Survey of DNS resolution failure analysis methods

Zeng Meng; Zhu Yujia; Li Baiyang; Wang Zhiyang; Chen Wenyu; Liu Qingyun

doi:10.11959/j.issn.2096-109x.2026002

您当前的位置：

首页 >

文章列表页 >

Survey of DNS resolution failure analysis methods

Comprehensive Reviews | 更新时间：2026-05-26

- Survey of DNS resolution failure analysis methods
- Chinese Journal of Network and Information Security Vol. 12, Issue 1, Pages: 1-17(2026)
- 作者机构：
  
  1.中国科学院信息工程研究所，北京 100085
  2.中国科学院大学网络空间安全学院，北京 100049
  3.中国互联网络信息中心，北京 100079
- 作者简介：
- 基金信息：
  
  The National key Research and Development Program of China(2024YFF1401304)
- DOI：10.11959/j.issn.2096-109x.2026002
  CLC： TP393
- Received：16 July 2025，
  
  Revised：2025-10-19，
  
  Published：25 February 2026
- 稿件说明：
移动端阅览
曾濛, 朱宇佳, 李白杨, 等. DNS解析失败分析方法综述[J]. 网络与信息安全学报, 2026, 12(1): 1-17.

Zeng Meng, Zhu Yujia, Li Baiyang, et al. Survey of DNS resolution failure analysis methods[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 1-17.
曾濛, 朱宇佳, 李白杨, 等. DNS解析失败分析方法综述[J]. 网络与信息安全学报, 2026, 12(1): 1-17. DOI： 10.11959/j.issn.2096-109x.2026002.

Zeng Meng, Zhu Yujia, Li Baiyang, et al. Survey of DNS resolution failure analysis methods[J]. Chinese Journal of Network and Information Security, 2026, 12(1): 1-17. DOI： 10.11959/j.issn.2096-109x.2026002.

摘要

域名系统（domain name system

DNS）是互联网的核心基础设施，其解析可靠性直接影响网络服务的可用性与用户体验。然而，随着DNS的功能扩展与体系结构复杂度的增加，DNS解析失败日益频发。现有针对DNS解析失败的研究较为碎片化，缺乏系统性的归纳与方法论支撑。鉴于此，从协议实施缺陷、配置错误、域名滥用、网络与管理问题4个维度提出分类归因框架，系统地刻画了DNS解析失败的成因与特征。基于该框架，结合互联网工程任务组发布的请求评议标准与典型案例，提出了协议一致性测试、自动化配置校验、域名信誉评分、高可用部署架构等缓解思路，为DNS故障诊断和防护提供系统化的分析视角与实践参考。

Abstract

As the cornerstone of Internet infrastructure

the Domain Name System (DNS) underpins network availability and user experience. However

the continuous evolution of DNS functionality and its growing architectural complexity have significantly exacerbated the risk of resolution failures. Despite this

existing literature remained fragmented and lacked systematic synthesis or a robust methodological foundation. To address this gap

a four-dimensional attribution framework was proposed to systematically characterize the etiology and patterns of DNS failures

covering protocol implementation defects

configuration errors

domain abuse

and network management challenges. Based on this framework

mitigation strategies were further identified by integrating the request for comments (RFC) standards published by the internet engineering task force (IETF) with real-world case studies

including protocol compliance testing

automated configuration validation

domain reputation scoring

and high-availability deployment architecture. This work provides a comprehensive analytical perspective and practical guidelines for effective DNS failure diagnosis and resilience.

关键词

Keywords

references

Park J , Khormali A , Mohaisen M , et al . Where are you taking me? behavioral analysis of open DNS resolvers [C ] // Proceedings of the 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2019 : 493 - 504 .

Internet Engineering Task Force . Common DNS implementation errors and suggested Fixes : RFC1536 [S ] . 1993 .

Internet Engineering Task Force . Observed DNS resolution misbehavior: RFC 4697 [S ] . 2006 .

Internet Engineering Task Force . Common DNS data file configuration errors: RFC 1537 [S ] . 1993 .

Internet Engineering Task Force . Common DNS operational and configuration errors: RFC 1912 [S ] . 1996 .

Internet Engineering Task Force . Operational considerations and issues with IPv6 DNS: RFC 4472 [S ] . 2006 .

Xu W , Li X , Lu C Y , et al . TsuKing: coordinating DNS resolvers and queries into potent DoS amplifiers [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 311 - 325 .

Li X , Wu D S , Duan H X , et al . DNSBomb: a new practical-and-powerful pulsing DoS attack exploiting DNS queries-and-responses [C ] // Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2024 : 4478 - 4496 .

Nosyk Y , KorczyńSki M , Duda A . Routing loops asMega amplifiers for DNS-based DDoS attacks [C ] // Proceedings of Passive and Active Measurement . Cham : Springer , 2022 : 629 - 644 .

