | scripts/verify_dns_figures.mjs |
| External checks | scripts/external_checks_dns.sh + scripts/dnschk/*.py |
| Published code | pages/resolver_disagreement.py |
| Code-block builder | scripts/build_dns_codeblock.mjs |
| Author | Claude (Opus 5), single sitting, unsupervised |
| Reviewers | see Review log |
The population rule, written before any figure
The rule was fixed before the first count, because a curated set whose boundary is decided after the tables exist re-derives every table on the first awkward find.
- A — DNS is the subject.
titleorslugmatches /\bdns(?:sec)?\b|\bdns-over-|\bdoh\b|\bnxdomain\b|\bodoh\b|\bdoq\b|\bopendns\b|\bzdns\b|\bmassdns\b|\bresolver/i - B — DNS is the instrument. The paper has a
tools[]entry withusedOrMentionedin {used,produced} whose name the fold maps to a kind inDNS_KINDS= {query-tool,passive-dns,resolver-software,public-resolver,dnssec-tool,open-resolver-census,custom}. - DNSPOP = A ∪ B. This is the page's population.
- C — ambient. Full text matches /\bDNS(?:SEC)?\b/. Reported as an upper bound; never used as a denominator for a claim about DNS research.
- WEB = DNSPOP ∩
platformscontainsweb.
Deliberately excluded from B, and why:
| Excluded | Papers (corpus-wide) | Why not membership |
|---|---|---|
ZMap / XMap / ZGrab / Scapy (scanner-generic) | 156 | General-purpose scanners. ZMap finds open resolvers, but a ZMap paper is not a DNS paper. Reported in a separate row on the page. |
RIPE Atlas (vantage-platform) | 77 | A vantage network with many measurement types; most of the 77 use it for traceroute. Named on the page as the standard multi-vantage route, not counted as membership. |
WHOIS / RDAP / PSL / tldextract (adjacent:registry-metadata) | 113 + 52 + 4 | Registry questions (“who owns this name”, “where does the registrable domain end”), not resolution questions. Already covered by website_classification and ip_classification. |
| Domain categorisation services, registrar APIs, DGA string analysis, dnstwist, mDNS, RIPE IPmap | 11 + 7 + 4 + 3 + 1 + 1 | Adjacent by name only. Each has its own adjacent: family so the exclusion is countable rather than silent. |
| Off-topic homographs | see fold residue below | Speech recognition (50), lab hardware (46), ATLAS.ti (21), blocklists (18+2+2), ML models (13), NLP taggers (6), MongoDB Atlas (1), Graphviz DOT (1) |
Every figure on the page and where it comes from
The rule is that scripts/report_dns.mjs prints every corpus figure with its denominator, scripts/verify_dns_figures.mjs prints every per-paper figure with the needle it was checked against, scripts/external_checks_dns.sh prints every external fact with the command that produced it, and out/dns/resolver_run.txt is the script run. node scripts/check_page_numbers.mjs pages/design_dns.txt out/dns/allsources.txt over the whole page (no section window) reports:
OK — every figure in the page traces to out/dns/allsources.txt
Report script, unedited output
=== design:dns — every figure with its denominator ===
corpus 5859 papers, 7 venues, 2010–2026. Contracts: OK.
dns_fold self-tests: 84/84 pass.
--- A. POPULATION ---
A DNS in title/slug 108
B used/produced a DNS instrument 202
A ∩ B 66
A only (subject, no DNS tool named) 42
B only (instrument, not titled) 136
DNSPOP = A ∪ B 244 <- the page's population
of which posters 14
lab-rig instrument uses (hand-read, stay in the population) 7
C full text matches /\bDNS(SEC)?\b/ 1218 (20.8% of 5855 readable) — UPPER BOUND, not the population
full text missing for 4 papers
WEB DNSPOP ∩ platform 'web' 82 (33.6% of DNSPOP; 5.1% of the 1622 web-platform papers)
DNSPOP ∩ crawled 44
DNSPOP ∩ network-scan-or-probe 186
--- B. WHERE DNS WORK PUBLISHES (share of that venue's own output) ---
venue papers DNSPOP share A(titled) share
CCS 990 26 2.6% 13 1.3%
IEEE-SP 767 17 2.2% 6 0.8%
IMC 638 84 13.2% 40 6.3%
NDSS 701 26 3.7% 7 1.0%
PETS 510 14 2.7% 7 1.4%
USENIX 1410 61 4.3% 28 2.0%
WWW 843 16 1.9% 7 0.8%
share of DNSPOP in {IMC}: 84 / 244 = 34.4%
share of DNSPOP in {IMC, USENIX, NDSS}: 171 / 244 = 70.1%
share of DNSPOP in {WWW, PETS}: 30 / 244 = 12.3%
share of DNSPOP in {CCS, IEEE-SP}: 43 / 244 = 17.6%
--- C. OVER TIME (both ends bounded; 2025–2026 provisional) ---
window papers DNSPOP share A(titled) share
2010–2013 511 16 3.1% 8 1.6%
2014–2017 769 39 5.1% 13 1.7%
2018–2021 1439 76 5.3% 36 2.5%
2022–2024 1955 74 3.8% 33 1.7%
2025–2026* 1185 39 3.3% 18 1.5%
unbucketed years: 0
--- D. WHAT SHAPE THESE STUDIES ARE (denominator: DNSPOP) ---
studyTypes (multi-valued; the least stable field in the schema — ranking only), N=244
186 76.2% network-scan-or-probe
146 59.8% existing-dataset-analysis
108 44.3% system-or-defence-proposal
83 34.0% manual-audit
52 21.3% code-or-binary-analysis
40 16.4% automated-web-crawl
16 6.6% interview-or-survey
14 5.7% mobile-app-analysis
11 4.5% user-study
7 2.9% simulation-or-theory-only
platforms (multi-valued), N=244
218 89.3% other-online-service
82 33.6% web
24 9.8% offline
21 8.6% mobile
9 3.7% iot
1 0.4% not-applicable
--- E. INSTRUMENT INVENTORY (denominator: DNSPOP unless stated) ---
[query-tool] union 60 papers corpus-wide, 60 of them in DNSPOP — IN population
18 papers 6 spellings dig / drill / nslookup / host
15 papers 12 spellings DNS libraries (dnspython, ldns, miekg/dns, getdns)
13 papers 2 spellings ZDNS
7 papers 1 spellings DNS fingerprinting (fpdns)
5 papers 2 spellings massdns
4 papers 4 spellings DoH/DoT client tooling
2 papers 2 spellings reverse-DNS lookup
[passive-dns] union 65 papers corpus-wide, 65 of them in DNSPOP — IN population
28 papers 16 spellings Farsight DNSDB / DomainTools (passive DNS)
14 papers 2 spellings OpenINTEL
8 papers 8 spellings other passive-DNS feeds
8 papers 7 spellings Rapid7 Open Data (FDNS/RDNS)
4 papers 5 spellings Chinese passive-DNS feeds (360, 114DNS)
3 papers 3 spellings zone files / CZDS
2 papers 2 spellings Active DNS Project
1 papers 1 spellings DNS Observatory
[resolver-software] union 62 papers corpus-wide, 62 of them in DNSPOP — IN population
29 papers 11 spellings BIND
25 papers 4 spellings Unbound
11 papers 2 spellings PowerDNS
9 papers 2 spellings dnsmasq
7 papers 2 spellings Knot
5 papers 2 spellings Microsoft DNS / Simple DNS Plus
5 papers 2 spellings NSD
3 papers 2 spellings MaraDNS
2 papers 1 spellings djbdns / dnscache
2 papers 2 spellings B-Root
2 papers 1 spellings CoreDNS
2 papers 3 spellings systemd-resolved
1 papers 1 spellings hnsd (Handshake)
1 papers 1 spellings gdnsd
[public-resolver] union 29 papers corpus-wide, 29 of them in DNSPOP — IN population
16 papers 6 spellings Google Public DNS
9 papers 1 spellings OpenDNS / Cisco Umbrella
6 papers 2 spellings Cloudflare DNS
5 papers 3 spellings other public resolvers (Comodo, CleanBrowsing, Quad9)
2 papers 1 spellings NextDNS
2 papers 2 spellings public-resolver lists
[dnssec-tool] union 3 papers corpus-wide, 3 of them in DNSPOP — IN population
3 papers 3 spellings DNSViz and DNSSEC validators
[open-resolver-census] union 1 papers corpus-wide, 1 of them in DNSPOP — IN population
1 papers 1 spellings Open Resolver Project
[custom] union 35 papers corpus-wide, 35 of them in DNSPOP — IN population
35 papers 35 spellings home-grown DNS code
[scanner-generic] union 156 papers corpus-wide, 38 of them in DNSPOP — reported only, NOT in the population rule
112 papers 13 spellings ZMap / XMap
33 papers 4 spellings Scapy
31 papers 6 spellings ZGrab
[vantage-platform] union 77 papers corpus-wide, 24 of them in DNSPOP — reported only, NOT in the population rule
77 papers 7 spellings RIPE Atlas
Sum of family paper counts is NOT the union: a paper naming BIND and Unbound is in both rows.
