Behavior of DNS’ Top Talkers, a .com/.net View

  • Eric Osterweil
  • Danny McPherson
  • Steve DiBenedetto
  • Christos Papadopoulos
  • Dan Massey
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7192)


This paper provides the first systematic study of DNS data taken from one of the 13 servers for the .com/.net registry. DNS’ generic Top Level Domains (gTLDs) such .com and .net serve resolvers from throughout the Internet and respond to billions of DNS queries every day. This study uses gTLD data to characterize the DNS resolver population and profile DNS query types. The results show a small and relatively stable set of resolvers (i.e. the top-talkers) constitute 90% of the overall traffic. The results provide a basis for understanding for this critical Internet service, insights on typical resolver behaviors and the use of IPv6 in DNS, and provides a foundation for further study of DNS behavior.


Server Selection Domain Name System Query Type IPv6 Address Mail Server 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    DNS-based Authentication of Named Entites (DANE),
  2. 2.
    Electronic Numbering (ENUM),
  3. 3.
    Ager, B., Mühlbauer, W., Smaragdakis, G., Uhlig, S.: Comparing DNS Resolvers in the Wild. In: Proceedings of ACM IMC 2010, Melbourne, Australia (November 2010)Google Scholar
  4. 4.
    Arends, R., Austein, R., Larson, M., Massey, D., Rose, S.: Protocol Modifications for the DNS Security Extensions. RFC 4035 (March 2005)Google Scholar
  5. 5.
    Brownlee, N., Nemeth, E.: Dns measurements at a root server. In: Proceedings of IEEE Global Telecommunications Conference, Globecom 2001 (2001)Google Scholar
  6. 6.
    Internet Software Consortium. ISC BIND Features,
  7. 7.
    Jung, J., Sit, E., Balakrishnan, H., Morris, R.: DNS Performance and the Effectiveness of Caching. In: Internet Measurement Workshop (2001)Google Scholar
  8. 8.
    Mao, Z.M., Cranor, C.D., Douglis, F., Rabinovich, M., Spatscheck, O., Wang, J.: A precise and efficient evaluation of the proximity between web clients and their local dns servers. In: USENIX Annual Technical Conference (2002)Google Scholar
  9. 9.
    Mockapetris, P., Dunlap, K.J.: Development of the domain name system. In: SIGCOMM 1988 (1988)Google Scholar
  10. 10.
    NLnet Labs. unbound DNS resolver,
  11. 11.
    Osterweil, E., Ryan, M., Massey, D., Zhang, L.: Quantifying the operational status of the dnssec deployment. In: IMC 2008 (2008)Google Scholar
  12. 12.
    Wang, X., Wang, Z., Lee, X.: Analyzing bind dns server selection algorithm. International Journal of Innovative Computing, Information and Control (2010)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2012

Authors and Affiliations

  • Eric Osterweil
    • 1
  • Danny McPherson
    • 1
  • Steve DiBenedetto
    • 2
  • Christos Papadopoulos
    • 2
  • Dan Massey
    • 2
  1. 1.Verisign LabsUSA
  2. 2.Colorado State UniversityUSA

Personalised recommendations