ECSeptional DNS Data: Evaluating Nameserver ECS Deployments with Response-Aware Scanning

2024-12-11

arXiv.org

AI Summary

This work addresses the lack of systematic evaluation of EDNS0 Client Subnet (ECS) deployment in DNS. We propose a response-aware scanning methodology that models authoritative servers’ response patterns to ECS queries, enabling adaptive, low-overhead probing. Our approach reduces query volume by 97% and constitutes the first scalable, dual-stack (IPv4/IPv6) ECS scanning framework. Empirically, we quantify global ECS adoption across authoritative DNS services for the first time: 53% support prefix-based responses, revealing severe operational fragmentation. Notably, we uncover widespread non-compliance with the official ECS specification among Google’s nameservers—exposing critical standardization gaps. We publicly release our scanner and dataset, significantly enhancing observability and standardization of DNS infrastructure.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Search and Optimization: Distributed Search
• Data Mining & Knowledge Management: Scalability, Parallel & Distributed Systems

Application Category

• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Security and Privacy: Large-scale security measurements
• Economics, Online Markets and Human Computation: Incentives in network design for Web infrastructures and ecosystems

Abstract

DNS is one of the cornerstones of the Internet. Nowadays, a substantial fraction of DNS queries are handled by public resolvers (e.g., Google Public DNS and Cisco's OpenDNS) rather than ISP nameservers. This behavior makes it difficult for authoritative nameservers to provide answers based on the requesting resolver. The impact is especially important for entities that make client origin inferences to perform DNS-based load balancing (e.g., CDNS). The EDNS0 Client Subnet (ECS) option adds the client's IP prefix to DNS queries, which allows authoritative nameservers to provide prefix-based responses. In this study, we introduce a new method for conducting ECS scans, which provides insights into ECS behavior and significantly reduces the required number of queries by up to 97% compared to state-of-the-art techniques. Our approach is also the first to facilitate ECS scans for IPv6. We conduct a comprehensive evaluation of the ECS landscape, examining the usage and implementation of ECS across various services. Overall, 53% of all nameservers support prefix-based responses. Furthermore, we find that Google nameservers do not comply with the Google Public DNS guidelines. Lastly, we plan to make our tool, and data publicly available to foster further research in the area.

Problem

• Evaluating ECS deployment in DNS for client origin inference
• Reducing query volume in ECS scans by 97%
• Assessing IPv6 ECS support and nameserver compliance

Innovation

• Introduces response-aware scanning for ECS
• Reduces query number by up to 97%
• First to enable IPv6 ECS scans