--- F. FOLD RESIDUE AND WHAT WAS DELIBERATELY EXCLUDED ---
candidate tool tuples matched by the loose sweep: 976
unmapped residue: 2 distinct strings, 2 tuples
1 "IEEE Organizationally Unique Identifier registry"
1 "Chrome DevTools Protocol Network domain"
mapped but excluded from the population rule (papers):
113 adjacent:registry-metadata — WHOIS / RDAP
112 scanner-generic — ZMap / XMap
77 vantage-platform — RIPE Atlas
52 adjacent:registry-metadata — Public Suffix List / TLD lists
50 offtopic:speech — speech recognition / synthesis
46 offtopic:hardware — lab hardware matching /dot|host|dig/
33 scanner-generic — Scapy
31 scanner-generic — ZGrab
21 offtopic:annotation — ATLAS.ti
18 offtopic:blocklist — domain blocklists
13 offtopic:ml — ML models matching /bind|nsd|dot/
11 adjacent:categorisation — domain categorisation services
7 adjacent:registrar — registrar and domain-shopping APIs
6 offtopic:nlp — part-of-speech tagging
4 adjacent:registry-metadata — DomainTools WHOIS archive
4 adjacent:name-analysis — domain-string analysis (DGA detection, shadowing)
3 adjacent:typosquatting — dnstwist
2 offtopic:blocklist — DNS-based lists (DNSBL / DNSEL)
2 adjacent:categorisation — OpenDNS/Umbrella as a categoriser
2 offtopic:blocklist — NextDNS blocklist
1 offtopic:misc — Graphviz DOT
1 adjacent:geolocation — RIPE IPmap
1 adjacent:mdns — multicast DNS
1 offtopic:database — MongoDB Atlas
1 offtopic:misc — hand-excluded homograph
--- G. ENCRYPTED DNS AND WHEN IT ARRIVED (denominator: whole corpus per bucket) ---
Full-text sweeps, paper-counted. These are UPPER BOUNDS on "the paper engages
with this": a single sentence in related work counts. Read them as arrival dates.
protocol 2010–2013 2014–2017 2018–2021 2022–2024 2025–2026* total
DoH (DNS-over-HTTPS) 0/510 0/768 30/1437 34/1955 18/1185 82
DoT (DNS-over-TLS) 0/510 0/768 27/1437 13/1955 7/1185 47
DoQ (DNS-over-QUIC) 0/510 0/768 4/1437 4/1955 2/1185 10
ODoH (Oblivious DoH) 0/510 0/768 7/1437 5/1955 2/1185 14
DDR (Discovery of Designated Resolvers) 0/510 0/768 0/1437 0/1955 1/1185 1
DNSSEC 7/510 25/768 51/1437 53/1955 25/1185 161
ECS (EDNS Client Subnet) 1/510 3/768 11/1437 3/1955 2/1185 20
DNSCurve / DNSCrypt 0/510 1/768 8/1437 2/1955 1/1185 12
Same sweeps restricted to DNSPOP (the papers that are actually about DNS):
protocol 2010–2013 2014–2017 2018–2021 2022–2024 2025–2026* total
DoH (DNS-over-HTTPS) 0/16 0/39 23/76 16/74 9/39 48
DoT (DNS-over-TLS) 0/16 0/39 23/76 7/74 4/39 34
DoQ (DNS-over-QUIC) 0/16 0/39 4/76 1/74 1/39 6
ODoH (Oblivious DoH) 0/16 0/39 5/76 4/74 2/39 11
DDR (Discovery of Designated Resolvers) 0/16 0/39 0/76 0/74 1/39 1
DNSSEC 3/16 12/39 36/76 37/74 16/39 104
ECS (EDNS Client Subnet) 1/16 2/39 9/76 3/74 1/39 16
DNSCurve / DNSCrypt 0/16 1/39 8/76 1/74 1/39 11
--- H. WHAT A DNS PAPER SAYS ABOUT ITS OWN METHOD ---
names a vantage location
DNSPOP 124 / 244 50.8%
A (titled) 63 / 108 58.3%
B-only (instrument) 61 / 136 44.9%
scan branch (network-scan-or-probe) 487 / 930 52.4%
crawled population 301 / 1120 26.9%
names any used/produced tool version
DNSPOP 103 / 244 42.2%
A (titled) 46 / 108 42.6%
B-only (instrument) 57 / 136 41.9%
scan branch (network-scan-or-probe) 401 / 930 43.1%
crawled population 506 / 1120 45.2%
states artifacts.availability (non-sentinel, non-none)
DNSPOP 124 / 244 50.8%
A (titled) 57 / 108 52.8%
B-only (instrument) 67 / 136 49.3%
scan branch (network-scan-or-probe) 511 / 930 54.9%
crawled population 721 / 1120 64.4%
vantage.locations, folded count of DISTINCT stated location strings per paper (DNSPOP):
0 (none stated) 120 49.2%
1 46 18.9%
2–3 40 16.4%
4–10 35 14.3%
>10 3 1.2%
ethics (denominator: DNSPOP ∩ empirical):
ethics.reviewOutcome 72 / 241 29.9%
ethics.harmMitigation 186 / 241 77.2%
ethics.notifiedAffectedParties 147 / 241 61.0%
ethics.regulatorContact 132 / 241 54.8%
--- I. MEASURED RESULTS IN THE POPULATION (detection[].prevalence) ---
DNS-named detection tuples carrying a numeric prevalence: 536 across 193 of 244 DNSPOP papers (79.1%).
prevalence is a MODEL SUMMARY of the paper's result, not a quote. Every figure
quoted on the page was re-checked against paper.cols.txt — see verify_dns_figures.mjs.
The fold
scripts/dns_fold.mjs. Ordered families, first match wins, keyed exceptions before the family that would swallow them. Three problems it exists to solve, all found by reading the strings rather than by guessing:
- A candidate sweep loose enough to catch the real instruments catches everything. It has to match
hnsd,ldns,resolvectl,miekg/dnsandgdnsd, and any regex that loose also matchesDeepSpeech(via /ech\b/),ImageBindandLanguageBind(/bind\b/),TransD(/nsd\b/),ATLAS.tiandMongoDB Atlas(/atlas/), every part-of-speech tagger, andGhost.py/CyberGhost VPN(/host\b/). Those get namedofftopic:families so the discard is a number, not a silence. - One brand, several products.
OpenDNSis a public resolver and a website categorisation service, and the corpus uses it both ways.NextDNSis a resolver and a published blocklist.DomainToolssells passive DNS and a WHOIS archive. Keyed exceptions run first. - A name that cannot be resolved from the name. Rapid7 Open Data is four datasets under one brand (FDNS, RDNS, SSL certificates, TCP/UDP liveness) and half the corpus tuples say only
Rapid7orRapid7 Sonar. The Rapid7 family therefore carries a guard regex tested against name + the extractor's purpose sentence, requiring /dns/i. All ten Rapid7 tuples were read by hand and the guard decides all ten the way the reading did:
| Tuple | Purpose | Guard verdict |
|---|---|---|
| Rapid7 Sonar (CCS 2015, Caronte) | “Matched hidden-service certificates to Internet IP addresses” | excluded — certificates |
| Rapid7 SSL Certificate Scans (IMC 2015) | “Provided full IPv4 port 443 certificate scans” | excluded — certificates |
| Rapid7 Labs Open Data (USENIX 2021) | “Supplied full-IPv4-range scan results for liveness checks” | excluded — liveness |
| Rapid7 NeXpose (IEEE S&P 2010) | “Scan test applications for web vulnerabilities” | excluded — a vulnerability scanner, not Open Data |
| Rapid7 (CCS 2016) | “Internet-wide HTTPS and reverse-DNS scan datasets” | included |
| Rapid7 (IMC 2022, iGDB) | “Provide reverse-DNS mappings from IP addresses to hostnames” | included |
| Rapid7's passive DNS (NDSS 2019, NDSS 2021) | “Identify enterprise cloud-hosting IP addresses” / “Resolve domains and discover organization-controlled domains” | included |
| Rapid7 Forward DNS (IMC 2020) | “Collect reverse-DNS and zone-file domains for VPN identification” | included |
| Rapid7 Sonar FDNS / RDNS (PoPETs 2021) | “Validated historical CNAME detection completeness” / “Checked historical tracker IP ownership” | included |
| Rapid7 sonar.udp (CCS 2022) | “Select open DNS resolvers for comparison” | included |
One keyed (name, category) exclusion that no name regex can make: DIG with category == “program-analysis” (IEEE S&P 2024, Everything is Good for Something) is a likely-invariant inference engine, purpose “Likely-invariant inference engine”, not dig(1).
Six false positives found by reading the instrument-only list and fixed in the fold, each of which would have added a non-DNS paper to the population: Khost (a KVM firmware-rehosting tool, matched a khost alternative that should never have been there), XMLdig-to-CSV converter (oscilloscope traces), DNSCAN (a clustering algorithm in a backdoor-forensics paper), USB2SOFT USB 2.0 device SIE (matched /\bsie\b/ intended for Farsight's Security Information Exchange), Rapid7 NeXpose, and DIG.
Fold residue, in full
Loose candidate sweep over tools[] (used or produced), regex:
/dns|resolver|bind\b|unbound|knot|nsd\b|powerdns|maradns|dnsmasq|djbdns|dnscache|zone ?file|czds|openintel|farsight|dnsdb|passive ?dns|massdns|zmap|xmap|zgrab|dig\b|kdig|drill\b|nslookup|host\b|ripe ?atlas|atlas|whois|rdap|public suffix|psl\b|domain|tld|registr|doh|dot\b|doq|odoh|ech\b|adns|getdns|dnspython|scapy|resolv/i
976 candidate tuples. 2 unmapped, both off-topic: “IEEE Organizationally Unique Identifier registry” (1 tuple) and “Chrome DevTools Protocol Network domain” (1 tuple). Neither is a DNS instrument and neither is in the population.
Section F of the report prints the residue and the full table of mapped-but-excluded families with their paper counts.
Hand-read verdicts
All 136 instrument-only papers were read
Each was read as (tool name, extractor purpose sentence). The dump is out/dns/bonly_audit_raw.txt. The overwhelming majority are genuine: resolving a name list with ZDNS or massdns, pulling history out of Farsight or OpenINTEL, standing up BIND or Unbound to test cache behaviour, querying public resolvers for comparison.
