M4: DNS Recursive Server Analysis

-

The M4 metrics analyze the DNS traffic at Recursive Servers. This is somewhat similar to the M3.3 set of metrics, with the difference that M3.3 analyze the traffic arriving to the root, which may be heavily filtered by the recursive resolvers. M4 attempts to measure the original behavior of DNS clients. M4 comprises 4 metrics, measuring the fraction of queries going to delegated TLD, to RFC 6761 special use names, to frequently leaked strings, and to other strings.

The M4 metric also tracks the usage of DNSSEC at recursive servers through metric M4.5:

In the following table, the current value is the value of the metric for the current month. The average value is the average value of that metric over the 12 months preceeding this one -- or the average since the beginning of measurements if measurements started fewer than 12 months ago.

Current value Average value
M4.1: % of queries directed at delegated TLDs. - -
M4.2: % of queries directed at RFC 6761 names. - -
M4.3: % of queries directed at frequently used strings. - -
M4.4: All other traffic. - -
DNSSEC M4.5: % of Clients setting the DNSSEC OK bit in queries - -

The following tables provide the list of names or strings most frequently encountered as part of M4.2 and M4.3.

Queries to RFC 6761 names

In the following table, the current value is the fraction of queries directed at RFC 6761 names in the current month. The average value is the average of that fraction since the beginning of the year.

Table M42 not found

Queries to frequently leaked strings

In the following table, the current value is the fraction of queries directed in the current month at frequently used strings. The average value is the average of that fraction since the beginning of the year.

Many of the strings frequently used at recursive resolvers correspond to local values, such as names of specific servers in the local network. We don't want to publish these names for privacy reasons. The corresponding queries are tabulated under a generic category, "(local host names)". The only strings that we list are those found in the top 128 strings leaked to the root, as measured with metric M3.

Table M43 not found