{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,17]],"date-time":"2024-07-17T05:22:37Z","timestamp":1721193757029},"reference-count":26,"publisher":"Association for Computing Machinery (ACM)","issue":"4","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2013,7]]},"abstract":"The Domain Name System (DNS) allows clients to use resolvers, sometimes called caches, to query a set of authoritative servers to translate host names into IP addresses. Prior work has proposed using the interaction between these DNS resolvers and the authoritative servers as an access control mechanism. However, while prior work has examined the DNS from many angles, the resolver component has received little scrutiny. Essential factors for using a resolver in an access control system, such as whether a resolver is part of an ISP\u2019s infrastructure or running on an end-user\u2019s system, have not been examined. In this study, we examine DNS resolver behavior and usage, from query patterns and reactions to nonstandard responses to passive association techniques to pair resolvers with their client hosts. In doing so, we discover evidence of security protocol support, misconfigured resolvers, techniques to fingerprint resolvers, and features for detecting automated clients. These measurements can influence the implementation and design of these resolvers and DNS-based access control systems.<\/jats:p>","DOI":"10.1145\/2499926.2499928","type":"journal-article","created":{"date-parts":[[2013,7,25]],"date-time":"2013-07-25T19:12:41Z","timestamp":1374779561000},"page":"1-17","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":16,"title":["Resolvers Revealed"],"prefix":"10.1145","volume":"12","author":[{"given":"Craig A.","family":"Shue","sequence":"first","affiliation":[{"name":"Worcester Polytechnic Institute"}]},{"given":"Andrew J.","family":"Kalafut","sequence":"additional","affiliation":[{"name":"Grand Valley State University"}]}],"member":"320","published-online":{"date-parts":[[2013,7]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879144"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Arends R. Austein R. Larson M. Massey D. and Rose S. 2005. Protocol modifications for the dns security extensions. IETF rfc 4035. http:\/\/tools.ietf.org\/html\/rfc4035. Arends R. Austein R. Larson M. Massey D. and Rose S. 2005. Protocol modifications for the dns security extensions. IETF rfc 4035. http:\/\/tools.ietf.org\/html\/rfc4035.","DOI":"10.17487\/rfc4035"},{"key":"e_1_2_1_3_1","unstructured":"ARIN. 2010. ASN listing. https:\/\/www.arin.net\/. ARIN. 2010. ASN listing. https:\/\/www.arin.net\/."},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the IEEE International Conference on Computer and Information Technology. 715--720","author":"Choi H."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(02)00424-3"},{"key":"e_1_2_1_6_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium.","author":"Dagon D."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/EC2ND.2011.16"},{"key":"e_1_2_1_8_1","unstructured":"Google. 2011. Google public dns. http:\/\/code.google.com\/speed\/public-dns\/. Google. 2011. Google public dns. http:\/\/code.google.com\/speed\/public-dns\/."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382283"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2002.803905"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2011.2130537"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the General Track of the Annual Conference at the USENIX Annual Technical Conference.","author":"Mao Z. M."},{"key":"e_1_2_1_13_1","doi-asserted-by":"crossref","unstructured":"Mockapetris P. 1987. Domain implementation and specification. IETF rfc 1035. http:\/\/tools.ietf.org\/html\/rfc1035. Mockapetris P. 1987. Domain implementation and specification. IETF rfc 1035. http:\/\/tools.ietf.org\/html\/rfc1035.","DOI":"10.17487\/rfc1035"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_9"},{"key":"e_1_2_1_15_1","unstructured":"OpenDNS. 2011. OpenDNS. http:\/\/www.opendns.com\/. OpenDNS. 2011. OpenDNS. http:\/\/www.opendns.com\/."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2009.090404"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159947"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298324"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2185376.2185386"},{"key":"e_1_2_1_20_1","unstructured":"Sisson G. 2010. DNS survey: October 2010. Tech. rep. The Measurement Factory. http:\/\/dns.measurement-factory.com\/surveys\/201010\/. Sisson G. 2010. DNS survey: October 2010. Tech. rep. The Measurement Factory. http:\/\/dns.measurement-factory.com\/surveys\/201010\/."},{"key":"e_1_2_1_21_1","unstructured":"Spamhaus Project. 2010a. Exploits block list (xbl). http:\/\/www.spamhaus.org\/xbl\/index.lasso. Spamhaus Project. 2010a. Exploits block list (xbl). http:\/\/www.spamhaus.org\/xbl\/index.lasso."},{"key":"e_1_2_1_22_1","unstructured":"Spamhaus Project. 2010b. Spamhaus block list (SBL). http:\/\/www.spamhaus.org\/sbl\/index.lasso. Spamhaus Project. 2010b. Spamhaus block list (SBL). http:\/\/www.spamhaus.org\/sbl\/index.lasso."},{"key":"e_1_2_1_23_1","unstructured":"University of Oregon Advanced Network Technology Center. 2010. Route views project. http:\/\/www.routeviews.org\/. University of Oregon Advanced Network Technology Center. 2010. Route views project. http:\/\/www.routeviews.org\/."},{"key":"e_1_2_1_24_1","doi-asserted-by":"crossref","unstructured":"Vixie P. 1999. Extension mechanisms for dns (edns0). IETF rfc 2671. http:\/\/www.ietf.org\/rfc\/rfc2671.txt. Vixie P. 1999. Extension mechanisms for dns (edns0). IETF rfc 2671. http:\/\/www.ietf.org\/rfc\/rfc2671.txt.","DOI":"10.17487\/rfc2671"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the 22nd International Conference on Theory and Applications of Cryptographic (EUROCRYPT\u201903)","author":"Von Ahn L."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_8"}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2499926.2499928","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,30]],"date-time":"2022-12-30T09:33:28Z","timestamp":1672392808000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2499926.2499928"}},"subtitle":["Characterizing DNS Resolvers and their Clients"],"short-title":[],"issued":{"date-parts":[[2013,7]]},"references-count":26,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2013,7]]}},"alternative-id":["10.1145\/2499926.2499928"],"URL":"https:\/\/doi.org\/10.1145\/2499926.2499928","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2013,7]]},"assertion":[{"value":"2012-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2013-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2013-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}