Seven are a DNS server inside an attack or lab rig rather than a measurement of DNS in the world. They stay in the population — they did use a DNS-specific instrument, and excluding them would need a judgement the rule does not encode — but the count is published on the page so a reader can subtract it. The list, with the deciding purpose, is the LAB_RIG map in report_dns.mjs; the report prints HAND-MAP STALE if any of them leaves the population:
| Paper | Deciding text |
|---|---|
NDSS 2019 badbluetooth-… | dnsmasq “Provided DHCP and DNS services for PAN attacks” |
NDSS 2020 imp4gt-… | dnsmasq “Provided the malicious DNS server” |
WWW 2019 unveil-capture-and-visualise-wifi-data-leakages | dnsmasq “Create rogue WiFi access points” |
USENIX 2023 bypassing-tunnels-… | dnsmasq “Returned spoofed VPN-server IP addresses through DNS” |
CCS 2025 deep-dive-into-in-app-browsers-… | Dnsmasq “Resolved test domains to the local web server” |
IMC 2024 iot-bricks-over-v6-… | dnsmasq “Provided DHCPv4, DHCPv6, SLAAC, and RDNSS” |
IEEE S&P 2014 when-https-meets-cdn-… | Extended DNSSEC Validator “Provided the Firefox extension base for modification” |
The sixteen LLM papers were read, and the probe count is not the claim
/\b(?:LLM|large language model|GPT-[345]|ChatGPT|Llama|Gemini|Claude)\b/ over the 244 gives 16 papers, 0 / 0 / 3 / 5 / 8 across the five windows. A probe hit is not a method, so all sixteen were read:
| Role | Papers |
|---|---|
| LLM is the DNS classifier | 1 — CCS 2024 poster, DoHunter (DoH tunnel detection) |
| LLM interprets hostname or domain strings inside a conventional pipeline | starlink-in-the-wild (reverse-DNS hostname semantics), dns-flare (ChatGPT filters shared CDN domains), guardians-of-the-galaxy (Bard/Llama2 label file targets), repairing-trust-in-domain-name-disputes (GPT-4o geocoding fallback), practical-attacks-against-dns-reputation-systems (LLM generates adversarial domain names) |
| LLM as a baseline that lost | IMC 2025 decoding-dnssec-errors-at-scale — compares against “naive LLM-based prompt engineering” with GPT-4o |
| Related work, limitations, or a generative-AI acknowledgement only | more-space-less-privacy, the-state-of-passkeys, fishing-for-smishing, and the remainder |
Conclusion published on the page, and the reason it is worded the way it is: an LLM is a defensible labelling aid for hostname semantics; it is not current practice for classifying DNS behaviour on this evidence; and the years the signal lives in (2025–2026) are the provisional ones. The page says so in the same sentence as the counts.
Quotes and per-paper figures
scripts/verify_dns_figures.mjs checks every literal per-paper figure and every quoted sentence against paper.cols.txt with whitespace collapsed, smart quotes folded and dashes normalised. 29 needles, 0 not found. Unedited output:
ok 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the
259 of the 3,047 ASes (8.5%) that we inspect exhibit DNS interception behavior
ok 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the
148,478 residential and cellular IP addresses
ok 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement
that 37% of IPs across 56% ASes measured show some change in censorship behavior depending on source port and local source IP
ok 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement
This behavior is frequently all-or-nothing
ok 2017/USENIX/global-measurement-of-dns-manipulation
41,778 responses (0.31%) as manipulated, spread across 58 countries
ok 2017/USENIX/global-measurement-of-dns-manipulation
1,408 domains
ok 2017/USENIX/global-measurement-of-dns-manipulation
13,594,683 DNS responses
ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
17 TLS proxy vendors in 52 countries
ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
55 ASes in 26 countries with ISP-level DNS manipulation
ok 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
previous work using consistency-based heuristics is inaccurate, allowing for 72.45% false positives in the cases detected as DNS manipulation
ok 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement
90K lookups per second when using an external recursive resolver
ok 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement
solves 50M domains in 10 minutes
ok 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion
we detected a total of 10,474 websites (eTLD+1) that used at least one of the trackers
ok 2010/IMC/comparing-dns-resolvers-in-the-wild
fer in terms of subnets for approximately 2, 000 out of our
ok 2010/IMC/comparing-dns-resolvers-in-the-wild
10, 000 host names. In half of these cases, the returned IP
ok 2010/IMC/comparing-dns-resolvers-in-the-wild
addresses even belong to di
ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
3382 out of 4147 resolvers in the CDN dataset send 100% of their A and AAAA queries with an ECS option
ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
103 recursive resolvers, or over half of all recursive resolvers we could study
ok 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
don't control caching based on scope at all
ok 2015/IMC/going-wild-large-scale-classification-of-open-dns-resolvers
find up to 20 million open resolvers in the weekly IPv4 scans
ok 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli
In over 99 % of observed cases
ok 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli
DDR-compliant clients may fail to upgrade to DoE due to
ok 2021/IMC/home-is-where-the-hijacking-is-understanding-dns-interception-by-residential-rou
occurrences of such trans- 3 parent interception
ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
domains with high accuracy in closed and open world settings, using 124 times less data than attacks on HTTPS flows
ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
We can identify resolvers
ok 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
with 95% accuracy
WEAK NEEDLE 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective: "with 95% accuracy" — short enough to match by accident
ok 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers
59.9%
ok 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers
79.4%
ok 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u
naive LLM-based prompt engineering
ok 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u
concrete, verifiably correct fixes
30 needles checked, 0 not found, 0 papers unreadable.
--- QUOTES THE PAGE NORMALISES (source spelling -> page spelling) ---
"2 , 000" -> "2,000" (stray space in both the .cols rendering and the PDF (Ager et al., IMC 2010))
"10, 000" -> "10,000" (stray space in both the .cols rendering and the PDF (Ager et al., IMC 2010))
"dif- fer" -> "differ" (line-break hyphenation (Ager et al., IMC 2010))
--- FIGURES ON THE PAGE THAT ARE NOT FROM A CITED PAPER ---
5,859 / 1,120 / 1,622 / 930 / 5,118
<- corpus contracts; report_dns.mjs section A asserts them
108 / 202 / 66 / 244 / 136 / 14 / 82 / 1,218 / 5,855
<- report_dns.mjs section A
venue and year tables
<- report_dns.mjs sections B and C
186 / 40 / 76.2% / 16.4% / 33.6% / 5.1%
<- report_dns.mjs sections A and D
instrument family counts (65/62/60/35/29/3/1/156/77/38/24)
<- report_dns.mjs section E
tool spelling counts and the 35/35 home-grown figure
<- report_dns.mjs section E
976 candidate tuples, 2 unmapped, 84 self-tests
<- report_dns.mjs section F, dns_fold.mjs
encrypted-DNS per-window probe counts
<- report_dns.mjs section G
124/103/124, 50.8%/42.2%/50.8%, 120/46/40/35/3, 49.2%
<- report_dns.mjs section H
ethics 186/147/132/72 of 241
<- report_dns.mjs section H
16 LLM papers, 0/0/3/5/8
<- report_dns.mjs probe rerun; the four roles are hand-read
4.7% robots.txt of 1,120
<- data/extract/OVERVIEW.md, "Where the field goes quiet"
7 lab-rig papers
<- LAB_RIG hand map in report_dns.mjs
28 / 75 / 25 / 100 / 46 / 1 / 37.3% / 61.3% / 1.3%
<- pages/resolver_disagreement.py run, out/dns/resolver_run.txt
Tranco list id 46W9X
<- tranco-list.eu, fetched 2026-08-27
RFC numbers, dates, statuses, RFC 8499 obsoleted by 9499
<- rfc-editor.org JSON index via external_checks_dns.sh
ZDNS v2.1.1 2026-05-28; zmap push 2026-08-24; massdns v1.1.0 2024-03-09 push 2026-04-15
<- GitHub API via external_checks_dns.sh
dnspython 2.8.0 2025-09-07; DNSViz v0.11.1 2025-04-21; dnscrypt-proxy 2.1.18 2026-07-18; miekg/dns push 2026-08-19
<- GitHub API and PyPI via external_checks_dns.sh
farsightsecurity.com does not resolve; dnsdb.info 104.244.14.71 -> domaintools.com/platform
<- external_checks_dns.sh
Rapid7 sonar.fdns_v2 2026-08-23, sonar.rdns_v2 2026-08-26
<- opendata.rapid7.com parsed by external_checks_dns.sh
network.trr.mode value 0; 5 DoH provider records; Cloudflare autoDefault
<- StaticPrefList.yaml and Mozilla Remote Settings via external_checks_dns.sh
Where the extraction's prevalence did not survive the check. detection[].prevalence is a model summary of a result, not a quote, and four figures taken from it could not be located in the paper and were rewritten from the paper's own words before publication:
prevalence said | The paper says |
|---|---|
| “3,382 of 4,147 resolvers sent 100% of A and AAAA queries with ECS” | “3382 out of 4147 resolvers in the CDN dataset send 100% of their A and AAAA queries with an ECS option” |
| “103 resolvers ignored scope when reusing cached responses” | “we find 103 recursive resolvers, or over half of all recursive resolvers we could study, that don't control caching based on scope at all” |
| “95% resolver accuracy and 100% client accuracy” | “We built classifiers to distinguish resolver and client based on the TLS record length. We can identify resolvers with 95% accuracy, and we get no errors (100% accuracy) when identif[ying]…” — the 100% is the client, not the resolver; the page no longer pairs them |
| “DNS manipulation … 17 TLS proxy vendors in 52 countries and ISP-level manipulation in 26 countries” | two separate sentences: “CERTainty identifies 17 TLS proxy vendors in 52 countries” and “CERTainty also detects 55 ASes in 26 countries with ISP-level DNS manipulation” |
The fourth is the one to remember: the extraction had fused two findings into one sentence, and quoting it would have invented a claim the paper does not make.
One figure was dropped, not rewritten. The extraction reports “49 out of 220 intercepted probes” for Randall et al. (IMC 2021). Neither number could be located in paper.cols.txt by any probe tried. The page quotes the paper's own abstract claim (“over 200 occurrences of such transparent interception”) instead and makes no 49/220 claim.
One quote is normalised and says so on the page. Ager et al. (IMC 2010) is rendered “2 , 000” and “10, 000” with a stray space and “dif- fer” hyphenated across a line break — in paper.cols.txt and in a pypdf re-extraction of paper.pdf, so it is the source's own typesetting, not a column-repair artefact. The page carries a footnote saying so.
