Internet service providers (ISPs) are emerging as unexpected contributors to excessive DNS traffic, following Google’s resolution of a similar issue in its Chrome browser, according to findings presented at ICANN’s annual conference.
During the event in Bali, Indonesia, ICANN’s Office of the CTO highlighted data from its Identifier Technology Health Indicators (ITHI) program, which monitors the domain name system’s security, stability, and resilience. Principal technologist Maud Durand discussed how Chrome’s “Chromiods” flaw—caused by well-intentioned anti-hijacking measures—once accounted for approximately half of all DNS root server traffic in 2020.
Given Chrome’s widespread use, this traffic was significant. ICANN and other stakeholders collaborated with Google to address the issue, resulting in a dramatic reduction from 45% to just 1% of DNS root server traffic today—a change Durand described as “in the noise.”
However, ICANN has now identified a new source of anomalous DNS traffic: ISPs that redundantly send every DNS query to multiple resolvers, such as Google, Cloudflare, and another provider. Durand likened this to a “belt and suspenders” approach, though a single resolver typically suffices for reliability.
While specifying primary and secondary DNS resolvers is standard practice for redundancy, the observed behavior involves sending requests over both IPv4 and IPv6, with about half of non-cached queries repeated within 100 milliseconds and 30% within thirty seconds. Durand speculated that this might stem from a lack of skilled networking engineers at some ISPs, leading to brute-force resilience methods. ICANN is investigating the cause.
Although these ISPs are not major players, ICANN warns that widespread adoption could strain DNS resources. This concern is amplified by a trend toward concentration in DNS service provision; the number of resolver farms visible to half of internet users has declined from nearly 250 in 2020 to under 150 today, potentially favoring large tech providers.
Durand expressed uncertainty about the reasons behind this consolidation but suggested that shrinking resolver operators might be overshadowed by tech giants, further centralizing DNS infrastructure.