Nervous ISPs replace Chrome as strange consumers of DNS resources

Google has fixed the flaws in the Chromium browser engine that saw it poll DNS root servers, but ISPs who seem to have odd views about resilience now emerged as a new source of probably-well-meaning overconsumption of internet resources.

ICANN’s office of the Chief Technology Officer delivered that view on Monday during the governance org’s annual conference in Bali, Indonesia, in a session that shared recent data from its Identifier Technology Health Indicators (ITHI) research program which monitors the security, stability and resilience of the domain name system.

ICANN principal technologist Maud Durand opened with a discussion of “Chromiods” the odd flaw in Chrome that meant well-meaning efforts to avoid a form of DNS hijacking caused the browser to generate about half of all DNS root server traffic during the year 2020.

Given Chrome’s enormous prevalence, that traffic was unwelcome.

ICANN, plus other internetworking and governance stakeholders, told Google to sort it out. Durand said the Chocolate Factory gradually did. ICANN has kept measuring the impact Chrome makes and Durand shared the graph below which shows the browser’s share of DNS root server traffic falling from 45 percent to one percent today.

Or as Durand described it, “in the noise.”

ICANN has now detected a new source of odd DNS traffic: ISPs that use multiple DNS servers for every one of their customers’ requests.

“Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” Durand said, labelling this practice a “belt and suspenders” approach because a single resolver usually suffices to keep services up.

It’s good practice to specify primary and secondary DNS resolvers, in case one doesn’t work. But DNS resolvers are already very resilient, and making multiple requests is unusual.

The ISPs ICANN has spotted send DNS requests over IPv4 and IPv6, and for non-cached requests repeat them within 100 milliseconds for about half of queries. A further 30 percent repeat within thirty seconds.

“It is hard to know if it is a bug or a specific behaviour,” Durand said, before advancing a personal theory that the ISPs who use this odd resilience technique can’t hire skilled internetworking engineers and therefore created a kind of brute-force resilience routine. The organization is researching the cause.

ICANN feels the ISPs using this practice aren’t major players, but the org worries that if the practice becomes widespread, or is adopted by a large entity, it could have a nasty impact.

Pointlessly busy DNS servers also matter because ICANN thinks the number of DNS service providers is becoming more concentrated.

ICANN has tried to calculate how many DNS resolvers half of internet users can “see” when they are online. As the graph below shows, users could see almost 250 resolver farms in the year 2020. That figure is just under 150 today.

Again, Durand isn’t sure why but suspects the number of DNS resolver operators might be shrinking and that the remaining visible resolvers belong to tech giants. ®