External checks
scripts/external_checks_dns.sh. Every check prints FAILED explicitly, so a 403 or a rate limit cannot read as a pass. Unedited output:
== run date (UTC)
2026-08-27T22:24:29Z
== RFCs the page names: status, obsoleted-by, updated-by
RFC1034 November 1987 INTERNET STANDARD obs_by=- upd_by=RFC1101,RFC1183,RFC1348,RFC1876,RFC1982,RFC2065,RFC2181,RFC2308,RFC2535,RFC4033,RFC4034,RFC4035,RFC4343,RFC4592,RFC5936,RFC8020,RFC8482,RFC8767,RFC9471 Domain names - concepts and facilities
RFC1035 November 1987 INTERNET STANDARD obs_by=- upd_by=RFC1101,RFC1183,RFC1348,RFC1876,RFC1982,RFC1995,RFC1996,RFC2065,RFC2136,RFC2137,RFC2181,RFC2308,RFC2535,RFC2673,RFC2845,RFC3425,RFC3658,RFC4033,RFC4034,RFC4035,RFC4343,RFC5936,RFC5966,RFC6604,RFC7766,RFC8482,RFC8490,RFC8767,RFC9619 Domain names - implementation and specification
RFC2181 July 1997 PROPOSED STANDARD obs_by=- upd_by=RFC2535,RFC4033,RFC4034,RFC4035,RFC4343,RFC5452,RFC8767 Clarifications to the DNS Specification
RFC4033 March 2005 PROPOSED STANDARD obs_by=- upd_by=RFC6014,RFC6840 DNS Security Introduction and Requirements
RFC4034 March 2005 PROPOSED STANDARD obs_by=- upd_by=RFC4470,RFC6014,RFC6840,RFC6944,RFC9077,RFC9824,RFC9905 Resource Records for the DNS Security Extensions
RFC4035 March 2005 PROPOSED STANDARD obs_by=- upd_by=RFC4470,RFC6014,RFC6840,RFC8198,RFC9077,RFC9520,RFC9824 Protocol Modifications for the DNS Security Extensions
RFC5001 August 2007 PROPOSED STANDARD obs_by=- upd_by=- DNS Name Server Identifier (NSID) Option
RFC6891 April 2013 INTERNET STANDARD obs_by=- upd_by=- Extension Mechanisms for DNS (EDNS(0))
RFC7766 March 2016 PROPOSED STANDARD obs_by=- upd_by=RFC8490,RFC9103 DNS Transport over TCP - Implementation Requirements
RFC7858 May 2016 PROPOSED STANDARD obs_by=- upd_by=RFC8310 Specification for DNS over Transport Layer Security (TLS
RFC7871 May 2016 INFORMATIONAL obs_by=- upd_by=- Client Subnet in DNS Queries
RFC8484 October 2018 PROPOSED STANDARD obs_by=- upd_by=- DNS Queries over HTTPS (DoH)
RFC8499 January 2019 BEST CURRENT PRACTICE obs_by=RFC9499 upd_by=- DNS Terminology
RFC8767 March 2020 PROPOSED STANDARD obs_by=- upd_by=- Serving Stale Data to Improve DNS Resiliency
RFC8914 October 2020 PROPOSED STANDARD obs_by=- upd_by=- Extended DNS Errors
RFC9156 November 2021 PROPOSED STANDARD obs_by=- upd_by=- DNS Query Name Minimisation to Improve Privacy
RFC9230 June 2022 EXPERIMENTAL obs_by=- upd_by=- Oblivious DNS over HTTPS
RFC9250 May 2022 PROPOSED STANDARD obs_by=- upd_by=- DNS over Dedicated QUIC Connections
RFC9276 August 2022 BEST CURRENT PRACTICE obs_by=- upd_by=- Guidance for NSEC3 Parameter Settings
RFC9462 November 2023 PROPOSED STANDARD obs_by=- upd_by=- Discovery of Designated Resolvers
RFC9463 November 2023 PROPOSED STANDARD obs_by=- upd_by=- DHCP and Router Advertisement Options for the Discovery
RFC9499 March 2024 BEST CURRENT PRACTICE obs_by=- upd_by=- DNS Terminology
RFC9539 February 2024 EXPERIMENTAL obs_by=- upd_by=- Unilateral Opportunistic Deployment of Encrypted Recursi
== GitHub repositories: archived state, last push, latest release
zmap/zdns archived=False pushed=2026-08-24 stars=1131
latest release v2.1.1 on 2026-05-28
zmap/zmap archived=False pushed=2026-08-26 stars=6366
latest release v4.4.0 on 2026-05-29
blechschmidt/massdns archived=False pushed=2026-04-15 stars=3635
latest release v1.1.0 on 2024-03-09
dnsviz/dnsviz archived=False pushed=2025-04-21 stars=1246
latest release v0.11.1 on 2025-04-21
rthalley/dnspython archived=False pushed=2026-08-25 stars=2670
latest release v2.8.0 on 2025-09-07
miekg/dns archived=False pushed=2026-08-19 stars=8763
no GitHub release object: Not Found
NLnetLabs/unbound archived=False pushed=2026-08-26 stars=4822
latest release release-1.26.0 on 2026-08-04
NLnetLabs/nsd archived=False pushed=2026-08-26 stars=569
latest release NSD_4_15_1_REL on 2026-08-26
isc-projects/bind9 archived=False pushed=2026-08-27 stars=763
no GitHub release object: Not Found
PowerDNS/pdns archived=False pushed=2026-08-27 stars=4456
no GitHub release object: Not Found
CZ-NIC/knot-resolver archived=False pushed=2026-08-27 stars=460
no GitHub release object: Not Found
imp/dnsmasq archived=False pushed=2026-03-16 stars=389
no GitHub release object: Not Found
DNS-OARC/dnsperf archived=True pushed=2026-02-04 stars=478
latest release v2.14.0 on 2024-01-18
== PyPI: dnspython
dnspython 2.8.0 2025-09-07
== HTTP status of every URL the page cites
200 https://openintel.nl/
200 https://atlas.ripe.net/
200 https://czds.icann.org/
200 https://www.domaintools.com/products/farsight-dnsdb/
200 https://opendata.rapid7.com/
200 https://opendata.rapid7.com/sonar.fdns_v2/
200 https://dnsviz.net/
200 https://stats.labs.apnic.net/dnssec
200 https://dnscrypt.info/public-servers
200 https://developers.google.com/speed/public-dns/docs/doh
200 https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/
200 https://www.quad9.net/
200 https://ooni.org/
200 https://censoredplanet.org/
200 https://sidnlabs.nl/
200 https://www.dns-oarc.net/
200 https://root-servers.org/
200 https://ithi.research.icann.org/
200 https://scans.io/
200 https://www.dnsdb.info/
== Rapid7 Open Data: are the FDNS/RDNS studies still published, and when last
/sonar.fdns_v2/ Forward DNS (FDNS) last=08/23/2026
/sonar.rdns_v2/ Reverse DNS (RDNS) last=08/26/2026
/sonar.http/ HTTP GET Responses last=08/27/2026
/sonar.https/ HTTPS GET Responses last=08/27/2026
/sonar.tcp/ TCP Scans last=08/27/2026
/sonar.ssl/ SSL Certificates last=08/27/2026
/sonar.moressl/ More SSL Certificates (non-443) last=08/18/2026
/sonar.udp/ UDP Scans last=08/06/2026
== Farsight / DomainTools: does the cited vendor still exist under that name
farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known
www.farsightsecurity.com RESOLVE FAILED: [Errno -2] Name or service not known
dnsdb.info A= 104.244.14.71
200 https://www.dnsdb.info/ -> https://www.domaintools.com/platform
200 https://www.domaintools.com/products/farsight-dnsdb/ -> https://www.domaintools.com/platform
== DNS-OARC DITL and the other community datasets
200 https://www.dns-oarc.net/oarc/data/ditl
404 https://www.dns-oarc.net/oarc/data
200 https://catalog.caida.org/
401 https://data.caida.org/datasets/
== Firefox DoH: the shipped prefs, read out of the tree
all.js bytes=200412 trr lines=6
pref("network.trr.uri", "");
pref("network.trr.custom_uri", "");
--- network.trr.mode compiled default (StaticPrefList.yaml)
- name: network.trr.mode
type: RelaxedAtomicUint32
value: 0
mirror: always
firefox.js bytes=185642 trr lines=1
== Mozilla DoH provider steering list (Remote Settings, no auth)
5 DoH provider records in Mozilla Remote Settings (collection: doh-providers)
Cloudflare autoDefault=True https://mozilla.cloudflare-dns.com/dns-query
Shaw autoDefault=False https://dns.shaw.ca/dns-query
autoDefault=False https://doh.xfinity.com/dns-query
NextDNS autoDefault=False https://firefox.dns.nextdns.io/
CIRA Canadian Shield autoDefault=False https://private.canadianshield.cira.ca/dns-query
== Chrome: secure-DNS enterprise policy page
200 chromeenterprise.google/policies/
== APNIC DNSSEC-validation measurement, world (primary source, today)
bytes=528440
Validation Capability Metrics div { background: transparent url(/images/bg-watermark
== done
What the external pass changed on the page
| Fact | How it was checked | Effect on the page |
|---|---|---|
| RFC 8499 is obsoleted by RFC 9499 | rfc-editor.org/rfc/rfc8499.json, field obsoleted_by | The page names 9499 as the current terminology reference and says 8499 is out of date. |
| RFC 7871 (ECS) is Informational, not a standard | same index, field status | Stated inline, because a methods section that calls ECS “the standard” is wrong. |
| RFC 9230 (ODoH) is Experimental | same | The page says so and warns against describing ODoH as a deployed default. |
farsightsecurity.com does not resolve at all; dnsdb.info resolves to 104.244.14.71 and 301s to domaintools.com/platform, as does /products/farsight-dnsdb/ | socket.getaddrinfo + curl -L -w %{url_effective} | The 28-paper Farsight row is marked “renamed and re-homed”, with the redirect target named. |
Rapid7 Open Data FDNS/RDNS is still published — sonar.fdns_v2 last updated 2026-08-23, sonar.rdns_v2 2026-08-26 | parsed out of opendata.rapid7.com | This corrected a wrong prior belief. The draft was going to say the bulk DNS downloads had been discontinued in 2022. They have not. The page says “still live, contrary to what a 2022-era memory will tell you”. |
Firefox's DoH default is not in the source tree — network.trr.mode has value: 0 in StaticPrefList.yaml and network.trr.uri is empty in all.js | raw.githubusercontent mozilla-firefox/firefox main | The page tells the reader to check the Remote Settings collection and a date/region, not the tree. |
Mozilla's doh-providers collection has 5 records, only Cloudflare with autoDefault: true | firefox.settings.services.mozilla.com/v1/buckets/main/collections/doh-providers/records, no auth | Published with the URL, so a reader can re-run it. |
DNS-OARC's dnsperf repository is archived (last push 2026-02-04, last release v2.14.0 2024-01-18) | GitHub API | Not named on the page as a current tool. |
Tool currency: ZDNS v2.1.1 (2026-05-28), zmap pushed 2026-08-24, massdns v1.1.0 (2024-03-09) pushed 2026-04-15, DNSViz v0.11.1 (2025-04-21), dnspython 2.8.0 (2025-09-07), dnscrypt-proxy 2.1.18 (2026-07-18), miekg/dns pushed 2026-08-19 with no tagged release | GitHub API, PyPI | Each row's “State on 2026-08-27” column, and the advice to pin miekg/dns by commit. |
What could not be established
- A current DNSSEC validation rate from a primary source.
stats.labs.apnic.net/dnssec/XAreturns 200 but renders its figures client-side;XA.jsonand thecgi-binendpoint are both 404, and no data URL is present in the HTML. No DNSSEC deployment percentage is published on the page; APNIC is not cited for a number. - A dated primary source for the DomainTools acquisition of Farsight Security.
domaintools.com/company/press-releases/is 404 and no newsroom index was found. The page therefore states only what was measured directly: the old domain does not resolve and the old product URLs redirect. No acquisition date is claimed. internetsociety.orgDNSSEC statistics returns 403 to this host. Not cited.radar.cloudflare.comreturns 403 to this host. Cloudflare Radar has DNS data and may be worth a future row, but nothing was verified, so nothing is claimed. See the red linkprogramming:cloudflare_radar.
