Guardians of DNS Integrity: A Remote Method for Identifying DNSSEC Validators Across the Internet
<|reference_start|>Guardians of DNS Integrity: A Remote Method for Identifying DNSSEC Validators Across the Internet: DNS Security Extensions (DNSSEC) provide the most effective way to fight DNS cache poisoning attacks. Yet, very few DNS resolvers perform DNSSEC validation. Identifying such systems is non-trivial and the existing methods are not suitable for Internet-scale measurements. In this paper, we propose a novel remote technique for identifying DNSSEC-validating resolvers. The proposed method consists of two steps. In the first step, we identify open resolvers by scanning 3.1 billion end hosts and request every non-forwarder to resolve one correct and seven deliberately misconfigured domains. We then build a classifier that discriminates validators from non-validators based on query patterns and DNS response codes. We find that while most open resolvers are DNSSEC-enabled, less than 18% in IPv4 (38% in IPv6) validate received responses. In the second step, we remotely identify closed non-forwarders in networks that do not have inbound Source Address Validation (SAV) in place. Using the classifier built in step one, we identify 37.4% IPv4 (42.9% IPv6) closed DNSSEC validators and cross-validate the results using RIPE Atlas probes. Finally, we show that the discovered (non)-validators actively send requests to DNS root servers, suggesting that we deal with operational recursive resolvers rather than misconfigured machines.<|reference_end|>
@article{nosyk2024guardians,
    title={Guardians of DNS Integrity: A Remote Method for Identifying DNSSEC
  Validators Across the Internet},
    author={Yevheniya Nosyk and Maciej Korczy'nski and Andrzej Duda},
    journal={arXiv preprint arXiv:2405.19851},
    year={2024},
    doi={10.1109/TrustCom60117.2023.00201},
    archivePrefix={arXiv},
    eprint={2405.19851},
    primaryClass={cs.CR cs.NI}
}