ICANN finds ISPs replacing Chrome as strange consumers of DNS resources

Chrome's DNS problem resolved

ICANN's office of the Chief Technology Officer shared new findings during the governance organization's annual conference in Bali, Indonesia, drawing on data from its Identifier Technology Health Indicators research program, which monitors the security, stability and resilience of the domain name system. Principal technologist Maud Durand opened the session with a discussion of Chromiods, the flaw in Chrome that caused well-meaning efforts to avoid DNS hijacking to generate about half of all DNS root server traffic during 2020. Given Chrome's enormous prevalence, that traffic was unwelcome, and ICANN along with other internetworking and governance stakeholders told Google to fix it. Durand said Google gradually did, and ICANN's measurements show the browser's share of DNS root server traffic falling from 45 percent to one percent today, which Durand described as in the noise.

ISPs adopt belt and suspenders DNS approach

ICANN has now detected a new source of odd DNS traffic: ISPs that use multiple DNS servers for every one of their customers' requests. Every single DNS query is sent three times, to Google, to Cloudflare, and to another DNS resolver. Durand labelled this practice a belt and suspenders approach, noting that a single resolver usually suffices to keep services up. While it is good practice to specify primary and secondary DNS resolvers in case one fails, DNS resolvers are already very resilient, and making multiple requests is unusual. The ISPs ICANN has spotted send DNS requests over IPv4 and IPv6, and for non-cached requests repeat them within 100 milliseconds for about half of queries. A further 30 percent repeat within thirty seconds.

Causes and concerns

Durand said it is hard to know whether the behaviour is a bug or intentional, before advancing a personal theory that the ISPs using this odd resilience technique cannot hire skilled internetworking engineers and therefore created a brute-force resilience routine. The organization is researching the cause. ICANN feels the ISPs using this practice are not major players, but worries that if the practice becomes widespread or is adopted by a large entity, it could have a nasty impact.

DNS resolver concentration trend

Pointlessly busy DNS servers also matter because ICANN thinks the number of DNS service providers is becoming more concentrated. ICANN has tried to calculate how many DNS resolvers half of internet users can see when they are online. Users could see almost 250 resolver farms in 2020, and that figure is just under 150 today. Durand is not sure why but suspects the number of DNS resolver operators might be shrinking and that the remaining visible resolvers belong to tech giants.

Sources: The Register