Abstract:
Caching is a critical method for enhancing the efficiency and the security of the Domain Name System (DNS). Initially, only successful domain name resolution results were...Show MoreMetadata
Abstract:
Caching is a critical method for enhancing the efficiency and the security of the Domain Name System (DNS). Initially, only successful domain name resolution results were cached. To mitigate failures in DNS transactions (e.g. NXDomain), the IETF proposed standards, further developed into RFC 9520 as of December 2023. In addition to the basic implementation, RFC 9520 standardizes more sophisticated forms of negative caching. This new standard aims to reduce redundant query retries in DNS traffic and protect resolvers from Denial of Service (DoS) attacks.In this study, we present a comprehensive examination of the specific implementations of Negative Caching in resolvers. We designed and validated a method for measuring negative caching and conducted experiments on 44 public resolvers, including their Do53, DoH, and DoT interfaces. Our findings indicate that while public resolvers generally implement various types of negative caching, some exhibit unexpected cache handling behaviors when encountering specific negative responses. Additionally, we discovered that most public resolvers modify the TTL value of negative responses before returning them to clients. Despite the lack of explicit TTL values for newly specified negative responses, we devised a method to approximate the default TTL values used by public resolvers.
Date of Conference: 22-24 November 2024
Date Added to IEEE Xplore: 27 January 2025
ISBN Information: