Deleting Your Domain? Preventing Data Leaks at TLD Scale
summary
SIDN builds LEMMINGS, a system that watches .nl DNS for mail MX queries and alerts former registrants when deleted domains still receive mail-related traffic. It runs on a Spark/HDFS pipeline processing ~4 billion DNS queries/day, analyzed ~600,000 deleted domains over nine months, filtered ~75% noise, and sent ~54,000 alerts. Outcomes: cancel-delete rates jump ~4×/6×/8× for low/medium/high risk, ~90% of high-risk names are re-registered within 30 days, and 60% show new mail servers within six months. LEMMINGS inspects only DNS metadata, not email content.
AI-written summary · about
chapters (14)
- 0:00Preventing domain data leaks
- 1:50Deleted domains and email leaks
- 5:45Lemmings warning system
- 11:00Domain lifecycle and Lemmings
- 15:36System architecture and data sources
- 21:23Filtering DNS email queries
- 25:02Risk rules and alert categorization
- 26:48Warning design and effectiveness
- 30:38Pilot results and registry feedback
- 31:42Measuring system impact
- 34:52Future challenges and improvements
- 35:14Key takeaways and impact
- 36:40Collaboration with TLDs
- 39:13Q&A
related talks
43mDetecting and Preventing Malicious Domain Registrations in the .eu TLD
27mA Longitudinal, End-to-End View of the DNSSEC Ecosystem
58mNew (And Newly - Changed) Fully Qualified Doman Names: A View of Worldwide Changes to DNS
19mHow Safe Is Your Domain?
46mExploring the ecosystem of malicious domain registrations in the .eu TLD
35mGame of Registrars...
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
26mMisuse of DNS, the Second Most Used Protocol