Skip to main content
SpringerLink
Log in

Assessing Support for DNS-over-TCP in the Wild

  • Conference paper
  • First Online:
Passive and Active Measurement (PAM 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13210))

Included in the following conference series:

Abstract

While the DNS protocol encompasses both UDP and TCP as its underlying transport, UDP is commonly used in practice. At the same time, increasingly large DNS responses and concerns over amplification denial of service attacks have heightened interest in conducting DNS interactions over TCP. This paper surveys the support for DNS-over-TCP in the deployed DNS infrastructure from several angles. First, we assess resolvers responsible for over 66.2% of the external DNS queries that arrive at a major content delivery network (CDN). We find that 2.7% to 4.8% of the resolvers, contributing around 1.1% to 4.4% of all queries arriving at the CDN from the resolvers we study, do not properly fallback to TCP when instructed by authoritative DNS servers. Should a content provider decide to employ TCP-fallback as the means of switching to DNS-over-TCP, it faces the corresponding loss of its customers. Second, we assess authoritative DNS servers (ADNS) for over 10M domains and many CDNs and find some ADNS, serving some popular websites and a number of CDNs, that do not support DNS-over-TCP. These ADNS would deny service to (RFC-compliant) resolvers that choose to switch to TCP-only interactions. Third, we study the TCP connection reuse behavior of DNS actors and describe a race condition in TCP connection reuse by DNS actors that may become a significant issue should DNS-over-TCP and other TCP-based DNS protocols, such as DNS-over-TLS, become widely used.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    The resolvers that directly interact with authoritative DNS servers – see Sect. 2.

  2. 2.

    Other available passive datasets, such as DITL [9] entail a similar limitation.

  3. 3.

    Indeed, 47% of 15–21% of TC responses initially found without a TCP query follow-up were to Google resolvers, virtually all of which the authors later assessed to be successful fallback to TCP, leaving 7–10% of TC responses still without a TCP followup.

  4. 4.

    While in Sect. 5 we categorize TCP support by domain to demonstrate the impact to clients using TCP as their transport medium, here we categorize by ADNS for easy comparison to Shulman and Waidner.

  5. 5.

    Indeed, a study [29] concerning large DNS responses did include both IPv4 and IPv6 traffic and did not note significant variations in behavior between the two.

  6. 6.

    We discover substantially more open ingress resolvers than other recent scans [2, 35]. The likely cause of this discrepancy is that those scans do not include ingress resolvers that respond from a different port (not 53) than the port used in probing, a behavior first observed in [33]. Indeed, our results include 2010584 (65.9%) ingress resolvers that do respond from port 53, closely matching the number of resolvers reported by the previous scans.

  7. 7.

    We missed 454 domains due to an issue with retrieving the full list from Majestic’s website.

  8. 8.

    While this technique is not exhaustive in discovering all domains from the available QNAMEs, it serves to provide a reasonably broad list for our subsequent measurements. In hindsight, using Mozilla’s public DNS suffix list at https://publicsuffix.org/ would have been better.

  9. 9.

    The table includes only 989 of the 1K popular websites because eleven of these domains either provide no NS records, the name servers listed fail to resolve to IP addresses, or none of the IP addresses responded to TCP or UDP queries.

  10. 10.

    We contacted both CDN1 and CDN2 about our findings. CDN1 acknowledged the bug, and CDN2 did not respond.