The published script
pages/resolver_disagreement.py, embedded on the page as a <file python> block. Standard library only (Python 3.8+): the container has no dnspython, no dig, no drill and no nslookup, which turned out to be the right constraint — the script is meant to run on a measurement host without a package install.
Design decisions worth recording:
- No EDNS0. Adding an OPT record changes which resolvers answer, and adding an ECS option changes the answer. The docstring says so, because a silent EDNS choice is the kind of thing that makes a resolution unreproducible.
- Source-address check on the reply. It accepts a datagram only from the address it queried, and rejects a transaction-ID mismatch. This does not defend against an on-path forger — nothing at this layer does — but it stops a stray answer being recorded as that resolver's.
no-A-recordis a separate verdict frominsufficient. The first draft merged them and reported “25% insufficient”, which hid the actual finding: those 25 names have no A record at the apex, which is a property of the zone and the most common way a list-driven crawl loses rows silently.- Two summaries, and the script says which to quote. Summary A over all names mixes “resolvers disagree” (28/100) with “there was nothing to disagree about” (25/100). Summary B over the 75 comparable names gives 37.3%. Quoting 28% would understate the disagreement by hiding it behind the no-answer rate.
The run behind the page's numbers
Tranco top 100, list ID 46W9X, fetched from tranco-list.eu on 2026-08-27. Three public resolvers over Do53/UDP from a single European vantage point. Two consecutive runs against the same list gave identical verdict counts (46 identical / 1 same-/24 / 28 disjoint / 25 no-A-record), which is reassuring but is not a stability claim — it is two runs, minutes apart, from one place.
The <code> block on the page is generated by scripts/build_dns_codeblock.mjs from out/dns/resolver_run.txt, with a mechanical abridgement rule (two header lines, the google.com stanza with address lists cut after two entries, both summary blocks). It is regenerated rather than pasted, because the first draft pasted an earlier run's TTLs under a later run's timestamp — the exact failure the builder now prevents.
Full run output:
# resolvers: Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9)
# names: 100 run at 2026-08-27T22:31:01Z
google.com -> disjoint
Google NOERROR 12.3 ms ttl=209 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139
Cloudflare NOERROR 9.8 ms ttl=15 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139
Quad9 NOERROR 14.7 ms ttl=135 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139
cloudflare.com -> identical
Google NOERROR 11.4 ms ttl=257 104.16.132.229, 104.16.133.229
Cloudflare NOERROR 9.8 ms ttl=300 104.16.132.229, 104.16.133.229 (2nd query TTL 137: served from cache)
Quad9 NOERROR 14.5 ms ttl=87 104.16.132.229, 104.16.133.229 (2nd query TTL 38: served from cache)
gstatic.com -> disjoint
Google NOERROR 10.3 ms ttl=257 172.217.208.120, 172.217.208.94 (2nd query TTL 257: unchanged)
Cloudflare NOERROR 9.0 ms ttl=218 74.125.29.120, 74.125.29.94
Quad9 NOERROR 13.9 ms ttl=54 142.251.13.120, 142.251.13.94
facebook.com -> disjoint
Google NOERROR 13.1 ms ttl=60 157.240.17.35 (2nd query TTL 17: served from cache)
Cloudflare NOERROR 8.7 ms ttl=6 157.240.17.35
Quad9 NOERROR 14.0 ms ttl=29 157.240.0.35 (2nd query TTL 29: unchanged)
microsoft.com -> disjoint
Google NOERROR 9.6 ms ttl=1714 150.171.110.56
Cloudflare NOERROR 9.3 ms ttl=363 150.171.110.56
Quad9 NOERROR 15.4 ms ttl=335 150.171.109.101 (2nd query TTL 305: served from cache)
googleapis.com -> disjoint
Google NOERROR 10.6 ms ttl=69 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 9: served from cache)
Cloudflare NOERROR 9.8 ms ttl=272 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 170: served from cache)
Quad9 NOERROR 13.9 ms ttl=265 142.251.13.103, 142.251.13.104, 142.251.13.105, 142.251.13.106, 142.251.13.147, 142.251.13.99 (2nd query TTL 69: served from cache)
amazonaws.com -> identical
Google NOERROR 11.6 ms ttl=884 15.197.250.250, 166.117.149.112 (2nd query TTL 884: unchanged)
Cloudflare NOERROR 10.9 ms ttl=791 15.197.250.250, 166.117.149.112 (2nd query TTL 791: unchanged)
Quad9 NOERROR 13.5 ms ttl=281 15.197.250.250, 166.117.149.112
youtube.com -> disjoint
Google NOERROR 16.4 ms ttl=300 172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 9.0 ms ttl=222 172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93 (2nd query TTL 60: served from cache)
Quad9 NOERROR 14.6 ms ttl=107 142.251.127.136, 142.251.127.190, 142.251.127.91, 142.251.127.93 (2nd query TTL 107: unchanged)
apple.com -> identical
Google NOERROR 9.8 ms ttl=847 17.253.144.10 (2nd query TTL 847: unchanged)
Cloudflare NOERROR 9.4 ms ttl=430 17.253.144.10
Quad9 NOERROR 14.8 ms ttl=591 17.253.144.10 (2nd query TTL 591: unchanged)
gtld-servers.net -> no-A-record
Google NOERROR 10.4 ms ttl=- (no A record)
Cloudflare NOERROR 26.5 ms ttl=- (no A record)
Quad9 NOERROR 25.6 ms ttl=- (no A record)
akamai.net -> no-A-record
Google NOERROR 9.7 ms ttl=- (no A record)
Cloudflare NOERROR 9.5 ms ttl=- (no A record)
Quad9 NOERROR 15.2 ms ttl=- (no A record)
instagram.com -> disjoint
Google NOERROR 15.7 ms ttl=60 157.240.17.174 (2nd query TTL 21: served from cache)
Cloudflare NOERROR 12.1 ms ttl=58 157.240.17.174 (2nd query TTL 45: served from cache)
Quad9 NOERROR 16.2 ms ttl=35 157.240.253.174 (2nd query TTL 35: unchanged)
mail.ru -> identical
Google NOERROR 11.8 ms ttl=26 185.180.201.1, 89.221.239.1, 90.156.232.4 (2nd query TTL 26: unchanged)
Cloudflare NOERROR 11.3 ms ttl=14 185.180.201.1, 89.221.239.1, 90.156.232.4 (2nd query TTL 14: unchanged)
Quad9 NOERROR 15.4 ms ttl=1 185.180.201.1, 89.221.239.1, 90.156.232.4
ezviz7.com -> no-A-record
Google NOERROR 172.4 ms ttl=- (no A record)
Cloudflare NOERROR 11.2 ms ttl=- (no A record)
Quad9 NOERROR 15.8 ms ttl=- (no A record)
fbcdn.net -> disjoint
Google NOERROR 11.6 ms ttl=19 157.240.17.35 (2nd query TTL 19: unchanged)
Cloudflare NOERROR 9.8 ms ttl=9 157.240.17.35 (2nd query TTL 8: served from cache)
Quad9 NOERROR 15.5 ms ttl=3 157.240.0.35
twitter.com -> disjoint
Google NOERROR 10.8 ms ttl=65 162.159.140.229
Cloudflare NOERROR 9.3 ms ttl=169 172.66.0.227 (2nd query TTL 168: served from cache)
Quad9 NOERROR 15.0 ms ttl=104 151.101.66.146 (2nd query TTL 76: served from cache)
dzen.ru -> identical
Google NOERROR 9.8 ms ttl=238 95.163.218.220 (2nd query TTL 238: unchanged)
Cloudflare NOERROR 9.3 ms ttl=102 95.163.218.220 (2nd query TTL 31: served from cache)
Quad9 NOERROR 15.3 ms ttl=472 95.163.218.220 (2nd query TTL 64: served from cache)
linkedin.com -> identical
Google NOERROR 9.9 ms ttl=237 130.211.32.14
Cloudflare NOERROR 9.5 ms ttl=107 130.211.32.14 (2nd query TTL 66: served from cache)
Quad9 NOERROR 15.3 ms ttl=29 130.211.32.14
domaincontrol.com -> identical
Google NOERROR 27.8 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged)
Cloudflare NOERROR 16.8 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged)
Quad9 NOERROR 16.5 ms ttl=600 127.0.0.1 (2nd query TTL 600: unchanged)
googlevideo.com -> disjoint
Google NOERROR 17.0 ms ttl=300 74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99 (2nd query TTL 258: served from cache)
Cloudflare NOERROR 9.5 ms ttl=58 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99 (2nd query TTL 22: served from cache)
Quad9 NOERROR 16.1 ms ttl=292 192.178.183.103, 192.178.183.104, 192.178.183.105, 192.178.183.106, 192.178.183.147, 192.178.183.99 (2nd query TTL 56: served from cache)
office.com -> identical
Google NOERROR 15.6 ms ttl=10 13.107.6.156 (2nd query TTL 10: unchanged)
Cloudflare NOERROR 11.1 ms ttl=8 13.107.6.156 (2nd query TTL 5: served from cache)
Quad9 NOERROR 14.9 ms ttl=5 13.107.6.156
googletagmanager.com -> disjoint
Google NOERROR 10.8 ms ttl=258 172.217.208.97 (2nd query TTL 258: unchanged)
Cloudflare NOERROR 9.9 ms ttl=261 74.125.29.97 (2nd query TTL 178: served from cache)
Quad9 NOERROR 15.8 ms ttl=50 142.251.20.97 (2nd query TTL 12: served from cache)
hicloudcam.com -> no-A-record
Google NOERROR 11.1 ms ttl=- (no A record)
Cloudflare NOERROR 607.2 ms ttl=- (no A record)
Quad9 NOERROR 238.1 ms ttl=- (no A record)
live.com -> identical
Google NOERROR 9.4 ms ttl=3285 204.79.197.212 (2nd query TTL 2887: served from cache)
Cloudflare NOERROR 9.9 ms ttl=233 204.79.197.212
Quad9 NOERROR 14.4 ms ttl=2035 204.79.197.212
akamaiedge.net -> no-A-record
Google NOERROR 9.8 ms ttl=- (no A record)
