Infrastructurednsnetworkingispsmeasurement
ICANN data shows some ISPs sending every DNS query to Google, Cloudflare and a third resolver at once, and nobody can tell if it's a bug
ICANN's measurements caught unnamed ISP resolvers asking three public resolvers the same question, over IPv4 and IPv6, with half the repeats inside 100 milliseconds. Chrome, the old DNS hog, has faded to the noise.
Durand’s job includes ICANN’s Identifier Technology Health Indicators, a measurement project the organization’s CTO office has run since 2017, and her session in Bali was about what the numbers show this year. One pattern stood out. “Every single DNS query is sent three times: to Google, to Cloudflare, and to another DNS resolver,” she said, describing what some ISP resolvers do, according to The Register.
The copies go out over IPv4 and IPv6. For queries that aren’t already cached, the repeats arrive “within 100 milliseconds for about half of queries,” and a further 30 percent show up within thirty seconds.
Durand called it “belt and suspenders.” Her own theory, offered as a theory, is that these ISPs lack the engineers to build resilience properly and went for brute force instead: ask everyone, take whichever answer comes back first.
The old champion of wasted DNS was Chrome. In 2020, Verisign’s Duane Wessels and Matt Thomas found that “half of the DNS root server traffic is very likely due to Chromium’s probes,” out of “about 60 billion queries to the root server system on a typical day.” Chromium was checking whether networks hijacked typos by looking up three random made-up names, and every one of them went all the way to the root. Google changed it after the pressure, and Durand now puts Chrome’s share “in the noise,” about 1 percent.
ICANN isn’t the only one seeing doubles. In June, APNIC’s Geoff Huston measured 43% of nearly 260 million test queries arriving as duplicates, with 45% of those duplicates landing within 10 milliseconds, behaviour he described as “not exactly friendly to the network or to the authoritative server.”
The ISPs doing the triple-send “aren’t major players,” ICANN says, but it warns that if the habit spreads it “could have a nasty impact.” Whether any of them meant to do it is still unknown.
Redundancy is supposed to mean a backup that waits. Asking every backup at once, on every lookup, buys a few milliseconds and spends it on somebody else’s servers. It’s the network version of calling three taxi companies and taking whichever car shows up first.
Small ISPs lean on Google, Cloudflare and outfits like Quad9 because running good recursive DNS is real work. That reliance is fine. Tripling it, on every lookup, for every customer, is a cost those providers carry for a speedup the ISP’s users will barely notice.