References

  1. https://osf.io/6ysxv/

  2. Al-Dalky, R., Rabinovich, M., Schomp, K.: A look at the ECS behavior of DNS resolvers. In: Proceedings of the ACM Internet Measurement Conference, pp. 116–129 (2019)

    Google Scholar 

  3. Al-Dalky, R., Schomp, K.: Characterization of collaborative resolution in recursive DNS resolvers. In: Beverly, R., Smaragdakis, G., Feldmann, A. (eds.) PAM 2018. LNCS, vol. 10771, pp. 146–157. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76481-8_11

    Chapter  Google Scholar 

  4. Barnes, R., Hoffman-Andrews, J., Kasten, J.: RFC 8555: automatic certificate management environment (ACME) (2019)

    Google Scholar 

  5. Böttger, T., et al.: An empirical study of the cost of DNS-over-HTTPS. In: Proceedings of the ACM Internet Measurement Conference, pp. 15–21 (2019)

    Google Scholar 

  6. Damas, J., Graff, M., Vixie, P.A.: RFC6891: extension mechanisms for DNS (EDNS0) (2013)

    Google Scholar 

  7. Deccio, C., Davis, J.: DNS privacy in practice and preparation. In: Proceedings of the 15th International Conference on Emerging Networking Experiments And Technologies (CoNEXT), pp. 138–143 (2019)

    Google Scholar 

  8. Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., Wessels, D.: RFC 7766: DNS transport over TCP-implementation requirements (2016)

    Google Scholar 

  9. DNS-OARC. https://www.dns-oarc.net/oarc/data/ditl (2018)

  10. Eastlake, D.: RFC 2535: domain name system security extensions (1999)

    Google Scholar 

  11. Hansen, T., Crocker, D., Hallam-Baker, P.: RFC 5585: DomainKeys identified mail (DKIM) service overview (2009)

    Google Scholar 

  12. Hoffman, P., McManus, P.: RFC 8484: DNS queries over HTTPS (DoH) (2018)

    Google Scholar 

  13. Hoffman, P., Schlyter, J.: RFC6698: The DNS-based authentication of named entities. (DANE) transport layer security (TLS) protocol: TLSA (2012)

    Google Scholar 

  14. Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., Hoffman, P.: RFC 7858: specification for DNS over transport layer security (TLS) (2016)

    Google Scholar 

  15. Huitema, C., Shore, M., Mankin, A., Dickinson, S., Iyengar, J.: Specification of DNS over dedicated QUIC connections. Internet-draft draft-huitema-quicdnsoquic-07. Work in Progress

    Google Scholar 

  16. Huston, G.: https://labs.ripe.net/Members/gih/a-question-of-dns-protocols, August 2013 (2013)

  17. Kitterman, S.: RFC 7208: Sender policy framework (SPF) for authorizing use of domains in email (2014)

    Google Scholar 

  18. Klein, A., Shulman, H., Waidner, M.: Internet-wide study of DNS cache injections. In: IEEE INFOCOM, pp. 1–9. IEEE (2017)

    Google Scholar 

  19. Klensin, J.: RFC 2821: simple mail transfer protocol (2001)

    Google Scholar 

  20. Klensin, J.: RFC 5321: simple mail transfer protocol (2008)

    Google Scholar 

  21. Kührer, M., Hupperich, T., Bushart, J., Rossow, C., Holz, T.: Going wild: large-scale classification of open DNS resolvers. In: Proceedings of the ACM Internet Measurement Conference (2015)

    Google Scholar 

  22. Kührer, M., Hupperich, T., Rossow, C., Holz, T.: Exit from hell? Reducing the impact of amplification DDoS attacks. In: 23rd \(\{\)USENIX\(\}\) Security Symposium (\(\{\)USENIX\(\}\) Security 14), pp. 111–125 (2014)

    Google Scholar 

  23. Lian, W., Rescorla, E., Shacham, H., Savage, S.: Measuring the practical impact of DNSSEC deployment. In: 22nd USENIX Security Symposium, pp. 573–588 (2013)

    Google Scholar 

  24. Lu, C., et al.: An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come? In: Proceedings of the ACM Internet Measurement Conference, pp. 22–35 (2019)

    Google Scholar 

  25. MacFarland, D.C., Shue, C.A., Kalafut, A.J.: Characterizing optimal DNS amplification attacks and effective mitigation. In: Mirkovic, J., Liu, Y. (eds.) PAM 2015. LNCS, vol. 8995, pp. 15–27. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-15509-8_2

