A Second Look at DNS QNAME Minimization

Abstract

The Domain Name System (DNS) is a critical Internet infrastructure that translates human-readable domain names to IP addresses. It was originally designed over 35 years ago and multiple enhancements have since then been made, in particular to make DNS lookups more secure and privacy preserving. Query name minimization () was initially introduced in 2016 to limit the exposure of queries sent across DNS and thereby enhance privacy. In this paper, we take a look at the adoption of , building upon and extending measurements made by De Vries et al. in 2018. We analyze adoption on the Internet using active measurements both on resolvers used by RIPE Atlas probes and on open resolvers. Aside from adding more vantage points when measuring adoption on open resolvers, we also increase the number of repetitions, which reveals conflicting resolvers – resolvers that support for some queries but not for others. For the passive measurements at root and Top-Level Domain (TLD) name servers, we extend the analysis over a longer period of time, introduce additional sources, and filter out non-valid queries. Furthermore, our controlled experiments measure performance and result quality of newer versions of the -enabled open source resolvers used in the previous study, with the addition of PowerDNS. Our results, using extended methods from previous work, show that the adoption of has significantly increased since 2018. New controlled experiments also show a trend of higher number of packets used by resolvers and lower error rates in the DNS queries. Since is a balance between performance and privacy, we further discuss the depth limit of minimizing labels and propose the use of a public suffix list for setting this limit.

Deep Dive into NTP Pool's Popularity and Mapping

“…For example, instead of querying the root DNS servers for time.apple.com (which the roots cannot directly answer, they can only point to where the .com authoritative servers), a recursive resolver using qname minimization will only query the root for .com, hiding the full name. While study has shown that qname minimization is still not widespread [17], its use is growing [42]. Our method applies only to resolvers that do not use qname minimization.…”