Nawrocki M , Jonker M , Schmidt T C , et al . The far side of DNS amplification: tracing the DDoS attack ecosystem from the Internet core [C ] // Proceedings of the 21st ACM Internet Measurement Conference . New York : ACM , 2021 : 419 - 434 .

Li X , Xu W , Liu B J , et al . TuDoor attack: systematically exploring and exploiting logic vulnerabilities in DNS response pre-processing with malformed packets [C ] // Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2024 : 4459 - 4477 .

Lu K Y , Chai T T , Xu H Y , et al . Research on unexpected DNS response from open DNS resolvers [J ] . The Computer Journal , 2022 , 65 ( 9 ): 2276 - 2298 .

Moura G C M , MüLler M , Davids M , et al . Fragmentation, truncation, and timeouts: are large DNS messages falling to bits? [C ] // Passive and Active Measurement . Cham : Springer , 2021 : 460 - 477 .

Nosyk Y , KorczyńSki M , Duda A . Extended DNS errors: unlocking the full potential of DNS troubleshooting [C ] // Proceedings of the 2023 ACM on Internet Measurement Conference . New York : ACM , 2023 : 213 - 221 .

Afek Y , Bremler-Barr A , Peleg N . Poster: measuring open resolvers negative caching [J ] . 2021 .

Shafir L , Afek Y , Bremler-Barr A , et al . DNS negative caching in the wild [C ] // Proceedings of the ACM SIGCOMM 2019 Conference Posters and Demos . New York : ACM , 2019 : 143 - 145 .

Zeng M , Zhu Y J , Li B Y , et al . Failed yet stored: a first look at DNS negative caching [C ] // Proceedings of the 2024 IEEE International Performance, Computing, and Communications Conference (IPCCC) . Piscataway : IEEE Press , 2025 : 1 - 10 .

Moura G C M , Heidemann J , De O Schmidt R , et al . Cache me if you can: effects of DNS time-to-live [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 : 101 - 115 .

Schomp K , Callahan T , Rabinovich M , et al . On measuring the client-side DNS infrastructure [C ] // Proceedings of the 2013 Conference on Internet Measurement Conference . New York : ACM , 2013 : 77 - 90 .

De Vries W B , Scheitle Q , MüLler M , et al . A first look at QNAME minimization in the domain name system [C ] // Passive and Active Measurement . Cham : Springer , 2019 : 147 - 160 .

Magnusson J , MüLler M , Brunstrom A , et al . A second look at DNS QNAME minimization [C ] // Proceedings of the 24th International Conference on Passive and Active Measurement . Cham : Springer , 2023 : 496 - 521 .

Mbewe E S , Chavula J . On QoE impact of DoH and DoT in Africa: why a user’s DNS choice matters [C ] // Proceedings of International Conference on Towards new e-Infrastructure and e-Services for Developing Countries . Cham : Springer , 2021 : 289 - 304 .

Heftrig E , Schulmann H , Vogel N , et al . The harder you try, the harder you fail: the KeyTrap denial-of-service algorithmic complexity attacks on DNSSEC [C ] // Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 497 - 510 .

Chung T , Rijswijk-Deij R V , Chandrasekaran B , et al . A longitudinal,end-to-end view of the DNSSEC ecosystem [C ] // Proceedings of the 26th USENIX Security Symposium . Berkeley : USENIX Association , 2017 : 1307 - 1322 .

Van Adrichem N L M , Blenn N , LúA A R , et al . A measurement study of DNSSEC misconfigurations [J ] . Security Informatics , 2015 , 4 ( 8 ): 1 - 14 .

Dai T X , Shulman H , Waidner M . DNSSEC misconfigurations in popular domains [C ] // Proceedings of International Conference on Cryptology and Network Security . Cham : Springer , 2016 : 651 - 660 .

Wander M . Measurement survey of server-side DNSSEC adoption [C ] // Proceedings of the 2017 Network Traffic Measurement and Analysis Conference (TMA) . Piscataway : IEEE Press , 2017 : 1 - 9 .

刘林晖 , 涂菲帆 , 陈勇 , 等 . 递归侧DNSSEC错误配置检测能力大规模探测分析 [J ] . 2024 , 10 ( 5 ): 81 - 94 .

Liu L H , Tu F F , Chen Y , et al . Large-scale measurement and analysis on misconfigurations of DNSSEC from recursive side [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 81 - 94 .

Zhang Q , Bai X , Li X , et al . ResolverFuzz: automated discovery of DNS resolver vulnerabilities with query-response fuzzing [C ] // Proceedings of the 33rd USENIX Security Symposium . Berkeley : USENIX Association , 2024 : 4729 - 4746 .

Yang D H , Li Z Y , Jiang H Y , et al . A deep dive into DNS behavior and query failures [J ] . Computer Networks , 2022 , 214 : 109131 .