    Chapter  Google Scholar 

  26. Majestic Top Million Root Domains List. https://majestic.com/reports/majestic-million (2021)

  27. Mockapetris, P.: RFC 883: domain names - implementation and specification (1983)

    Google Scholar 

  28. Mockapetris, P.V.: RFC 1035: domain names-implementation and specification (1987)

    Google Scholar 

  29. Moura, G.C.M., Müller, M., Davids, M., Wullink, M., Hesselman, C.: Fragmentation, truncation, and timeouts: are large DNS messages falling to bits? In: Hohlfeld, O., Lutu, A., Levin, D. (eds.) PAM 2021. LNCS, vol. 12671, pp. 460–477. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-72582-2_27

    Chapter  Google Scholar 

  30. Randall, A., et al.: Trufflehunter: cache snooping rare domains at large public DNS resolvers. In: Proceedings of the ACM Internet Measurement Conference, pp. 50–64 (2020)

    Google Scholar 

  31. van Rijswijk-Deij, R., Sperotto, A., Pras, A.: DNSSEC and its potential for DDoS attacks: a comprehensive measurement study. In: Proceedings of the ACM Internet Measurement Conference, pp. 449–460 (2014)

    Google Scholar 

  32. RIPE: Atlas. https://atlas.ripe.net/ (2021)

  33. Schomp, K., Callahan, T., Rabinovich, M., Allman, M.: On measuring the client-side DNS infrastructure. In: Proceedings of the ACM Internet Measurement Conference, pp. 77–90. ACM (2013)

    Google Scholar 

  34. Shulman, H., Waidner, M.: Is the internet ready for DNSSEC: evaluating pitfalls in the naming infrastructure. In: International Workshop on Traffic Monitoring and Analysis (TMA) (2016)

    Google Scholar 

  35. The Shadowserver Foundation. https://scan.shadowserver.org/dns/ (2020)

  36. Vixie, P.: RFC 2671: extension mechanisms for DNS (EDNS0) (1999)

    Google Scholar 

  37. Vixie, P., Schryver, V.: DNS response rate limiting (DNS RRL). http://ss.vix.su/~vixie/isc-tn-2012-1.txt (2012)

  38. Wouters, P., Abley, J., Dickinson, S., Bellis, R.: RFC 7828: The edns-tcp-keepalive EDNS0 option (2016)

    Google Scholar 

  39. Zhu, L., Hu, Z., Heidemann, J., Wessels, D., Mankin, A., Somaiya, N.: Connection-oriented DNS to improve privacy and security. In: 2015 IEEE Symposium on Security and Privacy, pp. 171–186. IEEE (2015)

    Google Scholar 

Download references

Acknowledgement

We thank the anonymous reviewers, and especially our shepherd, Alessio Botta, for useful comments and guidance. We are indebted to CWRU IT organization (“UTech”) for its continued support, without which this research would not be possible. The work of Jiarun Mao and Michael Rabinovich was supported in part by NSF through grant CNS-1647145.

Author information

Authors and Affiliations

  1. Case Western Reserve University, Cleveland, OH, 44106, USA

    Jiarun Mao & Michael Rabinovich

  2. Akamai Technologies, Cambridge, MA, 02142, USA

    Kyle Schomp

Authors
  1. Jiarun Mao
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Michael Rabinovich
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Kyle Schomp
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jiarun Mao .

