ISPs Emerge as New Source of DNS Root Server Overconsumption
ICANN identifies inefficient ISP query practices following the resolution of Chrome's DNS traffic issues.
1Chrome Traffic Issue Resolved
Google successfully addressed a flaw in the Chromium engine that previously caused excessive DNS root server traffic. During 2020, Chrome accounted for nearly half of all such traffic due to anti-hijacking measures. Recent data from ICANN’s ITHI program confirms that Chrome’s share of this traffic has now dropped from 45 percent to one percent.
2New ISP Traffic Patterns
ICANN has identified a new source of unusual DNS traffic originating from ISPs. These providers are sending single customer requests to three different resolvers simultaneously, including Google and Cloudflare. This redundant practice, described as a belt and suspenders approach, creates unnecessary load on the system despite the inherent resilience of modern DNS resolvers.
3Redundancy and Timing Analysis
The observed ISPs send requests over both IPv4 and IPv6 protocols. For non-cached requests, approximately half are repeated within 100 milliseconds, while another 30 percent are repeated within thirty seconds. This aggressive polling behavior is considered highly unusual, as a single reliable resolver is typically sufficient for maintaining stable internet connectivity for end users.
4Engineering Skill Gap Theory
Maud Durand, a principal technologist at ICANN, suggests this behavior might stem from a lack of skilled internetworking engineers within these specific ISPs. The theory posits that these organizations are implementing a brute-force resilience routine rather than optimizing their network architecture. ICANN is currently researching the root cause to confirm this hypothesis.
5Systemic Risk and Scale
While the ISPs currently employing this practice are not considered major industry players, ICANN remains concerned about potential scaling. If this redundant query method becomes widespread or is adopted by larger entities, it could significantly impact the stability of global DNS root servers. Monitoring these traffic patterns is essential for maintaining infrastructure health.
6Concentration of DNS Resolvers
ICANN research indicates that the number of DNS service providers is becoming increasingly concentrated. In 2020, users could access nearly 250 distinct resolver farms. That figure has dropped to under 150 today. This trend suggests that the market for DNS resolution is shrinking, with remaining visible resolvers increasingly belonging to large tech giants.
7Infrastructure Health Monitoring
The Identifier Technology Health Indicators program continues to monitor the security, stability, and resilience of the domain name system. By tracking these metrics, ICANN aims to identify inefficiencies before they cause widespread service disruptions. The shift from browser-based traffic issues to ISP-based inefficiencies highlights the evolving nature of internet resource management challenges.
8Future Outlook for DNS
The transition toward fewer, larger DNS resolver operators poses long-term questions regarding internet decentralization. As ISPs experiment with unconventional resilience techniques, the industry must balance redundancy with traffic efficiency. ICANN’s ongoing investigation into these specific ISP behaviors will be critical in determining whether these practices require formal governance or technical intervention.