Working notes behind dns: every query, every fold, every quote check, every external fetch, and every call that could reasonably have gone the other way. Corpus-level caveats — the venue funnel, the 2025–2026 provisional years, the extraction's own stability — are on corpus and are not restated here.

This page is a log, not prose. It is for someone checking a number.

The rule was fixed before the first count, because a curated set whose boundary is decided after the tables exist re-derives every table on the first awkward find.

• A — DNS is the subject. title or slug matches /\bdns(?:sec)?\b|\bdns-over-|\bdoh\b|\bnxdomain\b|\bodoh\b|\bdoq\b|\bopendns\b|\bzdns\b|\bmassdns\b|\bresolver/i
• B — DNS is the instrument. The paper has a tools[] entry with usedOrMentioned in {used, produced} whose name the fold maps to a kind in DNS_KINDS = {query-tool, passive-dns, resolver-software, public-resolver, dnssec-tool, open-resolver-census, custom}.
• DNSPOP = A ∪ B. This is the page's population.
• C — ambient. Full text matches /\bDNS(?:SEC)?\b/. Reported as an upper bound; never used as a denominator for a claim about DNS research.
• WEB = DNSPOP ∩ platforms contains web.

Deliberately excluded from B, and why:

The rule is that scripts/report_dns.mjs prints every corpus figure with its denominator, scripts/verify_dns_figures.mjs prints every per-paper figure with the needle it was checked against, scripts/external_checks_dns.sh prints every external fact with the command that produced it, and out/dns/resolver_run.txt is the script run. node scripts/check_page_numbers.mjs pages/design_dns.txt out/dns/allsources.txt over the whole page (no section window) reports:

OK — every figure in the page traces to out/dns/allsources.txt

=== design:dns — every figure with its denominator ===
corpus 5859 papers, 7 venues, 2010–2026. Contracts: OK.
dns_fold self-tests: 85/85 pass.

--- A. POPULATION ---
A  DNS in title/slug            108
B  used/produced a DNS instrument 202
   A ∩ B                        66
   A only (subject, no DNS tool named) 42
   B only (instrument, not titled)     136
DNSPOP = A ∪ B                  244   <- the page's population
   of which posters             14
   lab-rig instrument uses (hand-read, stay in the population) 7
C  full text matches /\bDNS(SEC)?\b/  1218  (20.8% of 5855 readable) — UPPER BOUND, not the population
   full text missing for         4 papers
WEB  DNSPOP ∩ platform 'web'     82  (33.6% of DNSPOP; 5.1% of the 1622 web-platform papers)
     DNSPOP ∩ crawled            44
     DNSPOP ∩ network-scan-or-probe 186

--- B. WHERE DNS WORK PUBLISHES (share of that venue's own output) ---
venue      papers   DNSPOP  share    A(titled)  share
CCS           990      26    2.6%        13    1.3%
IEEE-SP       767      17    2.2%         6    0.8%
IMC           638      84   13.2%        40    6.3%
NDSS          701      26    3.7%         7    1.0%
PETS          510      14    2.7%         7    1.4%
USENIX       1410      61    4.3%        28    2.0%
WWW           843      16    1.9%         7    0.8%
  share of DNSPOP in {IMC}: 84 / 244 = 34.4%
  share of DNSPOP in {IMC, USENIX, NDSS}: 171 / 244 = 70.1%
  share of DNSPOP in {WWW, PETS}: 30 / 244 = 12.3%
  share of DNSPOP in {CCS, IEEE-SP}: 43 / 244 = 17.6%

--- C. OVER TIME (both ends bounded; 2025–2026 provisional) ---
window       papers  DNSPOP  share   A(titled)  share
2010–2013       511      16    3.1%         8    1.6%
2014–2017       769      39    5.1%        13    1.7%
2018–2021      1439      76    5.3%        36    2.5%
2022–2024      1955      74    3.8%        33    1.7%
2025–2026*     1185      39    3.3%        18    1.5%
unbucketed years: 0

--- D. WHAT SHAPE THESE STUDIES ARE (denominator: DNSPOP) ---
studyTypes (multi-valued; the least stable field in the schema — ranking only), N=244
   186   76.2%  network-scan-or-probe
   146   59.8%  existing-dataset-analysis
   108   44.3%  system-or-defence-proposal
    83   34.0%  manual-audit
    52   21.3%  code-or-binary-analysis
    40   16.4%  automated-web-crawl
    16    6.6%  interview-or-survey
    14    5.7%  mobile-app-analysis
    11    4.5%  user-study
     7    2.9%  simulation-or-theory-only
platforms (multi-valued), N=244
   218   89.3%  other-online-service
    82   33.6%  web
    24    9.8%  offline
    21    8.6%  mobile
     9    3.7%  iot
     1    0.4%  not-applicable

--- E. INSTRUMENT INVENTORY (denominator: DNSPOP unless stated) ---

[query-tool] union 60 papers corpus-wide, 60 of them in DNSPOP — IN population
    18 papers    6 spellings  dig / drill / nslookup / tor-resolve
    16 papers   13 spellings  DNS libraries (dnspython, ldns, miekg/dns, getdns)
    13 papers    2 spellings  ZDNS
     7 papers    1 spellings  DNS fingerprinting (fpdns)
     5 papers    2 spellings  massdns
     4 papers    4 spellings  DoH/DoT client tooling
     2 papers    2 spellings  reverse-DNS lookup

[passive-dns] union 65 papers corpus-wide, 65 of them in DNSPOP — IN population
    28 papers   16 spellings  Farsight DNSDB / DomainTools (passive DNS)
    14 papers    2 spellings  OpenINTEL
     8 papers    8 spellings  other passive-DNS feeds
     8 papers    7 spellings  Rapid7 Open Data (FDNS/RDNS)
     4 papers    5 spellings  Chinese passive-DNS feeds (360, 114DNS)
     3 papers    3 spellings  zone files / CZDS
     2 papers    2 spellings  Active DNS Project
     1 papers    1 spellings  DNS Observatory

[resolver-software] union 62 papers corpus-wide, 62 of them in DNSPOP — IN population
    29 papers   11 spellings  BIND
    25 papers    4 spellings  Unbound
    11 papers    2 spellings  PowerDNS
     9 papers    2 spellings  dnsmasq
     7 papers    2 spellings  Knot
     5 papers    2 spellings  Microsoft DNS / Simple DNS Plus
     5 papers    2 spellings  NSD
     3 papers    2 spellings  MaraDNS
     2 papers    1 spellings  djbdns / dnscache
     2 papers    2 spellings  B-Root
     2 papers    1 spellings  CoreDNS
     2 papers    3 spellings  systemd-resolved
     1 papers    1 spellings  hnsd (Handshake)
     1 papers    1 spellings  gdnsd

[public-resolver] union 29 papers corpus-wide, 29 of them in DNSPOP — IN population
    16 papers    6 spellings  Google Public DNS
     9 papers    1 spellings  OpenDNS / Cisco Umbrella
     6 papers    2 spellings  Cloudflare DNS
     5 papers    3 spellings  other public resolvers (Comodo, CleanBrowsing, Quad9)
     2 papers    1 spellings  NextDNS
     2 papers    2 spellings  public-resolver lists

[dnssec-tool] union 3 papers corpus-wide, 3 of them in DNSPOP — IN population
     3 papers    3 spellings  DNSViz and DNSSEC validators

[open-resolver-census] union 1 papers corpus-wide, 1 of them in DNSPOP — IN population
     1 papers    1 spellings  Open Resolver Project

[custom] union 34 papers corpus-wide, 34 of them in DNSPOP — IN population
    34 papers   34 spellings  home-grown DNS code

[scanner-generic] union 156 papers corpus-wide, 38 of them in DNSPOP — reported only, NOT in the population rule
   112 papers   13 spellings  ZMap / XMap
    33 papers    4 spellings  Scapy
    31 papers    6 spellings  ZGrab

[vantage-platform] union 77 papers corpus-wide, 24 of them in DNSPOP — reported only, NOT in the population rule
    75 papers    6 spellings  RIPE Atlas
     2 papers    1 spellings  MobileAtlas

--- E2. FAMILY DETAIL FOR THE FAMILIES THE PAGE DESCRIBES IN PROSE ---

  DNS fingerprinting (fpdns): 7 papers
    by year: 2018:1 2023:3 2024:3
    by spelling: fpdns x7
    in DNSPOP: 7, of which IMC: 0

  DNSViz and DNSSEC validators: 3 papers
    by year: 2014:1 2023:1 2025:1
    by spelling: DNSViz x2 | Extended DNSSEC Validator x1 | DNSSEC-downgrade tool x1
    in DNSPOP: 3, of which IMC: 1

  dig / drill / nslookup / tor-resolve: 18 papers
    by year: 2010:2 2015:2 2019:4 2020:2 2021:4 2023:1 2024:1 2025:2
    by spelling: dig x12 | nslookup x2 | Dig x1 | host name matching tool x1 | drill x1 | tor-resolve x1
    in DNSPOP: 18, of which IMC: 7

  RIPE Atlas: 75 papers
    by year: 2015:4 2016:6 2017:7 2018:10 2019:5 2020:10 2021:5 2022:7 2023:5 2024:5 2025:6 2026:5
    by spelling: RIPE Atlas x72 | RIPE Atlas API x2 | RIPE Atlas REST API x1 | RIPE Atlas streaming API x1 | RIPE Atlas measurement platform x1 | RIPE Atlas probes x1
    in DNSPOP: 24, of which IMC: 21

  MobileAtlas: 2 papers
    by year: 2023:1 2025:1
    by spelling: MobileAtlas x2
    in DNSPOP: 0, of which IMC: 0

Sum of family paper counts is NOT the union: a paper naming BIND and Unbound is in both rows.