Editor information

Editors and Affiliations

  1. Brandenburg University of Technology, Cottbus, Germany

    Oliver Hohlfeld

  2. SIDN Labs - TU Delft, Arnhem, The Netherlands

    Giovane Moura

  3. ICube - University of Strasbourg, Illkirch, France

    Cristel Pelsser

Appendices

A Matching Algorithm

figure a
figure b
figure c

B CDN Targets Tested

Below we list the 47 CDNs we tested in this study, which includes 17 (shown in bold font) out of 25 CDNs listed at CDN Planet (https://www.cdnplanet.com/, accessed on Jan 2, 2022). The parenthetical information lists the domain name employed and whether all, some, or none of the ADNS tested are TCP capable.

advancedhosterscdn(11799613.pix-cdn.org, all),

akamai(www.a1776.g1.akamai.net, all),

amazoncloudfront(www.d2qjncoblxi5md.cloudfront.net, all),

aryaka(hd.itrip.com.top.aads1.net, none), azion(18697b.ha.azioncdn.net, all),

belugacdn(www.cdn.famefocus.com.i.belugacdn.com, none),

bitgravity(www.pc-ap.bitgravity.com, all),

bunnycdn(www.planetedomo.b-cdn.net, some),

cachefly(www.vip1.g5.cachefly.net, none), cdn77(www.1650447009.rsc.cdn77.org, all),

cdnetworks(www.kisa.or.kr.cdngc.net, none),

cdnify(karnataka.a.cdnify.io, all), cdnsun(www.239827766.r.cdnsun.net, all),

cdnvideo(bfm.cdnvideo.ru, all),

cedexis(mobile.interflora.fr.fasterize.it.2-01-295f-000e.cdx.cedexis.net, all),

chinacache(hpcc-page.cncssr.chinacache.net, all),

chinanetcenter(www.v4q3iig12pcnka.wscloudcdn.com, none),

cloudflare(www.upra.org.cdn.cloudflare.net, all), cubecdn(mr.sp.cubecdn.net, all),

edgecast(www.cs109.adn.edgecastcdn.net, all),

facebook(scontent.xx.fbcdn.net, all), fastly(www.prod.seamless.map.fastlylb.net, all),

google(www.g0e1hw.feedproxy.ghs.google.com, all),

highwinds(www.cds.v2f8x7x9.hwcdn.net, all),

incapsula(www.hs2rptk.x.incapdns.net, all),

internap(www.6a2809e8d5.site.internapcdn.net, none),

keycdn(p-frpa00-v4.kxcdn.com, all),

leasewebcdn(www.5ad9c8cb35308834bf7d93d4e09de97e.lswcdn.net, all),

level3(www.vc.sporttube.com.c.footprint.net, none),

limelight(ualsharp.vo.llnwd.net, none),

maxcdn(www.creative-watch-new-pull.4ncfzftyhcv4rwo.netdna-cdn.com, all),

medianova(img-cimri.mncdn.com, none),

netlify(www.campusmanagement.netlify.com, all),

ngenix(www.cntraveller-st.cdn.ngenix.net, all),

nyiftw(www.nyi.nyiftw.net, all), onapp(316150366.r.worldcdn.net, all),

optimalcdn(www.cdn.optimalcdn.com, all),

quantil(www.oversea.dtwscache.speedcdns.com, none),

reflectednetworks(www.e-static.pornmd.com.sds.rncdn7.com, all),

rocketcdn(www.mediacdn.karnaval.com.streamprovider.net, all),

singularcdn(h2.singularcdn.net.br, all),

stackpath(www.adoramapix-8u9vvrwnlphhiqnu.stackpathdns.com, all),

swiftcdn(secure.aims.jns.swiftserve.com, all),

unicorncdn(xc3uk5s3rf.unicorncdn.net, all), wordpress(www.2.gravatar.com, all),

yottaa(www.a19af6306e7c013695900a3ba3fac80a.yottaa.net, all),

zenedge(104-225-137-39-tls12.zenedge.net, all)

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Mao, J., Rabinovich, M., Schomp, K. (2022). Assessing Support for DNS-over-TCP in the Wild. In: Hohlfeld, O., Moura, G., Pelsser, C. (eds) Passive and Active Measurement. PAM 2022. Lecture Notes in Computer Science, vol 13210. Springer, Cham. https://doi.org/10.1007/978-3-030-98785-5_22

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-98785-5_22

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-98784-8

  • Online ISBN: 978-3-030-98785-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation