The Domain Name System (DNS) is the foundational phonebook of the internet, translating human-readable web addresses into machine-readable IP addresses. However, its architecture has long been vulnerable to a deceptively simple tactic known as the "random name attack." By flooding a domain’s authoritative nameservers with queries for nonexistent names, attackers can easily bypass local caches and drive servers to a breaking point, rendering legitimate services unavailable.
Understanding how the internet handles these nonexistent requests is crucial for hardening infrastructure against denial-of-service attempts. To shed light on this mechanism, researchers at APNIC Labs have conducted extensive global measurements examining how recursive resolvers and client devices respond to various types of negative DNS responses. Their findings reveal surprising inefficiencies in how the internet deals with traffic that fails to resolve.
The Mechanics of Random Name Attacks
Mounting a random name attack requires far less sophistication than many other cyber threats. Attackers do not need to craft advanced packets or maintain complex control over botnets. Instead, a simple, unprivileged script running on compromised hosts can generate endless variations of randomized domain names within a targeted zone.
Normally, DNS caching protects authoritative nameservers. When an application queries a domain name, local recursive resolvers cache the successful result. If the name does not exist, resolvers similarly cache the "No Such Domain Name" (NXDOMAIN) response, preventing subsequent identical queries from ever reaching the authoritative server.
However, when queries use continuously randomized names, local caches become completely ineffective. Each unique query bypasses the cache entirely and lands directly on the authoritative nameserver. To explore how this ecosystem reacts under real-world conditions, APNIC Labs utilized online advertising networks to seed millions of browser endpoints worldwide with queries to experimental domains. By tracking the resulting traffic on their own authoritative servers spanning multiple continents, researchers could observe how global recursive resolvers behave when forced to resolve nonexistent paths.
Predicted Results and Client Re-Query Timers
Before analyzing empirical data, researchers mapped out expected baseline behaviors. When client applications generate a DNS request, local operating system stub resolvers handle the transmission using the User Datagram Protocol (UDP). Because UDP is connectionless and provides no delivery guarantees, stub resolvers implement timeout timers.
If a response is not received within a specified window—often starting at one second and escalating through a series of retries—the stub resolver repeats the query or shifts to backup recursive resolvers. Similar timeout logic exists within recursive resolvers themselves when querying authoritative nameservers. While some level of retransmission is necessary to handle transient packet loss, overly aggressive timers run the risk of turning a single dropped packet into an unintentional query storm.
When a domain name genuinely does not exist, the authoritative server responds with an NXDOMAIN status code. In an ideal environment without packet loss or extreme network latency, a modern dual-stack client supporting modern protocols like HTTPS should generate a predictable, minimal burst of queries—typically for A, AAAA, and HTTPS record types—before gracefully halting.
Comparing 2019 and 2026 Measurement Data
APNIC Labs first ran this negative response experiment in October 2019, recording roughly 142 million queries across 60 million measurement samples. Even after accounting for standard UDP retransmissions and the global adoption rates of IPv6 at the time, the average of 2.37 queries per unique name was higher than expected.
To see if internet behavior had shifted, researchers repeated and expanded the experiment over a week in August 2026, utilizing a massive pool of over 115 million endpoints. Across this extended window, the servers recorded more than 509 million queries for random nonexistent names, averaging 4.40 queries per unique domain name—nearly double the rate observed seven years prior.
Several factors explain the rising query volume. The widespread deployment of "Happy Eyeballs" dual-stack implementations means modern endpoints routinely fire off concurrent A and AAAA requests, while a significant portion of clients also query for HTTPS records to negotiate connections. However, even after factoring in these protocol advancements, more than half of all observed traffic consisted of query repetitions. While 57% of tested endpoints completed resolution cleanly without unnecessary repeats, the remaining endpoints generated heavy repetition loops, averaging over six repeat queries per test.
Evaluating Alternative Negative Response Types
Faced with this pervasive query repetition, researchers broadened their investigation to ask whether NXDOMAIN is truly the most efficient way to communicate negative results, or if other DNS response codes fare better.
Testing the NOERROR / NODATA response—which indicates that a domain name exists but holds no resource records for the specific query type—yielded a slightly lower average of 3.93 queries per test, making it marginally more efficient than NXDOMAIN in terms of raw query counts.
In stark contrast, testing the SERVFAIL response, which signals an internal server error or configuration failure, triggered catastrophic amplification. Rather than treating SERVFAIL as a terminal response, recursive resolvers aggressively retried the query across multiple assumed paths. The experiment recorded an average of 51.29 queries per test, with some endpoints launching dozens of repeat queries in an apparent attempt to probe whether the failure was transient.
The REFUSED response, which indicates policy-based rejection, performed better than SERVFAIL but worse than explicit negatives, averaging 11.47 queries per test. Meanwhile, choosing absolute silence by dropping queries entirely resulted in an extreme average of 83.46 queries per test as persistent resolvers exhausted their entire retry timeouts.
Broader Implications for DNS Resilience
The comprehensive dataset gathered by APNIC Labs underscores a persistent inefficiency in how the global DNS handles negative outcomes. While definitive negative responses like NXDOMAIN and NOERROR / NODATA maintain relatively controlled query profiles, ambiguous responses or dropped packets trigger aggressive retry storms that can severely strain targeted infrastructure.
The findings open critical avenues for future research into recursive resolver logic, transport layer behaviors, and how protocol adjustments might reduce gratuitous query traffic across the internet.
Leave a Reply