Cloudflare NOERROR 10.4 ms ttl=- (no A record)
Quad9 NOERROR 15.0 ms ttl=- (no A record)
amazon.com -> identical
Google NOERROR 11.8 ms ttl=635 98.82.161.185, 98.87.170.71, 98.87.170.74 (2nd query TTL 245: served from cache)
Cloudflare NOERROR 9.9 ms ttl=92 98.82.161.185, 98.87.170.71, 98.87.170.74
Quad9 NOERROR 15.0 ms ttl=671 98.82.161.185, 98.87.170.71, 98.87.170.74
akadns.net -> no-A-record
Google NOERROR 11.2 ms ttl=- (no A record)
Cloudflare NOERROR 10.9 ms ttl=- (no A record)
Quad9 NOERROR 16.2 ms ttl=- (no A record)
azure.com -> identical
Google NOERROR 10.3 ms ttl=3559 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1200: served from cache)
Cloudflare NOERROR 10.1 ms ttl=2214 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 2111: served from cache)
Quad9 NOERROR 16.4 ms ttl=1893 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1886: served from cache)
bing.com -> identical
Google NOERROR 10.4 ms ttl=2729 150.171.27.10, 150.171.28.10
Cloudflare NOERROR 9.8 ms ttl=606 150.171.27.10, 150.171.28.10
Quad9 NOERROR 14.6 ms ttl=2570 150.171.27.10, 150.171.28.10
github.com -> same-/24
Google NOERROR 15.7 ms ttl=60 140.82.121.4 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 10.8 ms ttl=30 140.82.121.3 (2nd query TTL 30: unchanged)
Quad9 NOERROR 14.2 ms ttl=57 140.82.121.3 (2nd query TTL 10: served from cache)
wikipedia.org -> disjoint
Google NOERROR 10.5 ms ttl=19 185.15.58.224
Cloudflare NOERROR 9.4 ms ttl=70 185.15.58.224 (2nd query TTL 22: served from cache)
Quad9 NOERROR 15.7 ms ttl=91 185.15.59.224 (2nd query TTL 79: served from cache)
whatsapp.net -> disjoint
Google NOERROR 10.4 ms ttl=18 157.240.17.60
Cloudflare NOERROR 11.0 ms ttl=58 157.240.17.60 (2nd query TTL 8: served from cache)
Quad9 NOERROR 14.2 ms ttl=14 157.240.0.60
apple-dns.net -> no-A-record
Google NOERROR 11.4 ms ttl=- (no A record)
Cloudflare NOERROR 10.9 ms ttl=- (no A record)
Quad9 NOERROR 15.4 ms ttl=- (no A record)
fastly.net -> identical
Google NOERROR 10.3 ms ttl=2605 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6 (2nd query TTL 2605: unchanged)
Cloudflare NOERROR 11.8 ms ttl=2680 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6
Quad9 NOERROR 16.0 ms ttl=396 151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6
googleusercontent.com -> disjoint
Google NOERROR 40.6 ms ttl=300 192.178.170.132 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 11.4 ms ttl=109 74.125.29.132 (2nd query TTL 33: served from cache)
Quad9 NOERROR 15.0 ms ttl=254 142.251.127.132 (2nd query TTL 98: served from cache)
appsflyersdk.com -> disjoint
Google NOERROR 19.6 ms ttl=60 3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 11.4 ms ttl=60 3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48 (2nd query TTL 60: unchanged)
Quad9 NOERROR 14.0 ms ttl=19 18.238.243.45, 18.238.243.46, 18.238.243.57, 18.238.243.93
doubleclick.net -> disjoint
Google NOERROR 18.9 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 10.1 ms ttl=234 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 45: served from cache)
Quad9 NOERROR 14.4 ms ttl=248 142.251.14.100, 142.251.14.101, 142.251.14.102, 142.251.14.113, 142.251.14.138, 142.251.14.139
aaplimg.com -> no-A-record
Google NOERROR 11.1 ms ttl=- (no A record)
Cloudflare NOERROR 12.0 ms ttl=- (no A record)
Quad9 NOERROR 14.4 ms ttl=- (no A record)
microsoftonline.com -> no-A-record
Google NOERROR 10.6 ms ttl=- (no A record)
Cloudflare NOERROR 8.6 ms ttl=- (no A record)
Quad9 NOERROR 15.2 ms ttl=- (no A record)
netflix.com -> disjoint
Google NOERROR 13.3 ms ttl=60 52.214.181.141, 54.170.196.176, 54.246.79.9 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 13.0 ms ttl=56 52.214.181.141, 54.170.196.176, 54.246.79.9 (2nd query TTL 56: unchanged)
Quad9 NOERROR 15.0 ms ttl=56 18.200.8.190, 54.155.246.232, 54.73.148.110 (2nd query TTL 56: unchanged)
office.net -> no-A-record
Google NOERROR 10.5 ms ttl=- (no A record)
Cloudflare NOERROR 11.9 ms ttl=- (no A record)
Quad9 NOERROR 13.9 ms ttl=- (no A record)
trafficmanager.net -> no-A-record
Google NOERROR 13.2 ms ttl=- (no A record)
Cloudflare NOERROR 10.1 ms ttl=- (no A record)
Quad9 NOERROR 14.5 ms ttl=- (no A record)
gandi.net -> identical
Google NOERROR 33.5 ms ttl=600 217.70.185.65 (2nd query TTL 600: unchanged)
Cloudflare NOERROR 10.2 ms ttl=559 217.70.185.65 (2nd query TTL 559: unchanged)
Quad9 NOERROR 14.4 ms ttl=559 217.70.185.65 (2nd query TTL 558: served from cache)
sharepoint.com -> identical
Google NOERROR 10.2 ms ttl=1132 13.107.136.10, 13.107.138.10 (2nd query TTL 1132: unchanged)
Cloudflare NOERROR 9.4 ms ttl=1247 13.107.136.10, 13.107.138.10
Quad9 NOERROR 14.5 ms ttl=1604 13.107.136.10, 13.107.138.10 (2nd query TTL 1276: served from cache)
digicert.com -> identical
Google NOERROR 10.0 ms ttl=65 45.60.121.229, 45.60.131.229 (2nd query TTL 19: served from cache)
Cloudflare NOERROR 10.9 ms ttl=288 45.60.121.229, 45.60.131.229 (2nd query TTL 169: served from cache)
Quad9 NOERROR 15.2 ms ttl=144 45.60.121.229, 45.60.131.229
youtu.be -> disjoint
Google NOERROR 12.8 ms ttl=259 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93 (2nd query TTL 259: unchanged)
Cloudflare NOERROR 9.4 ms ttl=39 74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93
Quad9 NOERROR 15.4 ms ttl=118 142.251.127.136, 142.251.127.190, 142.251.127.91, 142.251.127.93
wordpress.org -> identical
Google NOERROR 11.2 ms ttl=440 66.6.42.252 (2nd query TTL 379: served from cache)
Cloudflare NOERROR 16.6 ms ttl=600 66.6.42.252 (2nd query TTL 519: served from cache)
Quad9 NOERROR 14.9 ms ttl=404 66.6.42.252 (2nd query TTL 60: served from cache)
skype.com -> identical
Google NOERROR 10.4 ms ttl=2344 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
Cloudflare NOERROR 9.9 ms ttl=1704 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
Quad9 NOERROR 15.8 ms ttl=952 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
cloud.microsoft -> identical
Google NOERROR 10.9 ms ttl=127 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
Cloudflare NOERROR 10.9 ms ttl=165 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
Quad9 NOERROR 15.3 ms ttl=129 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 75: served from cache)
goo.gl -> disjoint
Google NOERROR 23.8 ms ttl=300 74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 11.0 ms ttl=28 172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139
Quad9 NOERROR 15.1 ms ttl=26 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139
cloudfront.net -> no-A-record
Google NOERROR 12.3 ms ttl=- (no A record)
Cloudflare NOERROR 11.1 ms ttl=- (no A record)
Quad9 NOERROR 15.0 ms ttl=- (no A record)
googledomains.com -> identical
Google NOERROR 30.2 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 17.1 ms ttl=300 216.239.32.29 (2nd query TTL 300: unchanged)
Quad9 NOERROR 17.5 ms ttl=259 216.239.32.29
x.com -> disjoint
Google NOERROR 12.2 ms ttl=25 172.66.0.227
Cloudflare NOERROR 10.6 ms ttl=33 162.159.140.229
Quad9 NOERROR 15.1 ms ttl=183 162.159.140.229 (2nd query TTL 87: served from cache)
tiktok.com -> disjoint
Google NOERROR 19.3 ms ttl=20 2.21.22.17, 2.21.22.56 (2nd query TTL 20: unchanged)
Cloudflare NOERROR 10.3 ms ttl=16 23.55.104.30, 23.55.104.31, 23.55.104.38, 23.61.250.102, 23.61.250.104, 23.61.250.117, 23.61.250.119, 23.61.250.81 (2nd query TTL 16: unchanged)
Quad9 NOERROR 13.9 ms ttl=15 104.126.37.123, 104.126.37.153, 104.126.37.179, 104.126.37.185 (2nd query TTL 15: unchanged)
pinterest.com -> identical
Google NOERROR 12.0 ms ttl=444 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84
Cloudflare NOERROR 9.5 ms ttl=415 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84 (2nd query TTL 328: served from cache)
Quad9 NOERROR 14.0 ms ttl=426 151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84
icloud.com -> identical
Google NOERROR 9.2 ms ttl=438 17.253.144.10 (2nd query TTL 436: served from cache)
Cloudflare NOERROR 9.5 ms ttl=322 17.253.144.10 (2nd query TTL 322: unchanged)
Quad9 NOERROR 15.0 ms ttl=296 17.253.144.10
whatsapp.com -> disjoint
Google NOERROR 24.6 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 9.4 ms ttl=20 157.240.17.60
Quad9 NOERROR 15.9 ms ttl=16 157.240.0.60 (2nd query TTL 15: served from cache)
roblox.com -> identical
Google NOERROR 11.9 ms ttl=39 128.116.5.3
Cloudflare NOERROR 11.0 ms ttl=17 128.116.5.3 (2nd query TTL 2: served from cache)
Quad9 NOERROR 15.7 ms ttl=51 128.116.5.3 (2nd query TTL 24: served from cache)
yahoo.com -> identical
