On 6 May 2020 from 15:00 to 16:30 (UTC+2), the DNS Working Group held a remote session via Zoom.
Scribe: Boris Duval
Status: Draft
1. Effect of a global pandemic on DNS utilization
Steve De Jong
Neustar UltraDNS
Dave Knight asked if the presenter planned to dig deeper into the data.
Steve replied that he planned to hand over the data to others who have the tools to do so.
Dave asked if Steve would consider giving an update on the data.
Steve confirmed that he would consider coming back as there are plenty of interests from various stakeholders about this type of data.
Peter Van Dijk asked if the presenter knew why the public resolvers’ graphs were so flat.
Steve replied that it was probably due to the high number of non-human users of public resolvers (e.g. automation scripts, phishing attempts, spam runs). He added that it was his initial theory, but that he couldn’t answer specifically this question.
Roland Dobbins asked if the presenter thought that the majority of queries to his open recursive service were from automated things.
Steve answered that as the data showed with the home routers versus the co-work site, not all traffic is automated, but the majority is. However, he added that it’s very hard to evaluate precisely what is automated as he would need access to more data to be able to determine that.
Benno Overeinder asked the presenter if they had to make changes in his provisioning given the negative/positive impact on the industry.
Steve answered that there were some significant improvements made to their network infrastructure last year, and that they have enough bandwidth to handle the growth at this point.
There were no further questions.
2. COVID-19 influence on resolver traffic
Pieter Lexis and Peter van Dijk
Senior PowerDNS Engineers
Roland Dobbins asked if the presenters saw changes in response code dynamics (e.g. an increase in NXDOMAIN).
Peter van Dijk replied that they didn’t know as they don’t have any data to answer this question.
Peter Koch asked if there was any visible shift from mobile to home providers.
Pieter Lexis mentioned that the data collected came from a residential ISP and that they didn’t have contact with any mobile service operators. However, Peter van Dijk added that it could be possible that a part of the ISP’s growth comes from mobile. Pieter agreed.
Joao Damas mentioned that APNIC saw several countries shifting away from Open resolvers to ISP resolvers with Germany showing a pickup of previous levels during the last two weeks.
Peter van Dijk commented that this was matching their research and what Steve DeJong mentioned in the previous presentation.
Marco Davids posted a link in the chat from SIDN (.nl) showing their own observation on this matter.
VB asked if the presenters observed higher query volumes over IPv6 than before.
Peter van Dijk answered that they didn’t have this data at the moment but that they could ask for it at a later stage. VB added that Google reported an increase in IPv6 usage from home. Peter commented that it made sense as most offices are not running IPv6.
Benno Overeinder asked if obvious DNS DDoS attacks could be seen from the data collected.
Peter and Pieter answered that they didn’t see any of those.
Swapneel Sheth asked if the presenters saw any patterns with regards to Chrome versus other browsers’ traffic to the resolvers.
Peter replied that resolvers don’t know which browser is talking to them and added that even if they did, they will probably not have this data.
Pieter mentioned that it will be interesting if operators in the community had more anecdotes or data to share and encouraged participants to send them an email if it was the case. He added that he will ask the community if they saw an uptick with alternative protocols, such as DoT or DoH, as it would be interesting data to analyse.
There were no further questions.