--- F. FOLD RESIDUE AND WHAT WAS DELIBERATELY EXCLUDED ---
candidate tool tuples matched by the loose sweep: 976
unmapped residue: 2 distinct strings, 2 tuples
    1  "IEEE Organizationally Unique Identifier registry"
    1  "Chrome DevTools Protocol Network domain"

mapped but excluded from the population rule (papers):
   113  adjacent:registry-metadata — WHOIS / RDAP
   112  scanner-generic — ZMap / XMap
    75  vantage-platform — RIPE Atlas
    52  adjacent:registry-metadata — Public Suffix List / TLD lists
    50  offtopic:speech — speech recognition / synthesis
    46  offtopic:hardware — lab hardware matching /dot|host|dig/
    33  scanner-generic — Scapy
    31  scanner-generic — ZGrab
    21  offtopic:annotation — ATLAS.ti
    18  offtopic:blocklist — domain blocklists
    13  offtopic:ml — ML models matching /bind|nsd|dot/
    11  adjacent:categorisation — domain categorisation services
     7  adjacent:registrar — registrar and domain-shopping APIs
     6  offtopic:nlp — part-of-speech tagging
     4  adjacent:registry-metadata — DomainTools WHOIS archive
     4  adjacent:name-analysis — domain-string analysis (DGA detection, shadowing)
     3  adjacent:typosquatting — dnstwist
     2  offtopic:blocklist — DNS-based lists (DNSBL / DNSEL)
     2  adjacent:categorisation — OpenDNS/Umbrella as a categoriser
     2  offtopic:blocklist — NextDNS blocklist
     2  vantage-platform — MobileAtlas
     1  offtopic:misc — Graphviz DOT
     1  adjacent:geolocation — RIPE IPmap
     1  adjacent:mdns — multicast DNS
     1  offtopic:database — MongoDB Atlas
     1  offtopic:misc — hand-excluded homograph

--- G. ENCRYPTED DNS AND WHEN IT ARRIVED (denominator: whole corpus per bucket) ---
Full-text sweeps, paper-counted. These are UPPER BOUNDS on "the paper engages
with this": a single sentence in related work counts. Read them as arrival dates.
protocol                                    2010–2013  2014–2017  2018–2021  2022–2024 2025–2026*     total
DoH  (DNS-over-HTTPS)                           0/510      0/768    30/1437    34/1955    18/1185        82
DoT  (DNS-over-TLS)                             0/510      0/768    27/1437    13/1955     7/1185        47
DoQ  (DNS-over-QUIC)                            0/510      0/768     4/1437     4/1955     2/1185        10
ODoH (Oblivious DoH)                            0/510      0/768     7/1437     5/1955     2/1185        14
DDR  (Discovery of Designated Resolvers)        0/510      0/768     0/1437     0/1955     1/1185         1
DNSSEC                                          7/510     25/768    51/1437    53/1955    25/1185       161
ECS  (EDNS Client Subnet)                       1/510      3/768    11/1437     3/1955     2/1185        20
DNSCurve / DNSCrypt                             0/510      1/768     8/1437     2/1955     1/1185        12

Same sweeps restricted to DNSPOP (the papers that are actually about DNS):
protocol                                    2010–2013  2014–2017  2018–2021  2022–2024 2025–2026*     total
DoH  (DNS-over-HTTPS)                            0/16       0/39      23/76      16/74       9/39        48
DoT  (DNS-over-TLS)                              0/16       0/39      23/76       7/74       4/39        34
DoQ  (DNS-over-QUIC)                             0/16       0/39       4/76       1/74       1/39         6
ODoH (Oblivious DoH)                             0/16       0/39       5/76       4/74       2/39        11
DDR  (Discovery of Designated Resolvers)         0/16       0/39       0/76       0/74       1/39         1
DNSSEC                                           3/16      12/39      36/76      37/74      16/39       104
ECS  (EDNS Client Subnet)                        1/16       2/39       9/76       3/74       1/39        16
DNSCurve / DNSCrypt                              0/16       1/39       8/76       1/74       1/39        11

--- H. WHAT A DNS PAPER SAYS ABOUT ITS OWN METHOD ---

names a vantage location
  DNSPOP                                   124 /   244    50.8%
    A (titled)                              63 /   108    58.3%
    B-only (instrument)                     61 /   136    44.9%
  scan branch (network-scan-or-probe)      487 /   930    52.4%
  crawled population                       301 /  1120    26.9%

names any used/produced tool version
  DNSPOP                                   103 /   244    42.2%
    A (titled)                              46 /   108    42.6%
    B-only (instrument)                     57 /   136    41.9%
  scan branch (network-scan-or-probe)      401 /   930    43.1%
  crawled population                       506 /  1120    45.2%

states artifacts.availability (non-sentinel, non-none)
  DNSPOP                                   124 /   244    50.8%
    A (titled)                              57 /   108    52.8%
    B-only (instrument)                     67 /   136    49.3%
  scan branch (network-scan-or-probe)      511 /   930    54.9%
  crawled population                       721 /  1120    64.4%

vantage.locations, folded count of DISTINCT stated location strings per paper (DNSPOP):
  0 (none stated)   120  49.2%
  1                  46  18.9%
  2–3                40  16.4%
  4–10               35  14.3%
  >10                 3  1.2%

ethics (denominator: DNSPOP ∩ empirical):
  ethics.reviewOutcome                      72 /   241    29.9%
  ethics.harmMitigation                    186 /   241    77.2%
  ethics.notifiedAffectedParties           147 /   241    61.0%
  ethics.regulatorContact                  132 /   241    54.8%

ethics, DNS population vs the whole empirical corpus:
  ethics.reviewOutcome           DNS   72/241   29.9%   corpus  1728/5118   33.8%
  ethics.harmMitigation          DNS  186/241   77.2%   corpus  3186/5118   62.3%
  ethics.notifiedAffectedParties DNS  147/241   61.0%   corpus  2354/5118   46.0%
  ethics.regulatorContact        DNS  132/241   54.8%   corpus  2129/5118   41.6%

ethics.robotsTxt over the crawled population: 53 / 1120 = 4.7%

amplification/reflection full-text probe over DNSPOP: 58 / 244
  of which say so in the title or slug: 15
open-resolver full-text probe over DNSPOP: 54 / 244

--- H2. LLM PROBE OVER DNSPOP (case-sensitive; a hit is not a method) ---
regex: /\b(?:LLM|large language model|GPT-[345]|ChatGPT|Llama|Gemini|Claude)\b/
papers: 16 / 244
by window: 2010–2013 0   2014–2017 0   2018–2021 3   2022–2024 5   2025–2026* 8
case-INsensitive, for contrast: 19 papers, by window 0/0/3/7/9
The four roles below are HAND-READ verdicts over all of the case-sensitive hits,
not a further probe. They are listed with their deciding text on the provenance page.
  2020/NDSS/flowprint-semi-supervised-mobile-app-fingerprinting-on-encrypted-network-traffic
  2021/IMC/the-far-side-of-dns-amplification-tracing-the-ddos-attack-ecosystem-from-the-int
  2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion
  2022/IMC/investigating-the-impact-of-ddos-attacks-on-dns-infrastructure
  2023/PETS/heads-in-the-clouds-measuring-universities-migration-to-public-clouds-implicatio
  2024/CCS/poster-dohunter-a-feature-fusion-based-llm-for-doh-tunnel-detection
  2024/USENIX/guardians-of-the-galaxy-content-moderation-in-the-interplanetary-file-system
  2024/IEEE-SP/practical-attacks-against-dns-reputation-systems
  2025/USENIX/dns-flare-a-flush-reload-attack-on-dns-forwarders
  2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u
  2025/IMC/fishing-for-smishing-understanding-sms-phishing-infrastructure-and-strategies-by
  2026/NDSS/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles
  2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr
  2026/USENIX/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web
  2026/WWW/unveiling-the-resilience-of-llm-enhanced-search-engines-against-black-hat-seo-ma
  2026/WWW/starlink-in-the-wild-multi-perspective-measurements-via-dns

--- I. MEASURED RESULTS IN THE POPULATION (detection[].prevalence) ---
DNS-named detection tuples carrying a numeric prevalence: 536 across 193 of 244 DNSPOP papers (79.1%).
prevalence is a MODEL SUMMARY of the paper's result, not a quote. Every figure
quoted on the page was re-checked against paper.cols.txt — see verify_dns_figures.mjs.

scripts/dns_fold.mjs. Ordered families, first match wins, keyed exceptions before the family that would swallow them. Three problems it exists to solve, all found by reading the strings rather than by guessing:

1. A candidate sweep loose enough to catch the real instruments catches everything. It has to match hnsd, ldns, resolvectl, miekg/dns and gdnsd, and any regex that loose also matches DeepSpeech (via /ech\b/), ImageBind and LanguageBind (/bind\b/), TransD (/nsd\b/), ATLAS.ti and MongoDB Atlas (/atlas/), every part-of-speech tagger, and Ghost.py / CyberGhost VPN (/host\b/). Those get named offtopic: families so the discard is a number, not a silence.
2. One brand, several products. OpenDNS is a public resolver and a website categorisation service, and the corpus uses it both ways. NextDNS is a resolver and a published blocklist. DomainTools sells passive DNS and a WHOIS archive. Keyed exceptions run first.
3. A name that cannot be resolved from the name. Rapid7 Open Data is four datasets under one brand (FDNS, RDNS, SSL certificates, TCP/UDP liveness) and half the corpus tuples say only Rapid7 or Rapid7 Sonar. The Rapid7 family therefore carries a guard regex tested against name + the extractor's purpose sentence, requiring /dns/i. The candidate regex matches 13 tuples under 11 distinct spellings; all 13 were read by hand and the guard decides all 13 the way the reading did:

One keyed (name, category) exclusion that no name regex can make: DIG with category == “program-analysis” (IEEE S&P 2024, Everything is Good for Something) is a likely-invariant inference engine, purpose “Likely-invariant inference engine”, not dig(1).

Seven mis-bucketings found by reading the instrument-only list and the folded family listings, and fixed in the fold, each of which would have added a non-DNS paper to the population: Khost (a KVM firmware-rehosting tool, matched a khost alternative that should never have been there), XMLdig-to-CSV converter (oscilloscope traces), DNSCAN (a clustering algorithm in a backdoor-forensics paper), USB2SOFT USB 2.0 device SIE (matched /\bsie\b/ intended for Farsight's Security Information Exchange), Rapid7 NeXpose, and DIG. A seventh, “Miek Gieben's DNS implementation”, was landing in the home-grown family via a generic /dns.*implementation/ alternative when it is in fact miekg/dns, the Go library; that moved home-grown from 35 papers to 34 and DNS libraries from 15 to 16, and it is why the page's home-grown claim is worded as “almost no two called it the same thing” rather than as a clean 35/35.

Loose candidate sweep over tools[] (used or produced), regex:

/dns|resolver|bind\b|unbound|knot|nsd\b|powerdns|maradns|dnsmasq|djbdns|dnscache|zone ?file|czds|openintel|farsight|dnsdb|passive ?dns|massdns|zmap|xmap|zgrab|dig\b|kdig|drill\b|nslookup|host\b|ripe ?atlas|atlas|whois|rdap|public suffix|psl\b|domain|tld|registr|doh|dot\b|doq|odoh|ech\b|adns|getdns|dnspython|scapy|resolv/i

976 candidate tuples. 2 unmapped, both off-topic: “IEEE Organizationally Unique Identifier registry” (1 tuple) and “Chrome DevTools Protocol Network domain” (1 tuple). Neither is a DNS instrument and neither is in the population.