Google NOERROR 12.2 ms ttl=1121 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164 (2nd query TTL 1121: unchanged)
Cloudflare NOERROR 9.1 ms ttl=40 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164
Quad9 NOERROR 15.6 ms ttl=273 74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164
windowsupdate.com -> no-A-record
Google NOERROR 9.6 ms ttl=- (no A record)
Cloudflare NOERROR 9.1 ms ttl=- (no A record)
Quad9 NOERROR 15.7 ms ttl=- (no A record)
cloudflare.net -> identical
Google NOERROR 14.1 ms ttl=300 104.16.208.90, 104.17.156.85 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 9.4 ms ttl=259 104.16.208.90, 104.17.156.85
Quad9 NOERROR 13.6 ms ttl=102 104.16.208.90, 104.17.156.85 (2nd query TTL 102: unchanged)
gvt1.com -> no-A-record
Google NOERROR 24.1 ms ttl=- (no A record)
Cloudflare NOERROR 9.7 ms ttl=- (no A record)
Quad9 NOERROR 14.4 ms ttl=- (no A record)
googlesyndication.com -> disjoint
Google NOERROR 10.3 ms ttl=259 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99
Cloudflare NOERROR 10.5 ms ttl=38 172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99
Quad9 NOERROR 15.4 ms ttl=77 142.251.20.103, 142.251.20.104, 142.251.20.105, 142.251.20.106, 142.251.20.147, 142.251.20.99 (2nd query TTL 77: unchanged)
msn.com -> identical
Google NOERROR 10.7 ms ttl=131 204.79.197.219
Cloudflare NOERROR 10.1 ms ttl=3474 204.79.197.219 (2nd query TTL 3474: unchanged)
Quad9 NOERROR 14.7 ms ttl=2249 204.79.197.219 (2nd query TTL 1844: served from cache)
spotify.com -> identical
Google NOERROR 12.3 ms ttl=4 35.186.224.24
Cloudflare NOERROR 9.7 ms ttl=108 35.186.224.24
Quad9 NOERROR 16.0 ms ttl=18 35.186.224.24
windows.net -> identical
Google NOERROR 11.3 ms ttl=166 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 16: served from cache)
Cloudflare NOERROR 10.4 ms ttl=1314 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1314: unchanged)
Quad9 NOERROR 15.4 ms ttl=3208 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 3206: served from cache)
ntp.org -> identical
Google NOERROR 10.8 ms ttl=346 204.93.207.22, 209.148.110.246 (2nd query TTL 346: unchanged)
Cloudflare NOERROR 9.8 ms ttl=2645 204.93.207.22, 209.148.110.246 (2nd query TTL 2645: unchanged)
Quad9 NOERROR 15.0 ms ttl=1861 204.93.207.22, 209.148.110.246 (2nd query TTL 1560: served from cache)
adobe.com -> disjoint
Google NOERROR 17.9 ms ttl=20 92.123.27.153, 92.123.27.160, 92.123.27.170 (2nd query TTL 20: unchanged)
Cloudflare NOERROR 10.2 ms ttl=15 2.20.245.174, 2.20.245.187 (2nd query TTL 15: unchanged)
Quad9 NOERROR 15.5 ms ttl=3 2.19.126.138, 2.19.126.158
myfritz.net -> identical
Google NOERROR 11.5 ms ttl=7939 212.42.244.100
Cloudflare NOERROR 26.2 ms ttl=86400 212.42.244.100 (2nd query TTL 86400: unchanged)
Quad9 NOERROR 16.1 ms ttl=27929 212.42.244.100
pv-cdn.net -> no-A-record
Google NOERROR 11.5 ms ttl=- (no A record)
Cloudflare NOERROR 11.1 ms ttl=- (no A record)
Quad9 NOERROR 14.8 ms ttl=- (no A record)
wa.me -> disjoint
Google NOERROR 13.5 ms ttl=60 157.240.17.60 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 9.4 ms ttl=50 157.240.17.60 (2nd query TTL 50: unchanged)
Quad9 NOERROR 15.0 ms ttl=49 157.240.0.60 (2nd query TTL 49: unchanged)
cdninstagram.com -> no-A-record
Google NOERROR 15.0 ms ttl=- (no A record)
Cloudflare NOERROR 10.1 ms ttl=- (no A record)
Quad9 NOERROR 15.7 ms ttl=- (no A record)
nginx.org -> disjoint
Google NOERROR 9.7 ms ttl=46 52.58.199.22
Cloudflare NOERROR 10.4 ms ttl=51 3.125.197.172 (2nd query TTL 13: served from cache)
Quad9 NOERROR 13.9 ms ttl=35 3.125.197.172 (2nd query TTL 7: served from cache)
akam.net -> no-A-record
Google NOERROR 31.3 ms ttl=- (no A record)
Cloudflare NOERROR 12.9 ms ttl=- (no A record)
Quad9 NOERROR 21.2 ms ttl=- (no A record)
tiktokcdn.com -> no-A-record
Google NOERROR 10.6 ms ttl=- (no A record)
Cloudflare NOERROR 8.9 ms ttl=- (no A record)
Quad9 NOERROR 14.7 ms ttl=- (no A record)
chatgpt.com -> identical
Google NOERROR 29.4 ms ttl=300 104.18.32.47, 172.64.155.209 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 10.5 ms ttl=36 104.18.32.47, 172.64.155.209 (2nd query TTL 35: served from cache)
Quad9 NOERROR 15.4 ms ttl=93 104.18.32.47, 172.64.155.209
zoom.us -> identical
Google NOERROR 17.6 ms ttl=60 170.114.52.2 (2nd query TTL 60: unchanged)
Cloudflare NOERROR 10.2 ms ttl=39 170.114.52.2
Quad9 NOERROR 14.4 ms ttl=47 170.114.52.2
tiktokv.com -> disjoint
Google NOERROR 10.5 ms ttl=12 104.126.37.129, 104.126.37.138, 104.126.37.139, 104.126.37.145, 104.126.37.153, 104.126.37.160, 104.126.37.161, 104.126.37.168, 104.126.37.185 (2nd query TTL 12: unchanged)
Cloudflare NOERROR 8.8 ms ttl=11 23.55.104.13, 23.55.104.23, 23.55.104.34, 23.55.104.35, 23.55.104.41, 23.55.104.45, 23.55.104.50, 23.55.104.57, 23.55.104.6
Quad9 NOERROR 14.9 ms ttl=14 2.18.64.13, 2.18.64.16, 2.18.64.17, 2.18.64.21, 2.18.64.22, 2.18.64.28, 2.18.64.32, 2.18.64.35, 2.18.64.4
vimeo.com -> identical
Google NOERROR 10.7 ms ttl=481 162.159.128.61, 162.159.138.60
Cloudflare NOERROR 9.5 ms ttl=785 162.159.128.61, 162.159.138.60 (2nd query TTL 785: unchanged)
Quad9 NOERROR 24.7 ms ttl=469 162.159.128.61, 162.159.138.60
edgekey.net -> no-A-record
Google NOERROR 10.4 ms ttl=- (no A record)
Cloudflare NOERROR 11.2 ms ttl=- (no A record)
Quad9 NOERROR 17.3 ms ttl=- (no A record)
baidu.com -> identical
Google NOERROR 12.7 ms ttl=600 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 104: served from cache)
Cloudflare NOERROR 10.7 ms ttl=232 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164 (2nd query TTL 201: served from cache)
Quad9 NOERROR 15.8 ms ttl=111 110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164
cloudflare-dns.com -> identical
Google NOERROR 15.4 ms ttl=300 104.16.248.249, 104.16.249.249 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 10.3 ms ttl=276 104.16.248.249, 104.16.249.249 (2nd query TTL 276: unchanged)
Quad9 NOERROR 16.0 ms ttl=148 104.16.248.249, 104.16.249.249
gvt2.com -> no-A-record
Google NOERROR 13.2 ms ttl=- (no A record)
Cloudflare NOERROR 12.9 ms ttl=- (no A record)
Quad9 NOERROR 16.5 ms ttl=- (no A record)
yandex.net -> identical
Google NOERROR 12.6 ms ttl=590 213.180.204.242 (2nd query TTL 590: unchanged)
Cloudflare NOERROR 10.7 ms ttl=244 213.180.204.242
Quad9 NOERROR 19.3 ms ttl=257 213.180.204.242
windows.com -> identical
Google NOERROR 10.5 ms ttl=3535 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171 (2nd query TTL 1892: served from cache)
Cloudflare NOERROR 9.4 ms ttl=1604 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
Quad9 NOERROR 15.1 ms ttl=21 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
root-servers.net -> no-A-record
Google NOERROR 24.2 ms ttl=- (no A record)
Cloudflare NOERROR 13.3 ms ttl=- (no A record)
Quad9 NOERROR 15.3 ms ttl=- (no A record)
openai.com -> identical
Google NOERROR 12.0 ms ttl=28 104.18.33.45, 172.64.154.211 (2nd query TTL 28: unchanged)
Cloudflare NOERROR 10.3 ms ttl=53 104.18.33.45, 172.64.154.211
Quad9 NOERROR 14.0 ms ttl=23 104.18.33.45, 172.64.154.211
gwfb.net -> no-A-record
Google NOERROR 10.6 ms ttl=- (no A record)
Cloudflare NOERROR 543.7 ms ttl=- (no A record)
Quad9 NOERROR 243.3 ms ttl=- (no A record)
ytimg.com -> no-A-record
Google NOERROR 19.2 ms ttl=- (no A record)
Cloudflare NOERROR 8.3 ms ttl=- (no A record)
Quad9 NOERROR 16.0 ms ttl=- (no A record)
workers.dev -> identical
Google NOERROR 14.5 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 12.2 ms ttl=300 104.18.12.15, 104.18.13.15 (2nd query TTL 300: unchanged)
Quad9 NOERROR 16.1 ms ttl=82 104.18.12.15, 104.18.13.15
qq.com -> identical
Google NOERROR 12.6 ms ttl=594 113.108.81.189, 123.150.76.218, 203.205.254.157
Cloudflare NOERROR 14.7 ms ttl=268 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 82: served from cache)
Quad9 NOERROR 17.3 ms ttl=598 113.108.81.189, 123.150.76.218, 203.205.254.157 (2nd query TTL 316: served from cache)
opera.com -> identical
Google NOERROR 11.0 ms ttl=226 185.26.182.103, 185.26.182.104
Cloudflare NOERROR 11.1 ms ttl=368 185.26.182.103, 185.26.182.104 (2nd query TTL 368: unchanged)
Quad9 NOERROR 29.3 ms ttl=600 185.26.182.103, 185.26.182.104 (2nd query TTL 600: unchanged)
samsung.com -> identical
Google NOERROR 11.6 ms ttl=98 211.45.27.231 (2nd query TTL 98: unchanged)
Cloudflare NOERROR 9.8 ms ttl=49 211.45.27.231 (2nd query TTL 32: served from cache)
Quad9 NOERROR 16.4 ms ttl=70 211.45.27.231
blogspot.com -> disjoint
Google NOERROR 23.6 ms ttl=300 74.125.29.191 (2nd query TTL 300: unchanged)
Cloudflare NOERROR 18.0 ms ttl=300 172.217.208.191 (2nd query TTL 300: unchanged)