Lyu M Z , Gharakheili H H , Russell C , et al . Analyzing enterprise DNS traffic to classify assets and track cyber-health [J ] . arXiv: 2201.07352 , 2022 .

Takano Y , Ando R , Takahashi T , et al . A measurement study of open resolvers and DNS server version [C ] // Internet Conference (IEICE) . 2013 .

Müller M , Moura G C M , De O Schmidt R , et al . Recursives in the wild: engineering authoritative DNS servers [C ] // Proceedings of the 2017 Internet Measurement Conference . New York : ACM , 2017 : 489 - 495 .

Ager B , MüHlbauer W , Smaragdakis G , et al . Comparing DNS resolvers in the wild [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement . New York : ACM , 2010 : 15 - 21 .

郝逸航 , 刘紫千 , 常力元 , 等 . 基于Sketch的重要DNS查询缓存方法 [J ] . 网络与信息安全学报 , 2024 , 10 ( 5 ): 95 - 106 .

Hao Y H , Liu Z Q , Chang L Y , et al . Sketch-based caching method for significant DNS queries [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 95 - 106 .

Liu D P , Hao S , Wang H N . All your DNS records point to us: understanding the security threats of dangling DNS records [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2016 : 1414 - 1425 .

Zhang M M , Li X , Liu B J , et al . Detecting and measuring security risks of hosting-based dangling domains [J ] . Proceedings of the ACM on Measurement and Analysis of Computing Systems , 2023 , 7 ( 1 ): 1 - 28 .

Pappas V , Xu Z G , Lu S W , et al . Impact of configuration errors on DNS robustness [C ] // Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications . 2004 : 319 - 330 .

Akiwate G , Jonker M , Sommese R , et al . Unresolved issues: prevalence, persistence, and perils of lame delegations [C ] // Proceedings of the ACM Internet Measurement Conference . New York : ACM , 2020 : 281 - 294 .

Sommese R , Moura G C M , Jonker M , et al . When parents and children disagree: diving into DNS delegation inconsistency [C ] // Passive and Active Measurement . Cham : Springer , 2020 : 175 - 189 .

Zhang Y Y , Liu B J , Duan H X , et al . Rethinking the security threats of stale DNS glue records [C ] // Proceedings of the 33rd USENIX Security Symposium . Berkeley : USENIX Association , 2024 : 1261 - 1277 .

Jung J , Sit E , Balakrishnan H , et al . DNS performance and the effectiveness of caching [C ] // Proceedings of the IEEE/ACM Transactions on Networking . Piscataway : IEEE Press , 2002 , 10 ( 5 ): 589 - 603 .

Bojović P D , Gajin S . An approach to evaluation of common DNS misconfigurations [J ] . arXiv: 1711.05696 , 2017 .

Jiang J , Zhang J , Duan H X , et al . Analysis and measurement of zone dependency in the domain name system [C ] // Proceedings of the 2018 IEEE International Conference on Communications (ICC) . Piscataway : IEEE Press , 2018 : 1 - 7 .

Deccio C , Chen C C , Mohapatra P , et al . Quality of name resolution in the domain name system [C ] // Proceedings of the 2009 17th IEEE International Conference on Network Protocols . Piscataway : IEEE Press , 2009 : 113 - 122 .

Nikiforakis N , Van Acker S , Meert W , et al . Bitsquatting: exploiting bit-flips for fun, or profit? [C ] // Proceedings of the 22nd International Conference on World Wide Web . New York : ACM , 2013 : 989 - 998 .

Kintis P , Miramirkhani N , Lever C , et al . Hiding in plain sight: a longitudinal study of combosquatting abuse [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 569 - 586 .

Agten P , Joosen W , Piessens F , et al . Seven months' worth of mistakes: a longitudinal study of typosquatting abuse [C ] // Proceedings 2015 Network and Distributed System Security Symposium . Internet Society , 2015 .

Wang Y M , Beck D , Wang J , et al . Strider typo-patrol: discovery and analysis of systematic typo-squatting [J ] . SRUTI , 2006 .

Vissers T , Barron T , Van Goethem T , et al . The wolf of name street: hijacking domains through their nameservers [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 957 - 970 .

Lauinger T , Chaabane A , Buyukkayhan A S , et al . Game of registrars: an empirical analysis of post-expiration domain name takeovers [C ] // Proceedings of the 26th USENIX Security Symposium . Berkeley : USENIX Association , 2017 : 865 - 880 .

Lauinger T , Onarlioglu K , Chaabane A , et al . WHOIS lost in translation: (mis)understanding domain name expiration and re-registration [C ] // Proceedings of the 2016 Internet Measurement Conference . New York : ACM , 2016 : 247 - 253 .

Lever C , Walls R , Nadji Y , et al . Domain-Z: 28 registrations later measuring the exploitation of residual trust in domains [C ] // Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2016 : 691 - 706 .

