Recursive DNS Resolver Resilience: Analyzing The Deployment of Measureable KINDNS Practices

How we measure and collect data

Country data comes from APNIC Labs DNSSEC measurements. The country gauge presents the mean validation percentage across available country observations; indeterminate validation is shown as unknown.

For recursive DNS resolver data, we send a simple A-record query for dnssec-failed.org to each known recursive DNS resolver. A SERVFAIL response indicates DNSSEC validation is enabled, while a NOERROR response indicates that it is not enabled. Non-replying recursive DNS resolvers are marked as unknown. dnssec-failed.org is a domain operated by COMCAST with a deliberately broken DNSSEC signature, so a validating resolver will reject the response.

How we measure and collect data

We run active QMIN measurements to observe the query-name sequence generated by each tested recursive DNS resolver. QMIN is classified as properly enabled when the measurement reports QMIN and no more than 10 minimization iterations are observed. More than 10 iterations is highlighted as a potential excessive-query and amplification risk. Measurements explicitly reporting no QMIN are classified as not implemented. Unstable means that repeated measurements produced different QMIN behavior; missing or otherwise inconclusive measurements are shown as unknown.

max_minimise_count is the maximum number of minimization queries observed for a tested recursive DNS resolver, while minimize_one_lab records how many minimization steps reduced the query name by one label.

The horizontal bars show the five most frequently observed values for max_minimise_count and minimize_one_lab across measured recursive DNS resolvers.

How we measure and collect data

CAIDA Spoofer measurements provide active evidence that a network allows or blocks packets with spoofed source addresses. A recursive DNS resolver is classified as allowing spoofing when its AS has allowing evidence, and as actively blocking when its AS has CAIDA blocking evidence but no conflicting allowing evidence. Resolvers without either classification are shown as unknown.

In addition to CAIDA Spoofer data, we use a phenomenon in the open DNS infrastructure called transparent DNS forwarders. These are DNS servers that relay queries to upstream resolvers while retaining the original client's source address, hence forwarding packets with spoofed source IP addresses. The transparent forwarders found by the Open DNS API provide additional evidence that source-address validation is missing or not properly deployed in the AS of the transparent forwarder. More details on this component and the measurement method can be found in the following papers:

• Transparent Forwarders: An Unnoticed Component of the Open DNS Infrastructure by Nawrocki et al. (ACM CoNEXT 2021)
• Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification Attacks by Koch et al. (ACM CCS 2025)

How we measure and collect data

For each AS and economy represented by recursive DNS resolvers, we average the available MANRS readiness scores for anti-spoofing, coordination, filtering, IRR routing information, and RPKI routing information. Each AS or economy contributes equally to the displayed group average.

Open and closed groups are based on whether an AS or economy contains at least one open or closed recursive DNS resolver. An AS or economy can therefore appear in both groups. Entity totals include all matching database entities.