Section F of the report prints the residue and the full table of mapped-but-excluded families with their paper counts.

Each was read as (tool name, extractor purpose sentence). The dump is out/dns/bonly_audit_raw.txt. The overwhelming majority are genuine: resolving a name list with ZDNS or massdns, pulling history out of Farsight or OpenINTEL, standing up BIND or Unbound to test cache behaviour, querying public resolvers for comparison.

Seven are a DNS server inside an attack or lab rig rather than a measurement of DNS in the world. They stay in the population — they did use a DNS-specific instrument, and excluding them would need a judgement the rule does not encode — but the count is published on the page so a reader can subtract it. The list, with the deciding purpose, is the LAB_RIG map in report_dns.mjs; the report prints HAND-MAP STALE if any of them leaves the population:

/\b(?:LLM|large language model|GPT-[345]|ChatGPT|Llama|Gemini|Claude)\b/ over the 244 gives 16 papers, 0 / 0 / 3 / 5 / 8 across the five windows. A probe hit is not a method, so all sixteen were read:

Conclusion published on the page, and the reason it is worded the way it is: an LLM is a defensible labelling aid for hostname semantics; it is not current practice for classifying DNS behaviour on this evidence; and the years the signal lives in (2025–2026) are the provisional ones. The page says so in the same sentence as the counts.

scripts/verify_dns_figures.mjs checks every literal per-paper figure and every quoted sentence against paper.cols.txt with whitespace collapsed, smart quotes folded and dashes normalised. 31 needles, 0 not found (30 located in paper.cols.txt, 1 in paper.pdf only — see the box below). Unedited output:

ok    [.cols] 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the
        259 of the 3,047 ASes (8.5%) that we inspect exhibit DNS interception behavior
ok    [.cols] 2018/USENIX/who-is-answering-my-queries-understanding-and-characterizing-interception-of-the
        148,478 residential and cellular IP addresses
ok    [.cols] 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement
        that 37% of IPs across 56% ASes measured show some change in censorship behavior depending on source port and local source IP
ok    [.cols] 2022/USENIX/many-roads-lead-to-rome-how-packet-headers-influence-dns-censorship-measurement
        This behavior is frequently all-or-nothing
ok    [.cols] 2017/USENIX/global-measurement-of-dns-manipulation
        41,778 responses (0.31%) as manipulated, spread across 58 countries
ok    [.cols] 2017/USENIX/global-measurement-of-dns-manipulation
        1,408 domains
ok    [.cols] 2017/USENIX/global-measurement-of-dns-manipulation
        13,594,683 DNS responses
ok    [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
        17 TLS proxy vendors in 52 countries
ok    [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
        55 ASes in 26 countries with ISP-level DNS manipulation
ok    [.cols] 2023/PETS/certainty-detecting-dns-manipulation-at-scale-using-tls-certificates
        previous work using consistency-based heuristics is inaccurate, allowing for 72.45% false positives in the cases detected as DNS manipulation
ok    [.cols] 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement
        90K lookups per second when using an external recursive resolver
ok    [.cols] 2022/IMC/zdns-a-fast-dns-toolkit-for-internet-measurement
        solves 50M domains in 10 minutes
ok    [.cols] 2021/PETS/the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasion
        we detected a total of 10,474 websites (eTLD+1) that used at least one of the trackers
ok    [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild
        fer in terms of subnets for approximately 2, 000 out of our
ok    [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild
        10, 000 host names. In half of these cases, the returned IP
ok    [.cols] 2010/IMC/comparing-dns-resolvers-in-the-wild
        addresses even belong to di
ok    [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
        3382 out of 4147 resolvers in the CDN dataset send 100% of their A and AAAA queries with an ECS option
ok    [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
        103 recursive resolvers, or over half of all recursive resolvers we could study
ok    [.cols] 2019/IMC/a-look-at-the-ecs-behavior-of-dns-resolvers
        don't control caching based on scope at all
ok    [.cols] 2015/IMC/going-wild-large-scale-classification-of-open-dns-resolvers
        find up to 20 million open resolvers in the weekly IPv4 scans
ok    [.cols] 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli
        In over 99 % of observed cases
ok    [.cols] 2025/PETS/path-to-encrypted-dns-with-ddr-adoption-configuration-patterns-and-privacy-impli
        DDR-compliant clients may fail to upgrade to DoE due to
ok    [.cols] 2021/IMC/home-is-where-the-hijacking-is-understanding-dns-interception-by-residential-rou
        occurrences of such trans- 3 parent interception
ok    [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
        domains with high accuracy in closed and open world settings, using 124 times less data than attacks on HTTPS flows
ok    [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
        We can identify resolvers
ok    [.cols] 2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective
        with 95% accuracy
WEAK NEEDLE    2020/NDSS/encrypted-dns-privacy-a-traffic-analysis-perspective: "with 95% accuracy" — short enough to match by accident
ok    [PDF only] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers
        73% of all participants reported having heard of DNS before the survey
ok    [.cols] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers
        ipants who reported having heard of DNS, only 59.9% had
ok    [.cols] 2023/USENIX/user-awareness-and-behaviors-concerning-encrypted-dns-settings-in-web-browsers
        85 (79.4%) had the default
ok    [.cols] 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u
        naive LLM-based prompt engineering
ok    [.cols] 2025/IMC/decoding-dnssec-errors-at-scale-an-automated-dnssec-error-resolution-framework-u
        concrete, verifiably correct fixes

31 needles checked, 0 not found, 0 papers unreadable.

--- QUOTES THE PAGE NORMALISES (source spelling -> page spelling) ---
  "2 , 000" -> "2,000"   (stray space in both the .cols rendering and the PDF (Ager et al., IMC 2010))
  "10, 000" -> "10,000"   (stray space in both the .cols rendering and the PDF (Ager et al., IMC 2010))
  "dif- fer" -> "differ"   (line-break hyphenation (Ager et al., IMC 2010))

--- FIGURES ON THE PAGE THAT ARE NOT FROM A CITED PAPER ---
  population, venue, year, study-shape and web-slice counts
      <- report_dns.mjs sections A-D
  composite venue shares stated in prose
      <- report_dns.mjs section B
  instrument family counts, spelling counts, per-family year detail
      <- report_dns.mjs sections E and E2
  fold residue, candidate-tuple count, fold self-test count
      <- report_dns.mjs section F and `node scripts/dns_fold.mjs`
  encrypted-DNS per-window probe counts
      <- report_dns.mjs section G
  reporting-gap, vantage-bucket, ethics and amplification figures
      <- report_dns.mjs section H
  LLM probe counts, case-sensitive and case-insensitive
      <- report_dns.mjs section H2
  the 7 lab-rig papers
      <- the LAB_RIG hand map in report_dns.mjs, which the report cross-checks
  robots.txt reporting rate for the crawled population
      <- data/extract/OVERVIEW.md, "Where the field goes quiet"
  every resolver-run figure: verdict tallies, both summary denominators, TTLs
      <- out/dns/resolver_run.txt and resolver_run.json, from pages/resolver_disagreement.py
  the Tranco list id
      <- tranco-list.eu, fetched 2026-08-27; recorded in the provenance page
  RFC numbers, dates, statuses and obsoleted-by
      <- external_checks_dns.sh, RFC block
  tool versions, release and push dates, archived state, git tags
      <- external_checks_dns.sh, GitHub/PyPI/Go-proxy blocks
  vendor state: Farsight resolution, dnsdb.info and Rapid7 redirect targets, dataset dates
      <- external_checks_dns.sh, Farsight and Rapid7 blocks
  Firefox trr prefs and the DoH provider records
      <- external_checks_dns.sh, Firefox blocks
  the APNIC DDR figures and the ANRW Crossref record
      <- external_checks_dns.sh, APNIC and ANRW blocks

This block names artefacts, not values. Run the named artefact for the number.

Where the extraction's prevalence did not survive the check. detection[].prevalence is a model summary of a result, not a quote, and four figures taken from it could not be located in the paper and were rewritten from the paper's own words before publication:

The fourth is the one to remember: the extraction had fused two findings into one sentence, and quoting it would have invented a claim the paper does not make.

One figure was dropped, not rewritten. The extraction reports “49 out of 220 intercepted probes” for Randall et al. (IMC 2021). Neither number could be located in paper.cols.txt by any probe tried. The page quotes the paper's own abstract claim (“over 200 occurrences of such transparent interception”) instead and makes no 49/220 claim.

One quote is normalised and says so on the page. Ager et al. (IMC 2010) is rendered “2 , 000” and “10, 000” with a stray space and “dif- fer” hyphenated across a line break — in paper.cols.txt and in a pypdf re-extraction of paper.pdf, so it is the source's own typesetting, not a column-repair artefact. The page carries a footnote saying so.

scripts/external_checks_dns.sh. Every check prints FAILED explicitly, so a 403 or a rate limit cannot read as a pass. Unedited output:

== run date (UTC)
2026-08-27T23:07:52Z

== RFCs the page names: status, obsoleted-by, updated-by
RFC1034   November 1987  INTERNET STANDARD  obs_by=-          upd_by=RFC1101,RFC1183,RFC1348,RFC1876,RFC1982,RFC2065,RFC2181,RFC2308,RFC2535,RFC4033,RFC4034,RFC4035,RFC4343,RFC4592,RFC5936,RFC8020,RFC8482,RFC8767,RFC9471 Domain names - concepts and facilities
RFC1035   November 1987  INTERNET STANDARD  obs_by=-          upd_by=RFC1101,RFC1183,RFC1348,RFC1876,RFC1982,RFC1995,RFC1996,RFC2065,RFC2136,RFC2137,RFC2181,RFC2308,RFC2535,RFC2673,RFC2845,RFC3425,RFC3658,RFC4033,RFC4034,RFC4035,RFC4343,RFC5936,RFC5966,RFC6604,RFC7766,RFC8482,RFC8490,RFC8767,RFC9619 Domain names - implementation and specification
RFC2181   July 1997      PROPOSED STANDARD  obs_by=-          upd_by=RFC2535,RFC4033,RFC4034,RFC4035,RFC4343,RFC5452,RFC8767 Clarifications to the DNS Specification
RFC4033   March 2005     PROPOSED STANDARD  obs_by=-          upd_by=RFC6014,RFC6840 DNS Security Introduction and Requirements
RFC4034   March 2005     PROPOSED STANDARD  obs_by=-          upd_by=RFC4470,RFC6014,RFC6840,RFC6944,RFC9077,RFC9824,RFC9905 Resource Records for the DNS Security Extensions
RFC4035   March 2005     PROPOSED STANDARD  obs_by=-          upd_by=RFC4470,RFC6014,RFC6840,RFC8198,RFC9077,RFC9520,RFC9824 Protocol Modifications for the DNS Security Extensions
RFC5001   August 2007    PROPOSED STANDARD  obs_by=-          upd_by=-            DNS Name Server Identifier (NSID) Option
RFC6891   April 2013     INTERNET STANDARD  obs_by=-          upd_by=-            Extension Mechanisms for DNS (EDNS(0))
RFC7766   March 2016     PROPOSED STANDARD  obs_by=-          upd_by=RFC8490,RFC9103 DNS Transport over TCP - Implementation Requirements
RFC7858   May 2016       PROPOSED STANDARD  obs_by=-          upd_by=RFC8310      Specification for DNS over Transport Layer Security (TLS
RFC7871   May 2016       INFORMATIONAL      obs_by=-          upd_by=-            Client Subnet in DNS Queries
RFC8310   March 2018     PROPOSED STANDARD  obs_by=-          upd_by=-            Usage Profiles for DNS over TLS and DNS over DTLS
RFC8484   October 2018   PROPOSED STANDARD  obs_by=-          upd_by=-            DNS Queries over HTTPS (DoH)
RFC8499   January 2019   BEST CURRENT PRACTICE obs_by=RFC9499    upd_by=-            DNS Terminology
RFC8767   March 2020     PROPOSED STANDARD  obs_by=-          upd_by=-            Serving Stale Data to Improve DNS Resiliency
RFC8914   October 2020   PROPOSED STANDARD  obs_by=-          upd_by=-            Extended DNS Errors
RFC9156   November 2021  PROPOSED STANDARD  obs_by=-          upd_by=-            DNS Query Name Minimisation to Improve Privacy
RFC9230   June 2022      EXPERIMENTAL       obs_by=-          upd_by=-            Oblivious DNS over HTTPS
RFC9250   May 2022       PROPOSED STANDARD  obs_by=-          upd_by=-            DNS over Dedicated QUIC Connections
RFC9276   August 2022    BEST CURRENT PRACTICE obs_by=-          upd_by=-            Guidance for NSEC3 Parameter Settings
RFC9460   November 2023  PROPOSED STANDARD  obs_by=-          upd_by=-            Service Binding and Parameter Specification via the DNS 
RFC9462   November 2023  PROPOSED STANDARD  obs_by=-          upd_by=-            Discovery of Designated Resolvers
RFC9463   November 2023  PROPOSED STANDARD  obs_by=-          upd_by=-            DHCP and Router Advertisement Options for the Discovery 
RFC9499   March 2024     BEST CURRENT PRACTICE obs_by=-          upd_by=-            DNS Terminology
RFC9520   December 2023  PROPOSED STANDARD  obs_by=-          upd_by=-            Negative Caching of DNS Resolution Failures
RFC9539   February 2024  EXPERIMENTAL       obs_by=-          upd_by=-            Unilateral Opportunistic Deployment of Encrypted Recursi
RFC9567   April 2024     PROPOSED STANDARD  obs_by=-          upd_by=-            DNS Error Reporting
RFC9606   June 2024      PROPOSED STANDARD  obs_by=-          upd_by=-            DNS Resolver Information
RFC9848   March 2026     PROPOSED STANDARD  obs_by=-          upd_by=-            Bootstrapping TLS Encrypted ClientHello with DNS Service
RFC9953   March 2026     PROPOSED STANDARD  obs_by=-          upd_by=-            DNS over CoAP (DoC)

== GitHub repositories: archived state, last push, latest release
zmap/zdns                  archived=False pushed=2026-08-24 stars=1131
   latest release v2.1.1 on 2026-05-28
zmap/zmap                  archived=False pushed=2026-08-26 stars=6366
   latest release v4.4.0 on 2026-05-29
blechschmidt/massdns       archived=False pushed=2026-04-15 stars=3635
   latest release v1.1.0 on 2024-03-09
dnsviz/dnsviz              archived=False pushed=2025-04-21 stars=1246
   latest release v0.11.1 on 2025-04-21
rthalley/dnspython         archived=False pushed=2026-08-25 stars=2670
   latest release v2.8.0 on 2025-09-07
miekg/dns                  archived=False pushed=2026-08-19 stars=8763
   no GitHub release object: Not Found
NLnetLabs/unbound          archived=False pushed=2026-08-26 stars=4822
   latest release release-1.26.0 on 2026-08-04
NLnetLabs/nsd              archived=False pushed=2026-08-26 stars=569
   latest release NSD_4_15_1_REL on 2026-08-26
isc-projects/bind9         archived=False pushed=2026-08-27 stars=763
   no GitHub release object: Not Found
PowerDNS/pdns              archived=False pushed=2026-08-27 stars=4456
   no GitHub release object: Not Found
CZ-NIC/knot-resolver       archived=False pushed=2026-08-27 stars=461
   no GitHub release object: Not Found
imp/dnsmasq                archived=False pushed=2026-03-16 stars=389
   no GitHub release object: Not Found
DNS-OARC/dnsperf           archived=True  pushed=2026-02-04 stars=478
   latest release v2.14.0 on 2024-01-18
DNSCrypt/dnscrypt-proxy    archived=False pushed=2026-08-27 stars=13604
   latest release 2.1.18 on 2026-07-18

== miekg/dns has no GitHub Release object but DOES have semver tags
git tags: ['v1.1.73', 'v1.1.72', 'v1.1.70', 'v1.1.69', 'v1.1.68']
go module proxy @latest: {"Version":"v1.1.73","Time":"2026-08-19T05:07:32Z","Origin":{"VCS":"git","URL":"https://github.com/miekg/dns","Hash":"d854399da1ee385b432e8b07f79e53bbfc1ab1b0","Ref":"refs/tags/v1.1.73"}}

== Android Private DNS transport: Google's own announcement
  e devices. DNS-over-HTTP/3 (DoH3) support was released as part of a Google Play system update , so by the time you’re reading this, Android devices from Android 11 onwards 1 will use DoH3 instead of DoT for well-known 2 DNS servers which support it. Which DNS service you are using is unaffected by this change; only the transport will be upgraded. In th

== ANRW 2026 DDR paper (not in the seven-venue corpus), doi 10.1145/3822163.3827932
  The Illusion of DDR Deployment
  Yevheniya Nosyk; Andrzej Duda; Maciej Korczynski
  Proceedings of the 2026 Applied Networking Research Workshop [[2026, 7, 20]]

== APNIC DDR write-up by the ANRW authors (the figures the page quotes)
  ok   By Yevheniya Nosyk on 2 Sep 2025
  ok   Andrzej Duda and Maciej Korczy
  ok   321k DDR-enabled open resolvers
  ok   80.8% of DDR-enabled resolvers designating dns.google
  ok   97.4% of DDR-enabled resolvers

== PyPI: dnspython
dnspython 2.8.0 2025-09-07

== HTTP status of every URL the page cites
200  https://openintel.nl/
200  https://atlas.ripe.net/
200  https://czds.icann.org/
200  https://www.domaintools.com/products/farsight-dnsdb/
200  https://opendata.rapid7.com/
200  https://opendata.rapid7.com/sonar.fdns_v2/
200  https://dnsviz.net/
200  https://stats.labs.apnic.net/dnssec
200  https://dnscrypt.info/public-servers
200  https://developers.google.com/speed/public-dns/docs/doh
200  https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/
200  https://www.quad9.net/
200  https://ooni.org/
200  https://censoredplanet.org/
200  https://sidnlabs.nl/
200  https://www.dns-oarc.net/
200  https://root-servers.org/
200  https://ithi.research.icann.org/
200  https://scans.io/
200  https://www.dnsdb.info/

== Rapid7 Open Data: where does the cited host redirect to, and is the data current
  200  https://opendata.rapid7.com/  ->  https://sonardata.rapid7.com/
  200  https://opendata.rapid7.com/sonar.fdns_v2/  ->  https://sonardata.rapid7.com/sonar.fdns_v2/
  200  https://opendata.rapid7.com/sonar.rdns_v2/  ->  https://sonardata.rapid7.com/sonar.rdns_v2/
  /sonar.fdns_v2/          Forward DNS (FDNS)           last=08/23/2026
  /sonar.rdns_v2/          Reverse DNS (RDNS)           last=08/26/2026
  /sonar.http/             HTTP GET Responses           last=08/27/2026
  /sonar.https/            HTTPS GET Responses          last=08/27/2026
  /sonar.tcp/              TCP Scans                    last=08/27/2026
  /sonar.ssl/              SSL Certificates             last=08/27/2026
  /sonar.moressl/          More SSL Certificates (non-443) last=08/18/2026
  /sonar.udp/              UDP Scans                    last=08/06/2026

== Farsight / DomainTools: does the cited vendor still exist under that name
farsightsecurity.com       RESOLVE FAILED: [Errno -2] Name or service not known
www.farsightsecurity.com   RESOLVE FAILED: [Errno -2] Name or service not known
dnsdb.info                 A= 104.244.14.64
200  https://www.dnsdb.info/  ->  https://www.domaintools.com/platform
200  https://www.domaintools.com/products/farsight-dnsdb/  ->  https://www.domaintools.com/platform

== DNS-OARC DITL and the other community datasets
200  https://www.dns-oarc.net/oarc/data/ditl
404  https://www.dns-oarc.net/oarc/data
200  https://catalog.caida.org/
401  https://data.caida.org/datasets/

== Firefox DoH: the shipped prefs, read out of the tree
all.js bytes=200412 trr lines=6
pref("network.trr.uri", "");
pref("network.trr.custom_uri", "");
--- network.trr.mode compiled default (StaticPrefList.yaml)
- name: network.trr.mode
  type: RelaxedAtomicUint32
  value: 0
  mirror: always
firefox.js bytes=185642 trr lines=1

== Mozilla DoH provider steering list (Remote Settings, no auth)
5 DoH provider records in Mozilla Remote Settings (collection: doh-providers)
   Cloudflare     autoDefault=True  https://mozilla.cloudflare-dns.com/dns-query
   Shaw           autoDefault=False https://dns.shaw.ca/dns-query
                  autoDefault=False https://doh.xfinity.com/dns-query
   NextDNS        autoDefault=False https://firefox.dns.nextdns.io/
   CIRA Canadian Shield autoDefault=False https://private.canadianshield.cira.ca/dns-query

== Chrome: secure-DNS enterprise policy page
200  chromeenterprise.google/policies/

== APNIC DNSSEC-validation measurement, world (primary source, today)
bytes=528440
   Validation Capability Metrics div { background: transparent url(/images/bg-watermark

== done

• A current DNSSEC validation rate from a primary source. stats.labs.apnic.net/dnssec/XA returns 200 but renders its figures client-side; XA.json and the cgi-bin endpoint are both 404, and no data URL is present in the HTML. No DNSSEC deployment percentage is published on the page; APNIC is not cited for a number.
• A dated primary source for the DomainTools acquisition of Farsight Security. domaintools.com/company/press-releases/ is 404 and no newsroom index was found. The page therefore states only what was measured directly: the old domain does not resolve and the old product URLs redirect. No acquisition date is claimed.
• internetsociety.org DNSSEC statistics returns 403 to this host. Not cited.
• radar.cloudflare.com returns 403 to this host. Cloudflare Radar has DNS data and may be worth a future row, but nothing was verified, so nothing is claimed. See the red link programming:cloudflare_radar.

pages/resolver_disagreement.py, embedded on the page as a <file python> block. Standard library only (Python 3.8+): the container has no dnspython, no dig, no drill and no nslookup, which turned out to be the right constraint — the script is meant to run on a measurement host without a package install.

Design decisions worth recording:

• No EDNS0. Adding an OPT record changes which resolvers answer, and adding an ECS option changes the answer. The docstring says so, because a silent EDNS choice is the kind of thing that makes a resolution unreproducible.
• Source-address check on the reply. It accepts a datagram only from the address it queried, and rejects a transaction-ID mismatch. This does not defend against an on-path forger — nothing at this layer does — but it stops a stray answer being recorded as that resolver's.
• no-A-record is a separate verdict from insufficient. The first draft merged them and reported “25% insufficient”, which hid the actual finding: those 25 names have no A record at the apex, which is a property of the zone and the most common way a list-driven crawl loses rows silently.
• Two summaries, and the script says which to quote. Summary A over all names mixes “resolvers disagree” (28/100) with “there was nothing to disagree about” (25/100). Summary B over the 75 comparable names gives 37.3%. Quoting 28% would understate the disagreement by hiding it behind the no-answer rate.

Tranco top 100, list ID 46W9X, fetched from tranco-list.eu on 2026-08-27. Three public resolvers over Do53/UDP from a single European vantage point. Two consecutive runs against the same list gave identical verdict counts (46 identical / 1 same-/24 / 28 disjoint / 25 no-A-record), which is reassuring but is not a stability claim — it is two runs, minutes apart, from one place.

The <code> block on the page is generated by scripts/build_dns_codeblock.mjs from out/dns/resolver_run.txt, with a mechanical abridgement rule (two header lines, the google.com stanza with address lists cut after two entries, both summary blocks). It is regenerated rather than pasted, because the first draft pasted an earlier run's TTLs under a later run's timestamp — the exact failure the builder now prevents.

Full run output:

# resolvers: Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9)
# names: 100   run at 2026-08-27T22:56:27Z

google.com   -> partial
    Google       NOERROR     10.9 ms  ttl=242    172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139  (2nd query TTL 47: served from cache)
    Cloudflare   NOERROR      9.7 ms  ttl=299    172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139  (2nd query TTL 185: served from cache)
    Quad9        NOERROR     14.5 ms  ttl=108    142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139  (2nd query TTL 107: served from cache)

cloudflare.com   -> identical
    Google       NOERROR     17.3 ms  ttl=300    104.16.132.229, 104.16.133.229  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR      9.4 ms  ttl=245    104.16.132.229, 104.16.133.229  (2nd query TTL 159: served from cache)
    Quad9        NOERROR     15.1 ms  ttl=263    104.16.132.229, 104.16.133.229  (2nd query TTL 247: served from cache)

gstatic.com   -> disjoint
    Google       NOERROR     36.6 ms  ttl=300    172.217.208.120, 172.217.208.94  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     22.0 ms  ttl=90     74.125.29.120, 74.125.29.94  (2nd query TTL 22: served from cache)
    Quad9        NOERROR    122.9 ms  ttl=160    142.250.154.120, 142.250.154.94

facebook.com   -> partial
    Google       NOERROR     37.7 ms  ttl=60     157.240.17.35  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     10.0 ms  ttl=5      157.240.17.35  (2nd query TTL 5: unchanged)
    Quad9        NOERROR     13.9 ms  ttl=10     157.240.0.35

microsoft.com   -> partial
    Google       NOERROR      9.9 ms  ttl=2128   150.171.110.51  (2nd query TTL 2128: unchanged)
    Cloudflare   NOERROR     10.0 ms  ttl=2439   150.171.110.51  (2nd query TTL 780: served from cache)
    Quad9        NOERROR     13.5 ms  ttl=1460   150.171.109.101

googleapis.com   -> partial
    Google       NOERROR     15.8 ms  ttl=300    74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99  (2nd query TTL 282: served from cache)
    Cloudflare   NOERROR      8.8 ms  ttl=185    74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99  (2nd query TTL 152: served from cache)
    Quad9        NOERROR     13.5 ms  ttl=278    142.251.13.103, 142.251.13.104, 142.251.13.105, 142.251.13.106, 142.251.13.147, 142.251.13.99

amazonaws.com   -> identical
    Google       NOERROR      9.4 ms  ttl=613    15.197.250.250, 166.117.149.112  (2nd query TTL 176: served from cache)
    Cloudflare   NOERROR      9.7 ms  ttl=173    15.197.250.250, 166.117.149.112  (2nd query TTL 163: served from cache)
    Quad9        NOERROR     13.8 ms  ttl=686    15.197.250.250, 166.117.149.112  (2nd query TTL 43: served from cache)

youtube.com   -> partial
    Google       NOERROR     18.4 ms  ttl=300    172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     10.0 ms  ttl=39     172.217.208.136, 172.217.208.190, 172.217.208.91, 172.217.208.93
    Quad9        NOERROR     14.6 ms  ttl=5      192.178.183.136, 192.178.183.190, 192.178.183.91, 192.178.183.93  (2nd query TTL 5: unchanged)

apple.com   -> identical
    Google       NOERROR     10.8 ms  ttl=220    17.253.144.10  (2nd query TTL 219: served from cache)
    Cloudflare   NOERROR      9.2 ms  ttl=133    17.253.144.10
    Quad9        NOERROR     13.4 ms  ttl=805    17.253.144.10  (2nd query TTL 777: served from cache)

gtld-servers.net   -> no-A-record
    Google       NOERROR     39.0 ms  ttl=-      (no A record)
    Cloudflare   NOERROR    379.9 ms  ttl=-      (no A record)
    Quad9        NOERROR     21.1 ms  ttl=-      (no A record)

akamai.net   -> no-A-record
    Google       NOERROR     12.7 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.1 ms  ttl=-      (no A record)
    Quad9        NOERROR     15.8 ms  ttl=-      (no A record)

instagram.com   -> partial
    Google       NOERROR     14.2 ms  ttl=60     157.240.17.174  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     10.3 ms  ttl=38     157.240.17.174  (2nd query TTL 38: unchanged)
    Quad9        NOERROR     14.5 ms  ttl=25     157.240.253.174  (2nd query TTL 17: served from cache)

mail.ru   -> identical
    Google       NOERROR     56.8 ms  ttl=53     185.180.201.1, 89.221.239.1, 90.156.232.4  (2nd query TTL 5: served from cache)
    Cloudflare   NOERROR      9.6 ms  ttl=42     185.180.201.1, 89.221.239.1, 90.156.232.4
    Quad9        NOERROR     15.0 ms  ttl=5      185.180.201.1, 89.221.239.1, 90.156.232.4

ezviz7.com   -> no-A-record
    Google       NOERROR    261.6 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.9 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.6 ms  ttl=-      (no A record)

fbcdn.net   -> partial
    Google       NOERROR     14.1 ms  ttl=60     157.240.17.35  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR      9.7 ms  ttl=39     157.240.17.35  (2nd query TTL 38: served from cache)
    Quad9        NOERROR     14.8 ms  ttl=19     157.240.253.35

twitter.com   -> partial
    Google       NOERROR     10.0 ms  ttl=40     162.159.140.229
    Cloudflare   NOERROR      8.5 ms  ttl=5      172.66.0.227
    Quad9        NOERROR     15.8 ms  ttl=38     162.159.140.229  (2nd query TTL 38: unchanged)

dzen.ru   -> identical
    Google       NOERROR      9.3 ms  ttl=492    95.163.218.220  (2nd query TTL 492: unchanged)
    Cloudflare   NOERROR      8.6 ms  ttl=347    95.163.218.220  (2nd query TTL 347: unchanged)
    Quad9        NOERROR     15.6 ms  ttl=183    95.163.218.220  (2nd query TTL 157: served from cache)

linkedin.com   -> identical
    Google       NOERROR     13.0 ms  ttl=300    130.211.32.14  (2nd query TTL 54: served from cache)
    Cloudflare   NOERROR      9.9 ms  ttl=58     130.211.32.14
    Quad9        NOERROR     50.9 ms  ttl=69     130.211.32.14

domaincontrol.com   -> identical
    Google       NOERROR     21.0 ms  ttl=600    127.0.0.1  (2nd query TTL 600: unchanged)
    Cloudflare   NOERROR     17.9 ms  ttl=600    127.0.0.1  (2nd query TTL 600: unchanged)
    Quad9        NOERROR     16.4 ms  ttl=600    127.0.0.1  (2nd query TTL 600: unchanged)

googlevideo.com   -> disjoint
    Google       NOERROR     19.2 ms  ttl=300    74.125.29.103, 74.125.29.104, 74.125.29.105, 74.125.29.106, 74.125.29.147, 74.125.29.99  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR      9.9 ms  ttl=144    172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99  (2nd query TTL 101: served from cache)
    Quad9        NOERROR     15.4 ms  ttl=150    142.251.20.103, 142.251.20.104, 142.251.20.105, 142.251.20.106, 142.251.20.147, 142.251.20.99  (2nd query TTL 35: served from cache)

office.com   -> identical
    Google       NOERROR     13.9 ms  ttl=10     13.107.6.156  (2nd query TTL 10: unchanged)
    Cloudflare   NOERROR      8.6 ms  ttl=3      13.107.6.156  (2nd query TTL 3: unchanged)
    Quad9        NOERROR     13.8 ms  ttl=3      13.107.6.156

googletagmanager.com   -> disjoint
    Google       NOERROR     24.5 ms  ttl=300    172.217.208.97  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR      8.7 ms  ttl=132    192.178.170.97  (2nd query TTL 131: served from cache)
    Quad9        NOERROR     15.4 ms  ttl=127    192.178.183.97

hicloudcam.com   -> no-A-record
    Google       NOERROR    274.7 ms  ttl=-      (no A record)
    Cloudflare   NOERROR    272.8 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.6 ms  ttl=-      (no A record)

live.com   -> identical
    Google       NOERROR      9.6 ms  ttl=1363   204.79.197.212  (2nd query TTL 683: served from cache)
    Cloudflare   NOERROR      9.1 ms  ttl=321    204.79.197.212
    Quad9        NOERROR     15.1 ms  ttl=752    204.79.197.212

akamaiedge.net   -> no-A-record
    Google       NOERROR     11.1 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.8 ms  ttl=-      (no A record)
    Quad9        NOERROR     16.2 ms  ttl=-      (no A record)

amazon.com   -> identical
    Google       NOERROR     10.1 ms  ttl=603    98.82.161.185, 98.87.170.71, 98.87.170.74  (2nd query TTL 370: served from cache)
    Cloudflare   NOERROR     10.4 ms  ttl=372    98.82.161.185, 98.87.170.71, 98.87.170.74
    Quad9        NOERROR     13.8 ms  ttl=57     98.82.161.185, 98.87.170.71, 98.87.170.74  (2nd query TTL 43: served from cache)

akadns.net   -> no-A-record
    Google       NOERROR     10.1 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     11.2 ms  ttl=-      (no A record)
    Quad9        NOERROR     15.4 ms  ttl=-      (no A record)

azure.com   -> identical
    Google       NOERROR      9.8 ms  ttl=2750   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
    Cloudflare   NOERROR      7.9 ms  ttl=584    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
    Quad9        NOERROR     13.4 ms  ttl=358    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 358: unchanged)

bing.com   -> identical
    Google       NOERROR      9.2 ms  ttl=2051   150.171.27.10, 150.171.28.10  (2nd query TTL 2051: unchanged)
    Cloudflare   NOERROR      8.8 ms  ttl=566    150.171.27.10, 150.171.28.10  (2nd query TTL 527: served from cache)
    Quad9        NOERROR     14.0 ms  ttl=1042   150.171.27.10, 150.171.28.10  (2nd query TTL 258: served from cache)

github.com   -> partial
    Google       NOERROR     27.1 ms  ttl=60     140.82.121.4  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     10.3 ms  ttl=29     140.82.121.3
    Quad9        NOERROR     13.6 ms  ttl=6      140.82.121.4  (2nd query TTL 3: served from cache)

wikipedia.org   -> partial
    Google       NOERROR     10.8 ms  ttl=166    185.15.58.224  (2nd query TTL 55: served from cache)
    Cloudflare   NOERROR      9.2 ms  ttl=82     185.15.58.224
    Quad9        NOERROR     14.6 ms  ttl=116    185.15.59.224  (2nd query TTL 109: served from cache)

whatsapp.net   -> partial
    Google       NOERROR     14.2 ms  ttl=60     157.240.17.60  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     10.4 ms  ttl=26     157.240.17.60
    Quad9        NOERROR     15.2 ms  ttl=31     157.240.0.60  (2nd query TTL 29: served from cache)

apple-dns.net   -> no-A-record
    Google       NOERROR     11.8 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     32.8 ms  ttl=-      (no A record)
    Quad9        NOERROR     72.6 ms  ttl=-      (no A record)

fastly.net   -> identical
    Google       NOERROR     10.9 ms  ttl=460    151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6
    Cloudflare   NOERROR      9.0 ms  ttl=1152   151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6  (2nd query TTL 1152: unchanged)
    Quad9        NOERROR     14.1 ms  ttl=570    151.101.1.6, 151.101.129.6, 151.101.193.6, 151.101.65.6  (2nd query TTL 570: unchanged)

googleusercontent.com   -> disjoint
    Google       NOERROR     39.9 ms  ttl=300    192.178.170.132  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     15.2 ms  ttl=122    172.217.208.132
    Quad9        NOERROR     13.7 ms  ttl=215    142.251.20.132  (2nd query TTL 93: served from cache)

appsflyersdk.com   -> partial
    Google       NOERROR     13.9 ms  ttl=60     3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     11.6 ms  ttl=60     3.165.190.101, 3.165.190.35, 3.165.190.39, 3.165.190.48  (2nd query TTL 60: unchanged)
    Quad9        NOERROR     20.2 ms  ttl=60     13.226.244.111, 13.226.244.60, 13.226.244.76, 13.226.244.9  (2nd query TTL 60: unchanged)

doubleclick.net   -> partial
    Google       NOERROR     37.9 ms  ttl=300    74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139  (2nd query TTL 298: served from cache)
    Cloudflare   NOERROR      9.9 ms  ttl=59     74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139  (2nd query TTL 59: unchanged)
    Quad9        NOERROR     15.7 ms  ttl=123    142.251.14.100, 142.251.14.101, 142.251.14.102, 142.251.14.113, 142.251.14.138, 142.251.14.139  (2nd query TTL 59: served from cache)

aaplimg.com   -> no-A-record
    Google       NOERROR     12.6 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.5 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.3 ms  ttl=-      (no A record)

microsoftonline.com   -> no-A-record
    Google       NOERROR     11.5 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.9 ms  ttl=-      (no A record)
    Quad9        NOERROR     13.7 ms  ttl=-      (no A record)

netflix.com   -> partial
    Google       NOERROR     12.4 ms  ttl=60     18.200.8.190, 54.155.246.232, 54.73.148.110  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR      9.8 ms  ttl=45     18.200.8.190, 54.155.246.232, 54.73.148.110
    Quad9        NOERROR     13.9 ms  ttl=12     3.251.50.149, 54.155.178.5, 54.74.73.31  (2nd query TTL 9: served from cache)

office.net   -> no-A-record
    Google       NOERROR     11.6 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.6 ms  ttl=-      (no A record)
    Quad9        NOERROR     15.3 ms  ttl=-      (no A record)

trafficmanager.net   -> no-A-record
    Google       NOERROR     12.4 ms  ttl=-      (no A record)
    Cloudflare   NOERROR      9.4 ms  ttl=-      (no A record)
    Quad9        NOERROR     16.2 ms  ttl=-      (no A record)

gandi.net   -> identical
    Google       NOERROR     36.0 ms  ttl=600    217.70.185.65  (2nd query TTL 600: unchanged)
    Cloudflare   NOERROR     22.5 ms  ttl=600    217.70.185.65  (2nd query TTL 600: unchanged)
    Quad9        NOERROR     33.4 ms  ttl=600    217.70.185.65  (2nd query TTL 600: unchanged)

sharepoint.com   -> identical
    Google       NOERROR     11.5 ms  ttl=1692   13.107.136.10, 13.107.138.10
    Cloudflare   NOERROR      9.8 ms  ttl=3368   13.107.136.10, 13.107.138.10  (2nd query TTL 3367: served from cache)
    Quad9        NOERROR     15.6 ms  ttl=3279   13.107.136.10, 13.107.138.10  (2nd query TTL 1068: served from cache)

digicert.com   -> identical
    Google       NOERROR     10.6 ms  ttl=37     45.60.121.229, 45.60.131.229
    Cloudflare   NOERROR      8.7 ms  ttl=124    45.60.121.229, 45.60.131.229  (2nd query TTL 123: served from cache)
    Quad9        NOERROR     14.3 ms  ttl=41     45.60.121.229, 45.60.131.229  (2nd query TTL 37: served from cache)

youtu.be   -> partial
    Google       NOERROR     41.7 ms  ttl=300    74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     10.2 ms  ttl=203    74.125.29.136, 74.125.29.190, 74.125.29.91, 74.125.29.93  (2nd query TTL 185: served from cache)
    Quad9        NOERROR     14.7 ms  ttl=183    142.251.14.136, 142.251.14.190, 142.251.14.91, 142.251.14.93  (2nd query TTL 9: served from cache)

wordpress.org   -> identical
    Google       NOERROR     10.4 ms  ttl=80     66.6.42.252  (2nd query TTL 80: unchanged)
    Cloudflare   NOERROR      9.6 ms  ttl=310    66.6.42.252
    Quad9        NOERROR     13.4 ms  ttl=61     66.6.42.252  (2nd query TTL 14: served from cache)

skype.com   -> identical
    Google       NOERROR     10.8 ms  ttl=1974   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 851: served from cache)
    Cloudflare   NOERROR     10.2 ms  ttl=545    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 545: unchanged)
    Quad9        NOERROR     15.8 ms  ttl=3405   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 3399: served from cache)

cloud.microsoft   -> identical
    Google       NOERROR     11.9 ms  ttl=156    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
    Cloudflare   NOERROR      9.9 ms  ttl=171    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 171: unchanged)
    Quad9        NOERROR     16.5 ms  ttl=62     20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171

goo.gl   -> disjoint
    Google       NOERROR     38.9 ms  ttl=300    74.125.29.100, 74.125.29.101, 74.125.29.102, 74.125.29.113, 74.125.29.138, 74.125.29.139  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     11.5 ms  ttl=55     172.217.208.100, 172.217.208.101, 172.217.208.102, 172.217.208.113, 172.217.208.138, 172.217.208.139
    Quad9        NOERROR     25.8 ms  ttl=300    142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139  (2nd query TTL 59: served from cache)

cloudfront.net   -> no-A-record
    Google       NOERROR     10.1 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     19.1 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.7 ms  ttl=-      (no A record)

googledomains.com   -> identical
    Google       NOERROR     25.0 ms  ttl=300    216.239.32.29  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     17.9 ms  ttl=300    216.239.32.29  (2nd query TTL 300: unchanged)
    Quad9        NOERROR     22.7 ms  ttl=300    216.239.32.29  (2nd query TTL 300: unchanged)

x.com   -> partial
    Google       NOERROR      9.0 ms  ttl=134    172.66.0.227
    Cloudflare   NOERROR     11.2 ms  ttl=210    172.66.0.227  (2nd query TTL 47: served from cache)
    Quad9        NOERROR     14.5 ms  ttl=44     162.159.140.229  (2nd query TTL 44: unchanged)

tiktok.com   -> disjoint
    Google       NOERROR     17.8 ms  ttl=20     2.21.22.17, 2.21.22.56  (2nd query TTL 20: unchanged)
    Cloudflare   NOERROR      9.1 ms  ttl=7      104.109.250.146, 104.109.250.172  (2nd query TTL 3: served from cache)
    Quad9        NOERROR     14.4 ms  ttl=16     2.16.1.147, 2.16.1.170, 2.16.1.219, 2.16.1.225  (2nd query TTL 16: unchanged)

pinterest.com   -> identical
    Google       NOERROR     11.1 ms  ttl=592    151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84  (2nd query TTL 457: served from cache)
    Cloudflare   NOERROR      9.9 ms  ttl=211    151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84
    Quad9        NOERROR     13.7 ms  ttl=339    151.101.0.84, 151.101.128.84, 151.101.192.84, 151.101.64.84  (2nd query TTL 297: served from cache)

icloud.com   -> identical
    Google       NOERROR     10.0 ms  ttl=110    17.253.144.10  (2nd query TTL 104: served from cache)
    Cloudflare   NOERROR      9.9 ms  ttl=406    17.253.144.10  (2nd query TTL 406: unchanged)
    Quad9        NOERROR     16.3 ms  ttl=83     17.253.144.10

whatsapp.com   -> partial
    Google       NOERROR     13.1 ms  ttl=60     157.240.17.60  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     10.7 ms  ttl=56     157.240.17.60  (2nd query TTL 52: served from cache)
    Quad9        NOERROR     14.1 ms  ttl=19     157.240.0.60  (2nd query TTL 11: served from cache)

roblox.com   -> identical
    Google       NOERROR      9.9 ms  ttl=11     128.116.44.3  (2nd query TTL 5: served from cache)
    Cloudflare   NOERROR     10.1 ms  ttl=23     128.116.44.3
    Quad9        NOERROR     14.6 ms  ttl=49     128.116.44.3  (2nd query TTL 14: served from cache)

yahoo.com   -> identical
    Google       NOERROR     10.1 ms  ttl=583    74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164
    Cloudflare   NOERROR     10.0 ms  ttl=42     74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164  (2nd query TTL 42: unchanged)
    Quad9        NOERROR     14.9 ms  ttl=739    74.6.143.25, 74.6.143.26, 74.6.231.20, 74.6.231.21, 98.137.11.163, 98.137.11.164

windowsupdate.com   -> no-A-record
    Google       NOERROR      9.0 ms  ttl=-      (no A record)
    Cloudflare   NOERROR      9.2 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.7 ms  ttl=-      (no A record)

cloudflare.net   -> identical
    Google       NOERROR     19.1 ms  ttl=300    104.16.208.90, 104.17.156.85  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     10.5 ms  ttl=122    104.16.208.90, 104.17.156.85
    Quad9        NOERROR     14.7 ms  ttl=51     104.16.208.90, 104.17.156.85

gvt1.com   -> no-A-record
    Google       NOERROR     25.5 ms  ttl=-      (no A record)
    Cloudflare   NOERROR      9.1 ms  ttl=-      (no A record)
    Quad9        NOERROR     13.5 ms  ttl=-      (no A record)

googlesyndication.com   -> partial
    Google       NOERROR     16.6 ms  ttl=300    172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     18.1 ms  ttl=300    172.217.208.103, 172.217.208.104, 172.217.208.105, 172.217.208.106, 172.217.208.147, 172.217.208.99  (2nd query TTL 11: served from cache)
    Quad9        NOERROR     15.5 ms  ttl=184    142.250.154.103, 142.250.154.104, 142.250.154.105, 142.250.154.106, 142.250.154.147, 142.250.154.99  (2nd query TTL 184: unchanged)

msn.com   -> identical
    Google       NOERROR     11.5 ms  ttl=2205   204.79.197.219  (2nd query TTL 1276: served from cache)
    Cloudflare   NOERROR     15.7 ms  ttl=3600   204.79.197.219  (2nd query TTL 2297: served from cache)
    Quad9        NOERROR     15.0 ms  ttl=1061   204.79.197.219  (2nd query TTL 2: served from cache)

spotify.com   -> identical
    Google       NOERROR     11.0 ms  ttl=190    35.186.224.24  (2nd query TTL 190: unchanged)
    Cloudflare   NOERROR      9.2 ms  ttl=85     35.186.224.24  (2nd query TTL 79: served from cache)
    Quad9        NOERROR     14.9 ms  ttl=246    35.186.224.24  (2nd query TTL 1: served from cache)

windows.net   -> identical
    Google       NOERROR     11.3 ms  ttl=372    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
    Cloudflare   NOERROR      9.6 ms  ttl=3291   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 997: served from cache)
    Quad9        NOERROR     14.8 ms  ttl=1680   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 1678: served from cache)

ntp.org   -> identical
    Google       NOERROR     10.3 ms  ttl=2418   204.93.207.22, 209.148.110.246  (2nd query TTL 840: served from cache)
    Cloudflare   NOERROR      9.4 ms  ttl=1117   204.93.207.22, 209.148.110.246  (2nd query TTL 319: served from cache)
    Quad9        NOERROR     15.1 ms  ttl=2202   204.93.207.22, 209.148.110.246  (2nd query TTL 1666: served from cache)

adobe.com   -> disjoint
    Google       NOERROR     20.2 ms  ttl=20     92.123.27.153, 92.123.27.160  (2nd query TTL 20: unchanged)
    Cloudflare   NOERROR     10.4 ms  ttl=12     23.7.245.131, 23.7.245.197
    Quad9        NOERROR     15.1 ms  ttl=20     2.19.126.138, 2.19.126.158  (2nd query TTL 3: served from cache)

myfritz.net   -> identical
    Google       NOERROR     10.3 ms  ttl=7680   212.42.244.100
    Cloudflare   NOERROR     26.1 ms  ttl=86400  212.42.244.100  (2nd query TTL 86400: unchanged)
    Quad9        NOERROR     16.0 ms  ttl=34585  212.42.244.100

pv-cdn.net   -> no-A-record
    Google       NOERROR     10.9 ms  ttl=-      (no A record)
    Cloudflare   NOERROR      9.4 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.2 ms  ttl=-      (no A record)

wa.me   -> partial
    Google       NOERROR     15.3 ms  ttl=60     157.240.17.60  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     11.0 ms  ttl=39     157.240.17.60  (2nd query TTL 23: served from cache)
    Quad9        NOERROR     15.3 ms  ttl=45     157.240.253.60  (2nd query TTL 13: served from cache)

cdninstagram.com   -> no-A-record
    Google       NOERROR     14.3 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.4 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.5 ms  ttl=-      (no A record)

nginx.org   -> partial
    Google       NOERROR     11.2 ms  ttl=18     52.58.199.22  (2nd query TTL 18: unchanged)
    Cloudflare   NOERROR     10.8 ms  ttl=60     52.58.199.22  (2nd query TTL 23: served from cache)
    Quad9        NOERROR     14.3 ms  ttl=10     3.125.197.172  (2nd query TTL 10: unchanged)

akam.net   -> no-A-record
    Google       NOERROR     28.6 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     11.7 ms  ttl=-      (no A record)
    Quad9        NOERROR     17.8 ms  ttl=-      (no A record)

tiktokcdn.com   -> no-A-record
    Google       NOERROR     11.9 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.7 ms  ttl=-      (no A record)
    Quad9        NOERROR     15.2 ms  ttl=-      (no A record)

chatgpt.com   -> identical
    Google       NOERROR     26.3 ms  ttl=300    104.18.32.47, 172.64.155.209  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     10.4 ms  ttl=6      104.18.32.47, 172.64.155.209
    Quad9        NOERROR     15.5 ms  ttl=260    104.18.32.47, 172.64.155.209  (2nd query TTL 23: served from cache)

zoom.us   -> identical
    Google       NOERROR     13.8 ms  ttl=60     170.114.52.2  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     11.1 ms  ttl=46     170.114.52.2  (2nd query TTL 46: unchanged)
    Quad9        NOERROR     14.8 ms  ttl=44     170.114.52.2  (2nd query TTL 44: unchanged)

tiktokv.com   -> disjoint
    Google       NOERROR      9.8 ms  ttl=1      104.126.37.128, 104.126.37.129, 104.126.37.139, 104.126.37.145, 104.126.37.153, 104.126.37.160, 104.126.37.161, 104.126.37.168, 104.126.37.185
    Cloudflare   NOERROR     10.0 ms  ttl=13     2.21.22.27, 2.21.22.32, 2.21.22.40, 2.21.22.41, 2.21.22.56, 2.21.22.57, 2.21.22.58, 23.10.249.56, 23.10.249.82  (2nd query TTL 2: served from cache)
    Quad9        NOERROR     14.4 ms  ttl=12     2.18.64.11, 2.18.64.12, 2.18.64.16, 2.18.64.19, 2.18.64.22, 2.18.64.28, 2.18.64.32, 2.18.64.33, 2.18.64.6  (2nd query TTL 9: served from cache)

vimeo.com   -> identical
    Google       NOERROR      9.6 ms  ttl=168    162.159.128.61, 162.159.138.60
    Cloudflare   NOERROR      9.6 ms  ttl=348    162.159.128.61, 162.159.138.60  (2nd query TTL 312: served from cache)
    Quad9        NOERROR     14.0 ms  ttl=882    162.159.128.61, 162.159.138.60  (2nd query TTL 177: served from cache)

edgekey.net   -> no-A-record
    Google       NOERROR     12.9 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     11.0 ms  ttl=-      (no A record)
    Quad9        NOERROR     16.6 ms  ttl=-      (no A record)

baidu.com   -> identical
    Google       NOERROR     12.4 ms  ttl=352    110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164  (2nd query TTL 83: served from cache)
    Cloudflare   NOERROR     10.6 ms  ttl=55     110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164  (2nd query TTL 55: unchanged)
    Quad9        NOERROR     15.2 ms  ttl=419    110.242.74.102, 111.63.65.103, 111.63.65.247, 124.237.177.164  (2nd query TTL 203: served from cache)

cloudflare-dns.com   -> identical
    Google       NOERROR     16.7 ms  ttl=300    104.16.248.249, 104.16.249.249  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     11.0 ms  ttl=86     104.16.248.249, 104.16.249.249
    Quad9        NOERROR     14.6 ms  ttl=156    104.16.248.249, 104.16.249.249

gvt2.com   -> no-A-record
    Google       NOERROR     19.6 ms  ttl=-      (no A record)
    Cloudflare   NOERROR      9.8 ms  ttl=-      (no A record)
    Quad9        NOERROR     15.1 ms  ttl=-      (no A record)

yandex.net   -> identical
    Google       NOERROR     11.0 ms  ttl=433    213.180.204.242  (2nd query TTL 365: served from cache)
    Cloudflare   NOERROR     57.8 ms  ttl=600    213.180.204.242  (2nd query TTL 368: served from cache)
    Quad9        NOERROR     55.4 ms  ttl=600    213.180.204.242  (2nd query TTL 503: served from cache)