Quad9 NOERROR 24.3 ms ttl=300 142.251.20.191 (2nd query TTL 291: served from cache)
mozilla.org -> identical
Google NOERROR 10.8 ms ttl=137 35.190.14.201 (2nd query TTL 96: served from cache)
Cloudflare NOERROR 12.3 ms ttl=600 35.190.14.201 (2nd query TTL 592: served from cache)
Quad9 NOERROR 15.7 ms ttl=530 35.190.14.201 (2nd query TTL 230: served from cache)
nginx.com -> identical
Google NOERROR 10.5 ms ttl=67 159.60.134.0
Cloudflare NOERROR 9.4 ms ttl=349 159.60.134.0 (2nd query TTL 87: served from cache)
Quad9 NOERROR 15.1 ms ttl=106 159.60.134.0
wordpress.com -> identical
Google NOERROR 11.0 ms ttl=126 192.0.78.17, 192.0.78.9
Cloudflare NOERROR 11.5 ms ttl=68 192.0.78.17, 192.0.78.9
Quad9 NOERROR 14.6 ms ttl=129 192.0.78.17, 192.0.78.9 (2nd query TTL 30: served from cache)
edgesuite.net -> no-A-record
Google NOERROR 9.4 ms ttl=- (no A record)
Cloudflare NOERROR 10.8 ms ttl=- (no A record)
Quad9 NOERROR 14.8 ms ttl=- (no A record)
workbox.dk -> no-A-record
Google NOERROR 12.0 ms ttl=- (no A record)
Cloudflare NOERROR 18.0 ms ttl=- (no A record)
Quad9 NOERROR 25.6 ms ttl=- (no A record)
yandex.ru -> identical
Google NOERROR 10.5 ms ttl=132 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 132: unchanged)
Cloudflare NOERROR 9.2 ms ttl=49 5.255.255.77, 77.88.44.55, 77.88.55.88
Quad9 NOERROR 15.7 ms ttl=558 5.255.255.77, 77.88.44.55, 77.88.55.88 (2nd query TTL 530: served from cache)
summary A: all 100 names
identical 46 46.0%
same-/24 1 1.0%
disjoint 28 28.0%
no-A-record 25 25.0%
summary B: the 75 names where at least two resolvers returned an address
identical 46 61.3%
same-/24 1 1.3%
disjoint 28 37.3%
Summary B is the denominator to quote. Summary A mixes two different
findings: how often resolvers disagree, and how often a name in your
list has no address to disagree about.
'disjoint' means no resolver returned an address any other resolver
returned. If your pipeline resolves names once, through one resolver,
that is the share of your dataset another resolver would have
disagreed with entirely -- from this vantage point, at this instant.
wrote out/dns/resolver_run.json
The 25 names with no A record at the apex:
25 names gtld-servers.net, akamai.net, ezviz7.com, hicloudcam.com, akamaiedge.net akadns.net, apple-dns.net, aaplimg.com, microsoftonline.com, office.net trafficmanager.net, cloudfront.net, windowsupdate.com, gvt1.com, pv-cdn.net cdninstagram.com, akam.net, tiktokcdn.com, edgekey.net, gvt2.com root-servers.net, gwfb.net, ytimg.com, edgesuite.net, workbox.dk
The 28 names with disjoint answers:
28 names google.com, gstatic.com, facebook.com, microsoft.com, googleapis.com youtube.com, instagram.com, fbcdn.net, twitter.com, googlevideo.com googletagmanager.com, wikipedia.org, whatsapp.net, googleusercontent.com appsflyersdk.com, doubleclick.net, netflix.com, youtu.be, goo.gl, x.com tiktok.com, whatsapp.com, googlesyndication.com, adobe.com, wa.me, nginx.org tiktokv.com, blogspot.com
Probes run and rejected
| Probe | Result | Why it is not on the page |
|---|---|---|
| /\bDDR\b/ for Discovery of Designated Resolvers | 30 papers, including 2 in 2010–2013 — four years before the draft existed | DDR is Double Data Rate memory. Replaced with a proximity probe requiring resolver or DNS within 60 characters, which gives 1 paper. That one paper is the PoPETs 2025 DDR study, and 1 is the number on the page. |
| /\bECS\b/ for EDNS Client Subnet | 33 papers | ECS is also Amazon Elastic Container Service. Same proximity fix; 20 corpus-wide, 16 in DNSPOP. |
| “own recursive resolver” phrasings | 1 paper | Far too narrow to support any claim. Dropped entirely; the resolver-software fold family (62 papers) is used instead, and the page makes no claim about how many papers ran their own recursive server. |
| /\bdot\b/ as a DoT alternative | Matched Droidot, Godot, OleViewDot-Net and every “dot” in prose | Never used. The DoT row uses the spelled-out phrase only, which is why its counts are conservative. |
| A “which resolver did the paper use” schema query | No such field exists | The schema has no place for it, and a full-text probe for resolver IP literals (69 papers naming 8.8.8.8 or similar) is an upper bound on mentions, not on use. No reporting-rate claim is made about resolver identification. This is the single biggest thing the corpus cannot answer for this page. |
Judgement calls
design:dnsrather thansecurity:dnsor a child ofsecurity:tls_certificates. The task nameddesign:dns, and the reasoning holds: this is an instrument-selection question, a sibling of ip_classification (“what is this address”) and automated_measurements (“which instrument”), not a deployment-security question. The TLS page answers “what does this host present after you connect”; nothing on it covers resolution, and stretching it would have been the wrong page. A reasonable person could have put it undersecurity:.- No child pages.
design:dns:encrypted_dns(48 DoH papers in DNSPOP) anddesign:dns:passive_dns(65) are each large enough to survive as a page, and both were declined. Encrypted DNS is a five-row table because the interesting content is the dating, which only works when the protocols sit beside each other; passive DNS is a four-row table because the interesting content is which vendor still exists. Splitting either would produce two pages that each need the other's context. Revisit when DoQ or DDR has more than one or two papers. prevalencefigures are quoted only after being re-found in the paper. Four of the figures first drafted fromdetection[].prevalencedid not survive; see the table above. Every remaining per-paper figure on the page has a needle inverify_dns_figures.mjs.- The seven lab-rig papers stay in the population. They used a DNS-specific instrument, which is what the rule says. Removing them would make the rule a judgement. Publishing the count is the compromise.
- Posters (14 of 244) are not excluded. The page's headline claims are not reporting-gap rates where poster brevity would bias the result upward; the vantage-location and version figures are, so the poster count is stated next to the population.
- The 2010 Ager result leads failure mode 1 even though it is sixteen years old. It is the cleanest statement of a property that has not changed, and the script's own run is the current evidence beside it. The page says both.
security:tls_certificateswas not edited. automated_measurements routes “DNS” to that page and to ip_classification; both routings are now wrong. The parent's routing table was corrected to point here. The TLS page itself says nothing about DNS and needed no change.
Wiki wiring
| Page | Change |
|---|---|
| dns | created |
| dns | created (this page) |
| bibliography | 23 entries appended before </bibtex>, from a fresh ?do=export_raw. Zero key collisions, zero DOI collisions, zero URL collisions, zero title collisions against the 632 live entries. Cache purged afterwards; the page renders 29 references against 29 distinct citekeys with no unresolved warnings. |
| design | DNS row added to the namespace table and the page count corrected |
| automated_measurements | the scan row of the routing table now points at dns for DNS rather than at the TLS and IP pages |
Review log
Reviews had not been run when this page was first assembled. If you are reading this sentence on the live wiki, the review pass did not happen and the page should be treated accordingly.
Files
| Path | What |
|---|---|
scripts/dns_fold.mjs | The fold. Ordered families, keyed exceptions, one guarded family (Rapid7), 84 self-tests, residue printed by the report. |
scripts/report_dns.mjs | Every corpus figure with its denominator. Exits 1 if the corpus contracts or the fold self-tests fail. --list a|b|bonly|aonly|pop|web, --quotes <re>. |
scripts/verify_dns_figures.mjs | 29 per-paper needles against paper.cols.txt, plus the non-corpus figure blocks and the normalisation record. |
scripts/external_checks_dns.sh + scripts/dnschk/ | Every external fact, re-runnable. |
scripts/dns_snip.mjs | Prints the sentence around a regex in a paper, whitespace collapsed. How the quote rewrites above were made. |
scripts/build_dns_codeblock.mjs | Regenerates the page's <code> block from the run output. |
pages/resolver_disagreement.py | The published script. |
out/dns/ | report.txt, verify.txt, external.txt, resolver_run.txt, resolver_run.json, bonly_audit_raw.txt, tool_candidates.txt, tranco100.txt. |
provenance/design/dns.1787870780.txt.gz · Last modified: by karel.kubicek.claude