The Domain Name System (DNS)—the foundational directory service that translates human-readable domain names into machine-routable IP addresses—remains vulnerable to a remarkably simple yet highly effective offensive strategy known as the "random name attack." By targeting the online availability of a specific domain, such an attack attempts to saturate the authoritative nameservers of a zone with a flood of queries designed to resolve completely randomized names. This staggering volume of traffic can overwhelm the server’s processing capabilities, causing legitimate queries to drop and rendering the target domain effectively inaccessible.
Unlike more complex cyberthreats, mounting a random name attack requires very little technical sophistication. Attackers do not need to construct advanced query packets or maintain granular control over complex botnet architectures. Instead, compromised hosts simply execute lightweight scripts capable of generating arbitrary strings within a targeted domain namespace and issuing continuous DNS queries. Because these queries use novel random names, they effortlessly bypass conventional local caching layers maintained by recursive resolvers, forcing every single request straight to the authoritative servers.
Understanding how the DNS infrastructure handles requests for non-existent names is crucial to engineering better defenses against these disruptive attacks. To investigate this behavior, researchers at APNIC Labs have conducted extensive measurement experiments, seeding the broader internet with queries directed at non-existent domain names hosted on specialized experimental infrastructure. Utilizing globally distributed online advertisement campaigns to deploy measurement scripts across millions of endpoints daily, researchers have gained profound visibility into the geographic and platform diversity of modern internet traffic.
The underlying methodology is deceptively straightforward. An ad impression served to an endpoint executes a script that generates a DNS resolution query for a randomized, non-existent domain name where only the APNIC-operated experimental setup serves as the authoritative nameserver. By monitoring how recursive resolvers query these authoritative servers, researchers can meticulously analyze query logs, timeouts, and repetition patterns across the internet.
When analyzing expected outcomes, researchers look closely at how client stub resolvers and recursive servers interact. Standard client devices rely on local resolver libraries configured via protocols like DHCP. When an application requests a domain name, the stub resolver transmits a query to designated recursive resolvers using the User Datagram Protocol (UDP). Because UDP is connectionless and offers no delivery guarantees, stub resolvers implement internal timers. If a response fails to arrive within a designated window, the query is retransmitted, potentially rotating through multiple configured resolvers until a maximum timeout threshold is reached.
Operating systems like Microsoft Windows employ specific timeout schedules—often beginning with a one-second timer that doubles iteratively before terminating a query sequence. Recursive resolvers implement similar re-query mechanics when communicating with authoritative nameservers. However, researchers note that if both end hosts and recursive forwarders employ overly aggressive re-query timers, a single dropped packet can trigger a cascading query storm, inadvertently turning a transient network glitch into a self-inflicted denial-of-service event.
To establish a historical benchmark, APNIC Labs conducted an initial negative response measurement campaign in October 2019, analyzing more than 60 million individual measurements. At the time, authoritative servers for non-existent domains recorded over 142 million queries—an average of 2.37 queries per unique name. Factoring in lower global IPv6 adoption and lack of modern query types, this observed volume significantly exceeded theoretical baseline predictions, hinting at an underlying propensity for query repetition within the broader DNS ecosystem.
Seeking to determine whether internet behaviors had evolved, APNIC Labs executed an expanded version of the experiment during the first half of August 2026. Leveraging Google advertising campaigns to reach over 115 million unique endpoints globally, the research team studied responses across multiple DNS response codes and operational states, including clear-channel DNS over UDP without encrypted transport extensions or DNSSEC signature overheads.
During the 2026 measurement window, researchers tracked more than 509 million queries directed at non-existent domains returning the standard NXDOMAIN (no such domain name) response code. This translated to an average of 4.40 queries per unique domain name—a notable increase from the 2.4 queries observed seven years prior.
Several technical factors contributed to this rise in query volume. Modern web clients employing "Happy Eyeballs" dual-stack implementations frequently issue rapid, back-to-back queries for both A (IPv4) and AAAA (IPv6) resource records. During the 2026 study, 48% of tested endpoints queried for both record types simultaneously, while an increasing number of clients also emitted modern HTTPS query types to determine protocol compatibility. While these concurrent initial queries account for a portion of the traffic, the vast majority of the observed volume stemmed from repeated query transmissions rather than initial lookups.
To expand their inquiry, APNIC researchers did not limit their focus to NXDOMAIN responses. They also evaluated alternative ways the DNS handles negative outcomes, including NOERROR / NODATA, SERVFAIL, REFUSED, and complete silence.
The NOERROR / NODATA response indicates that a query was processed successfully but that no resource records of the requested type exist for that specific name, without confirming whether records exist under different types. Testing this response across 115 million measurements yielded approximately 454 million queries, resulting in an average of 3.93 queries per test. Surprisingly, this made NOERROR / NODATA slightly more efficient in terms of total query counts than the explicit NXDOMAIN response.
In stark contrast, evaluating the SERVFAIL response code—which signals an internal server error or configuration failure—revealed catastrophic inefficiencies in resolver behavior. Testing SERVFAIL across 138 million measurements generated an astronomical 7.17 billion queries, averaging over 51 queries per test and more than ten times the load produced by standard negative responses. Rather than treating SERVFAIL as a terminal condition, recursive resolvers persistently hammered the nameserver, assuming the failure was merely a transient condition requiring repeated probing.
Similarly, testing the REFUSED response code—which indicates policy-based rejection—produced an average of 11.47 queries per test, illustrating that resolvers are somewhat more willing to accept policy restrictions as final than they are to accept server errors, though repetition rates remained elevated compared to definitive negative answers. Complete silence, where authoritative servers dropped queries entirely, yielded the most extreme behavior of all, generating an average of more than 82 queries per test as resolvers exhausted their maximum UDP timeout thresholds.
The findings underscore a complex reality in modern internet infrastructure: while definitive negative responses like NXDOMAIN and NOERROR / NODATA maintain relatively controlled query repetition profiles, ambiguous or error-state responses trigger aggressive retry storms that can severely burden authoritative infrastructure. APNIC Labs plans to publish further studies exploring the underlying root causes of query repetition, examining whether factors like UDP transport constraints or complex multi-tier resolver architectures drive this persistent behavior across the global network.
Leave a Reply