ISPs Replace Chrome as Primary Source of DNS Root Server Overload
ICANN identifies inefficient ISP DNS query practices causing unnecessary traffic to root servers.
1Chrome Traffic Mitigation Success
Google successfully addressed the Chromium browser flaw that previously accounted for nearly half of all DNS root server traffic. Following intervention from ICANN and governance stakeholders, Chrome's contribution to this traffic has dropped from 45 percent in 2020 to just one percent today, effectively reducing the browser's impact to negligible background noise.
2Emergence of ISP Inefficiency
ICANN has identified a new source of excessive DNS traffic originating from smaller internet service providers. These entities are currently sending identical DNS queries to multiple resolvers simultaneously, including Google and Cloudflare. This practice, described as a belt and suspenders approach, creates unnecessary load on root servers that were previously burdened by Chrome.
3Redundancy Through Brute Force
The identified ISPs are sending queries over both IPv4 and IPv6 protocols. Approximately half of these non-cached requests are repeated within 100 milliseconds, while another 30 percent repeat within thirty seconds. ICANN technologists suggest this behavior may stem from a lack of skilled engineering talent, leading to brute-force resilience routines rather than optimized configurations.
4Operational Risks of Redundancy
While current offenders are not major industry players, ICANN warns that widespread adoption of this practice could have significant negative impacts on global DNS stability. The organization is actively researching whether this behavior is a technical bug or a deliberate, albeit misguided, attempt to ensure service continuity through excessive, redundant query volume.
5Concentration of Resolver Operators
Beyond query volume, ICANN is monitoring the consolidation of DNS service providers. Data indicates that the number of visible resolver farms has declined from nearly 250 in 2020 to under 150 today. This trend suggests that the market for DNS resolution is shrinking, with remaining infrastructure increasingly controlled by large technology entities.
6The Role of ITHI Research
The Identifier Technology Health Indicators program serves as the primary mechanism for monitoring the security, stability, and resilience of the domain name system. By analyzing traffic patterns at the root level, ICANN can identify anomalies like the Chrome flaw or current ISP practices, providing evidence-based insights for global internet governance and technical standards.
7Technical Resilience Standards
Standard industry practice dictates the use of primary and secondary DNS resolvers to ensure failover capabilities. However, modern DNS resolvers are already highly resilient, making the simultaneous multi-provider query approach unnecessary. ICANN emphasizes that single, well-configured resolvers are generally sufficient to maintain uptime, rendering the current ISP behavior an inefficient use of resources.
8Future Governance Implications
As DNS resolver operators consolidate, the stability of the internet becomes increasingly dependent on fewer, larger entities. ICANN’s ongoing investigation into ISP query habits highlights the tension between local network resilience strategies and global infrastructure health. Future efforts will likely focus on standardizing query behavior to prevent further unnecessary strain on root servers.