ISPs generate excess DNS root traffic via redundant resolver queries
Network operators are sending duplicate DNS requests to multiple providers, creating unnecessary load on global infrastructure despite existing resilience.
Key points
- Chrome’s share of DNS root server traffic has dropped from 45 percent to one percent.
- Some ISPs send every DNS query to three different resolvers simultaneously.
- Approximately half of these redundant queries are repeated within 100 milliseconds.
Internet service providers are generating excessive traffic to DNS root servers by sending duplicate queries to multiple resolvers for every single request. This behaviour was highlighted by ICANN principal technologist Maud Durand during the organisation’s annual conference in Bali, Indonesia. The data comes from ICANN’s Identifier Technology Health Indicators research program, which monitors the security and stability of the domain name system. Durand noted that while browser-related issues have been resolved, operator configurations are now the primary source of this unusual resource consumption.
Root cause
The issue stems from a “belt and suspenders” approach to network resilience adopted by certain ISPs. Instead of relying on a single primary resolver with a secondary backup, these operators send every DNS query to three distinct providers: Google, Cloudflare, and another resolver. Durand explained that this practice is unusual because modern DNS resolvers are already highly resilient. Specifying primary and secondary resolvers is standard good practice for handling failures, but making simultaneous multiple requests for every query is not required to keep services operational.
Attack path
This is not a malicious attack but rather a configuration choice that results in overconsumption of internet resources. The ISPs in question send DNS requests over both IPv4 and IPv6 protocols. For queries that are not already cached, the systems repeat the requests rapidly. According to the data presented by ICANN, about half of these non-cached queries are repeated within 100 milliseconds. A further 30 percent of the queries are repeated within thirty seconds, creating a significant volume of redundant traffic that places unnecessary strain on the global DNS infrastructure.
Affected versions
The source material does not specify particular software versions or firmware releases responsible for this behaviour. The issue appears to be tied to the network architecture and configuration policies of specific internet service providers rather than a vulnerability in a specific product version. The data reflects aggregate traffic patterns observed by ICANN’s monitoring systems, identifying the practice as a systemic operational choice rather than a bug in a single software release.
Mitigation
- Review DNS resolver configurations to ensure queries are not being broadcast to multiple providers simultaneously.
- Implement standard primary and secondary resolver setups instead of parallel querying.
- Monitor internal DNS traffic logs for high volumes of duplicate queries within short timeframes.
- Consult with network engineering teams to assess whether current redundancy measures exceed necessary resilience requirements.
Why it matters
Teams usually configure DNS with a primary and secondary resolver to handle outages. Sending every query to multiple providers simultaneously is unnecessary because resolvers are already resilient. This practice creates redundant traffic that burdens global infrastructure. Check whether your network sends parallel requests. Ensure your configuration relies on failover mechanisms rather than constant duplication. Avoid over-engineering resilience in ways that consume shared resources. Focus on standard failover protocols that activate only when the primary resolver fails, maintaining stability without generating excess load on the wider internet.
What to do and how to stay safe: ICANN
- Audit DNS resolver settings to confirm that queries are not being sent to multiple providers at the same time.
- Verify that your network uses a standard primary and secondary resolver model for failover.
- Monitor for high volumes of duplicate DNS requests, particularly those occurring within milliseconds.
- Evaluate whether current redundancy configurations are necessary or if they create unnecessary load on external services.
Step-by-step guide: Password Policies Examples That Reduce Password Fatigue
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are ISPs sending duplicate DNS queries?
They are using a redundant “belt and suspenders” approach, sending every query to three resolvers to ensure resilience.
Has Chrome’s impact on DNS traffic been resolved?
Yes, Chrome’s share of DNS root server traffic has fallen from 45 percent to one percent after Google fixed the flaws.
How quickly are these duplicate queries sent?
About half of the non-cached queries are repeated within 100 milliseconds, with another 30 percent within thirty seconds.
