Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path
summary
Large-scale measurement finds on-path DNS interception across networks using 148,478 residential and cellular IPs and two measurement methods a residential proxy and an instrumented security-software debug mode. Results show 259 of 3,047 ASes (8.5%) exhibit interception, with behaviors classified into four resolution types and request redirection preferred over replication. China shows up to 28% of Google Public DNS UDP queries intercepted, many intercepted resolvers run deprecated software and lack DNSSEC, and some responses are actively manipulated.
AI-written summary · about
chapters (7)
- 0:00Introduction to DNS threats
- 2:14DNS resolution models
- 4:50Measurement methodology
- 7:51Technical challenges
- 10:56Interception analysis
- 14:40Motivations and conclusions
- 17:46Q&A session
related talks
29mGlobal Measurement of DNS Manipulation
15mYou Depend on DNS, This Is How It Works and You Won't...
26mMisuse of DNS, the Second Most Used Protocol
12mTriplet Censors: Demystifying Great Firewall’s DNS Censorship Behavior
45mAll the Ways to Control the Internet and More
46mPanel: DNS Privacy Vs.
27mAbuse of CPE Devices and Recommended Fixes
47mDNS On Fire