windows.com   -> identical
    Google       NOERROR     10.9 ms  ttl=364    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171
    Cloudflare   NOERROR     13.0 ms  ttl=2688   20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171  (2nd query TTL 77: served from cache)
    Quad9        NOERROR     16.3 ms  ttl=719    20.112.250.133, 20.231.239.246, 20.236.44.162, 20.70.246.20, 20.76.201.171

root-servers.net   -> no-A-record
    Google       NOERROR     17.7 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.5 ms  ttl=-      (no A record)
    Quad9        NOERROR     18.6 ms  ttl=-      (no A record)

openai.com   -> identical
    Google       NOERROR     13.8 ms  ttl=60     104.18.33.45, 172.64.154.211  (2nd query TTL 60: unchanged)
    Cloudflare   NOERROR     17.0 ms  ttl=60     104.18.33.45, 172.64.154.211  (2nd query TTL 60: unchanged)
    Quad9        NOERROR     15.4 ms  ttl=23     104.18.33.45, 172.64.154.211

gwfb.net   -> no-A-record
    Google       NOERROR    277.5 ms  ttl=-      (no A record)
    Cloudflare   NOERROR    505.4 ms  ttl=-      (no A record)
    Quad9        NOERROR    215.0 ms  ttl=-      (no A record)

ytimg.com   -> no-A-record
    Google       NOERROR     28.3 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     24.8 ms  ttl=-      (no A record)
    Quad9        NOERROR     14.6 ms  ttl=-      (no A record)

workers.dev   -> identical
    Google       NOERROR     15.3 ms  ttl=300    104.18.12.15, 104.18.13.15  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     11.9 ms  ttl=300    104.18.12.15, 104.18.13.15  (2nd query TTL 300: unchanged)
    Quad9        NOERROR     22.8 ms  ttl=300    104.18.12.15, 104.18.13.15  (2nd query TTL 300: unchanged)

qq.com   -> identical
    Google       NOERROR     10.0 ms  ttl=47     113.108.81.189, 123.150.76.218, 203.205.254.157
    Cloudflare   NOERROR     10.7 ms  ttl=579    113.108.81.189, 123.150.76.218, 203.205.254.157  (2nd query TTL 357: served from cache)
    Quad9        NOERROR     17.6 ms  ttl=274    113.108.81.189, 123.150.76.218, 203.205.254.157  (2nd query TTL 206: served from cache)

opera.com   -> identical
    Google       NOERROR     34.9 ms  ttl=600    185.26.182.103, 185.26.182.104  (2nd query TTL 154: served from cache)
    Cloudflare   NOERROR     25.7 ms  ttl=600    185.26.182.103, 185.26.182.104  (2nd query TTL 128: served from cache)
    Quad9        NOERROR     16.0 ms  ttl=182    185.26.182.103, 185.26.182.104

samsung.com   -> identical
    Google       NOERROR     11.0 ms  ttl=133    211.45.27.231  (2nd query TTL 133: unchanged)
    Cloudflare   NOERROR      9.0 ms  ttl=110    211.45.27.231
    Quad9        NOERROR     15.2 ms  ttl=259    211.45.27.231  (2nd query TTL 89: served from cache)

blogspot.com   -> partial
    Google       NOERROR     19.0 ms  ttl=300    74.125.29.191  (2nd query TTL 300: unchanged)
    Cloudflare   NOERROR     10.8 ms  ttl=221    74.125.29.191  (2nd query TTL 221: unchanged)
    Quad9        NOERROR     14.4 ms  ttl=52     142.251.110.191

mozilla.org   -> identical
    Google       NOERROR     11.5 ms  ttl=218    35.190.14.201  (2nd query TTL 218: unchanged)
    Cloudflare   NOERROR      9.8 ms  ttl=420    35.190.14.201
    Quad9        NOERROR     14.5 ms  ttl=221    35.190.14.201

nginx.com   -> identical
    Google       NOERROR     11.1 ms  ttl=218    159.60.134.0  (2nd query TTL 165: served from cache)
    Cloudflare   NOERROR     11.5 ms  ttl=353    159.60.134.0  (2nd query TTL 353: unchanged)
    Quad9        NOERROR     14.3 ms  ttl=158    159.60.134.0

wordpress.com   -> identical
    Google       NOERROR     12.0 ms  ttl=163    192.0.78.17, 192.0.78.9  (2nd query TTL 131: served from cache)
    Cloudflare   NOERROR      9.7 ms  ttl=103    192.0.78.17, 192.0.78.9  (2nd query TTL 83: served from cache)
    Quad9        NOERROR     14.4 ms  ttl=50     192.0.78.17, 192.0.78.9

edgesuite.net   -> no-A-record
    Google       NOERROR     12.8 ms  ttl=-      (no A record)
    Cloudflare   NOERROR     10.5 ms  ttl=-      (no A record)
    Quad9        NOERROR     16.0 ms  ttl=-      (no A record)

workbox.dk   -> no-A-record
    Google       NOERROR     55.7 ms  ttl=-      (no A record)
    Cloudflare   NOERROR    133.6 ms  ttl=-      (no A record)
    Quad9        NOERROR     20.8 ms  ttl=-      (no A record)

yandex.ru   -> identical
    Google       NOERROR     10.2 ms  ttl=426    5.255.255.77, 77.88.44.55, 77.88.55.88  (2nd query TTL 420: served from cache)
    Cloudflare   NOERROR     11.1 ms  ttl=570    5.255.255.77, 77.88.44.55, 77.88.55.88
    Quad9        NOERROR     16.0 ms  ttl=134    5.255.255.77, 77.88.44.55, 77.88.55.88

summary A: all 100 names
  identical        46   46.0%
  partial          21   21.0%
  disjoint          8    8.0%
  no-A-record      25   25.0%

summary B: the 75 names where at least two resolvers returned an address
  identical        46   61.3%
  partial          21   28.0%
  disjoint          8   10.7%
  NOT identical    29   38.7%   <- the headline: at least one resolver disagreed with another

Summary B is the denominator to quote. Summary A mixes two different
findings: how often resolvers disagree, and how often a name in your
list has no address to disagree about.

'disjoint' means NO PAIR of resolvers returned an address in common, and
no pair even shared a /24. 'partial' means some pair overlapped and some
pair did not. The number to quote for "how much does my choice of
resolver matter" is NOT identical: that is the share of your name list
where resolvers did not all agree -- from this vantage point, at this
instant. 'disjoint' alone understates it; quoting 'disjoint' as though
it meant "any disagreement" overstates it.

wrote out/dns/resolver_run.json

The 25 names with no A record at the apex:

25 names
gtld-servers.net, akamai.net, ezviz7.com, hicloudcam.com, akamaiedge.net
akadns.net, apple-dns.net, aaplimg.com, microsoftonline.com, office.net
trafficmanager.net, cloudfront.net, windowsupdate.com, gvt1.com, pv-cdn.net
cdninstagram.com, akam.net, tiktokcdn.com, edgekey.net, gvt2.com
root-servers.net, gwfb.net, ytimg.com, edgesuite.net, workbox.dk

The 28 names with disjoint answers:

8 names
gstatic.com, googlevideo.com, googletagmanager.com, googleusercontent.com
goo.gl, tiktok.com, adobe.com, tiktokv.com

1. design:dns rather than security:dns or a child of security:tls_certificates. The task named design:dns, and the reasoning holds: this is an instrument-selection question, a sibling of ip_classification (“what is this address”) and automated_measurements (“which instrument”), not a deployment-security question. The TLS page answers “what does this host present after you connect”; nothing on it covers resolution, and stretching it would have been the wrong page. A reasonable person could have put it under security:.
2. No child pages. design:dns:encrypted_dns (48 DoH papers in DNSPOP) and design:dns:passive_dns (65) are each large enough to survive as a page, and both were declined. Encrypted DNS is a five-row table because the interesting content is the dating, which only works when the protocols sit beside each other; passive DNS is a four-row table because the interesting content is which vendor still exists. Splitting either would produce two pages that each need the other's context. Revisit when DoQ or DDR has more than one or two papers.
3. prevalence figures are quoted only after being re-found in the paper. Four of the figures first drafted from detection[].prevalence did not survive; see the table above. Every remaining per-paper figure on the page has a needle in verify_dns_figures.mjs.
4. The seven lab-rig papers stay in the population. They used a DNS-specific instrument, which is what the rule says. Removing them would make the rule a judgement. Publishing the count is the compromise.
5. Posters (14 of 244) are not excluded. The page's headline claims are not reporting-gap rates where poster brevity would bias the result upward; the vantage-location and version figures are, so the poster count is stated next to the population.
6. Two rhetorical sentences were re-derived and one was wrong. The draft said “IMC is where this work lives, by a factor of three over the next venue” (true: 13.2% vs 4.3%) and “if you read only the web-measurement venues you are reading the wrong 60%” (unsupported). Measuring it: TheWebConf and PoPETs together are 12.3% of the 244 and IMC, USENIX Security and NDSS together are 70.1%. The sentence now states those two figures, which report_dns.mjs section B derives so they are not hand arithmetic beside a table.
7. The 2010 Ager result leads failure mode 1 even though it is sixteen years old. It is the cleanest statement of a property that has not changed, and the script's own run is the current evidence beside it. The page says both.
8. security:tls_certificates was not edited. automated_measurements routes “DNS” to that page and to ip_classification; both routings are now wrong. The parent's routing table was corrected to point here. The TLS page itself says nothing about DNS and needed no change.

Five review passes plus three rounds of self-review. Each reviewer was told explicitly that the author's context may not be exhaustive, and each was handed the page text, the report script and its unedited output, the fold, the quote checker and the external checks.

Snapshots. The three focused passes all read the same frozen snapshot, out/dns/review/frozen_design_dns.txt (48,440 bytes, the page as published at revision 1787870384) and out/dns/review/frozen_provenance.txt. Two rounds of self-review corrections were applied to the live page while they were running (revisions 1787870940 and 1787871092), so a reviewer reporting one of those is reporting something already fixed — the table below says which.

Found by re-deriving the page's own framing sentences rather than its tables, which is where the site's history says unmeasured claims hide.

Declared not checked by this pass: the fold counts and the venue/year corpus tables (out of scope for a citations review), and most of the non-paper external figures beyond the four it re-fetched.

Every finding below was re-verified independently before being acted on, because a currency claim is exactly the kind a reviewer can get wrong from memory.

The pass-2 reviewer was re-run against the corrected page and scripts, as the workflow requires for any reviewer whose findings were acted on.

Back to dns. Corpus-level caveats: corpus.