Moore T , Clayton R . The ghosts of banking past: empirical analysis of closed bank websites [M ] // Financial Cryptography and Data Security . Berlin, Heidelberg : Springer , 2014 : 33 - 48 .

Hao S , Thomas M , Paxson V , et al . Understanding the domain registration behavior of spammers [C ] // Proceedings of the 2013 Conference on Internet Measurement Conference . New York : ACM , 2013 : 63 - 76 .

马永征 , 李洪涛 , 马中胜 , 等 . 防护性DNS服务关键技术研究综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 5 ): 39 - 55 .

Ma Y Z , Li H T , Ma Z S , et al . Survey on key technologies for protective DNS service [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 39 - 55 .

Khalil I M , Guan B , Nabeel M , et al . A domain is only as good as its buddies: detecting stealthy malicious domains via graph inference [C ] // Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy . New York : ACM , 2018 : 330 - 341 .

Kountouras A , Kintis P , Lever C , et al . Enabling network security through active DNS datasets [C ] // Proceedings of Research in Attacks, Intrusions, and Defenses . Cham : Springer , 2016 : 188 - 208 .

Liu G N , Jin L , Hao S , et al . Dial “N”for NXDomain: the scale, origin, and security implications of DNS queries to non-existent domains [C ] // Proceedings of the 2023 ACM on Internet Measurement Conference . New York : ACM , 2023 : 198 - 212 .

Gao H Y , Yegneswaran V , Chen Y , et al . An empirical reexamination of global DNS behavior [C ] // Proceedings of the ACM SIGCOMM 2013 conference on SIGCOMM . New York : ACM , 2013 : 267 - 278 .

Fukuda K , Heidemann J . Detecting malicious activity with DNS backscatter [C ] // Proceedings of the 2015 Internet Measurement Conference . New York : ACM , 2015 : 197 - 210 .

Qu J , Ma X B , Liu W M . Who is DNS serving for a human-software perspective of modeling DNS services [J ] . Knowledge-Based Systems , 2023 , 263 : 110279 .

Schuppen S , Teubert D , Herrmann P , et al . FANCI: feature-based automated NXDomain classification and intelligence [C ] // Proceedings of the 27th USENIX Security Symposium . Berkeley : USENIX Association , 2018 : 1165 - 1181 .

Hao S , Feamster N , Pandrangi R . Monitoring the initial DNS behavior of malicious domains [C ] // Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference . New York : ACM , 2011 : 269 - 278 .

Antonakakis M , Perdisci R , Dagon D , et al . Building a dynamic reputation system for DNS [C ] // Proceedings of the 19th USENIX Security Symposium . Berkeley : USENIX Association , 2010 .

Raman R S , Shenoy P , Kohls K , et al . Censored planet: an Internet-wide, longitudinal censorship observatory [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2020 : 49 - 66 .

Siby S , Juarez M , Diaz C , et al . Encrypted DNS⇒privacy a traffic analysis perspective [J ] . arXiv: 1906.09682 , 2019 .

Pearce P , Jones B , Li F , et al . Global measurement of DNS manipulation [C ] // Proceedings of the 26th USENIX Security Symposium . Berkeley : USENIX Association , 2017 : 307 - 323 .

Feal á , Vallina P , Gamba J , et al . Blocklist babel: on the transparency and dynamics of open source blocklisting [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 2 ): 1334 - 1349 .

Niaki A A , Cho S , Weinberg Z , et al . ICLab: a global,longitudinal Internet censorship measurement platform [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 : 135 - 151 .

Kogan D , Corrigan-Gibbs H . Private blocklist lookups with checklist [C ] // Proceedings of the 30th USENIX security symposium . Berkeley : USENIX Association , 2021 : 875 - 892 .

Internet Engineering Task Force . Extended DNS errors: RFC 8914 [S ] . 2020 .

Hendriks L , De Boer P T , Pras A . IPv6-specific misconfigurations in the DNS [C ] // Proceedings of the 2017 13th International Conference on Network and Service Management (CNSM) . Piscataway : IEEE Press , 2017 : 1 - 5 .

Liao X , Xu J , Zhang Q , et al . A comprehensive study of DNS operational issues by mining DNS forums [J ] . IEEE Access , 2022 , 10 : 110807 - 110820 .

Views

232

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

SI-CP-ABE: an isogeny-based ciphertext-policy attribute-based encryption scheme

Real-time attack scenario reconstruction method based on incremental alert analysis

DynaSynth: a large language model fine-tuning data dynamic synthesis agent tool for unstructured cybersecurity corpus

An identity and group authentication scheme for resource-constrained industrial control devices based on Chinese commericial cryptography

Web service threat detection method based on traffic interaction graph analysis

Related Author

No data

Related Institution

No data

⁰