{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,8]],"date-time":"2025-10-08T15:50:16Z","timestamp":1759938616715,"version":"3.37.3"},"reference-count":34,"publisher":"Oxford University Press (OUP)","issue":"9","license":[{"start":{"date-parts":[[2021,5,22]],"date-time":"2021-05-22T00:00:00Z","timestamp":1621641600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"funder":[{"DOI":"10.13039\/501100011395","name":"Major Science and Technology Program for Water Pollution Control and Treatment","doi-asserted-by":"publisher","award":["2018YFB1800202"],"award-info":[{"award-number":["2018YFB1800202"]}],"id":[{"id":"10.13039\/501100011395","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,9,16]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>As the backbone of the domain name system (DNS), DNS resolvers are essential to the Internet. Nowadays, the measurement of DNS resolvers, especially open DNS resolvers, has become a research focus. Previous research works show that DNS responses returned from some open DNS resolvers are not expected for clients and the Internet. We call these DNS responses \u2018unexpected DNS responses\u2019. Research on unexpected DNS responses is beneficial to the research, usage and management of open DNS resolvers. This paper explores unexpected DNS responses returned from open DNS resolvers in terms of identification and classification to better understand the behaviours of open DNS resolvers. First, an identification method is proposed to identify all kinds of DNS responses from each section of DNS messages. Second, a classification method is proposed to classify unexpected DNS responses by their influences on clients and the Internet. Furthermore, an efficient identification and classification method is proposed to simplify the above process. Among about 9 million responding open DNS resolvers in the experiments on the IPv4 address space, about 40% return unexpected DNS responses. Experimental results show that the proposed methods can identify and classify all kinds of DNS responses returned from open DNS resolvers.<\/jats:p>","DOI":"10.1093\/comjnl\/bxab063","type":"journal-article","created":{"date-parts":[[2021,4,29]],"date-time":"2021-04-29T11:50:11Z","timestamp":1619697011000},"page":"2276-2298","source":"Crossref","is-referenced-by-count":3,"title":["Research on Unexpected DNS Response from Open DNS Resolvers"],"prefix":"10.1093","volume":"65","author":[{"given":"Keyu","family":"Lu","sequence":"first","affiliation":[{"name":"Faculty of Computing , Harbin Institute of Technology, Harbin, 150001, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tingting","family":"Chai","sequence":"additional","affiliation":[{"name":"Faculty of Computing , Harbin Institute of Technology, Harbin, 150001, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haiyan","family":"Xu","sequence":"additional","affiliation":[{"name":"Faculty of Computing , Harbin Institute of Technology, Harbin, 150001, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shitala","family":"Prasad","sequence":"additional","affiliation":[{"name":"Institute for Infocomm Research , A*Star, Singapore, 138632, Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianen","family":"Yan","sequence":"additional","affiliation":[{"name":"Faculty of Computing , Harbin Institute of Technology, Harbin, 150001, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhaoxin","family":"Zhang","sequence":"additional","affiliation":[{"name":"Faculty of Computing , Harbin Institute of Technology, Harbin, 150001, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"286","published-online":{"date-parts":[[2021,5,22]]},"reference":[{"volume-title":"Proceedings of INFOCOM 2017","year":"2017","author":"Klein","key":"2022091610474628000_ref1"},{"key":"2022091610474628000_ref2","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1016\/j.comnet.2017.02.007","article-title":"The best bang for the byte: Characterizing the potential of DNS amplification attacks","volume":"116","author":"MacFarland","year":"2017","journal-title":"Computer Networks"},{"key":"2022091610474628000_ref3","first-page":"77","volume-title":"Proceedings of IMC 2013","author":"Schomp","year":"2013"},{"key":"2022091610474628000_ref4","first-page":"355","volume-title":"Proceedings of IMC 2015","author":"Kuhrer","year":"2015"},{"author":"Shadowserver, Open Resolver Scanning Project","key":"2022091610474628000_ref5"},{"key":"2022091610474628000_ref6","article-title":"Domain names - implementation and specification","author":"Mockapetris","year":"1987","journal-title":"RFC 1035"},{"key":"2022091610474628000_ref7","article-title":"Domain Name System (DNS) IANA considerations","author":"Eastlake","year":"2013","journal-title":"RFC 6895"},{"key":"2022091610474628000_ref8","article-title":"DNS Stateful Operations","author":"Bellis","year":"2019","journal-title":"RFC 8490"},{"key":"2022091610474628000_ref9","article-title":"Extension mechanisms for DNS (EDNS(0))","volume":"6891","author":"Damas","year":"2013","journal-title":"RFC"},{"key":"2022091610474628000_ref10","article-title":"Clarifications and implementation notes for DNS Security (DNSSEC)","author":"Weiler","year":"2013","journal-title":"RFC 6840"},{"key":"2022091610474628000_ref11","article-title":"Indicating resolver support of DNSSEC","author":"Conrad","year":"2001","journal-title":"RFC 3225"},{"key":"2022091610474628000_ref12","article-title":"Protocol modifications for the DNS Security Extensions","author":"Arends","year":"2005","journal-title":"RFC 4035"},{"key":"2022091610474628000_ref13","article-title":"Resource Records for the DNS Security Extensions","author":"Arends","year":"2005","journal-title":"RFC 4034"},{"key":"2022091610474628000_ref14","article-title":"Domain Name System (DNS) Cookies","author":"Eastlake","year":"2016","journal-title":"RFC 7873"},{"key":"2022091610474628000_ref15","article-title":"Dynamic updates in the Domain Name System (DNS UPDATE)","author":"Vixie","year":"1997","journal-title":"RFC 2136"},{"key":"2022091610474628000_ref16","article-title":"DNAME redirection in the DNS","author":"Rose","year":"2012","journal-title":"RFC 6672"},{"key":"2022091610474628000_ref17","article-title":"Secret key transaction authentication for DNS (TSIG)","author":"Vixie","year":"2000","journal-title":"RFC 2845"},{"key":"2022091610474628000_ref18","article-title":"HMAC SHA TSIG algorithm identifiers","author":"Eastlake","year":"2006","journal-title":"RFC 4635"},{"key":"2022091610474628000_ref19","article-title":"Secret key establishment for DNS (TKEY RR)","author":"Eastlake","year":"2000","journal-title":"RFC 2930"},{"key":"2022091610474628000_ref20","first-page":"3","volume-title":"Proceedings of ESORICS 2015","author":"Shulman","year":"2015"},{"key":"2022091610474628000_ref21","first-page":"3","volume-title":"Proceedings of PAM 2015","author":"Kaizer","year":"2015"},{"key":"2022091610474628000_ref22","first-page":"493","volume-title":"Proceedings of DSN 2019","author":"Park","year":"2019"},{"key":"2022091610474628000_ref23","first-page":"307","volume-title":"Proceedings of the 26th USENIX Security Symposium","author":"Pearce","year":"2017"},{"key":"2022091610474628000_ref24","first-page":"113","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Liu","year":"2018"},{"key":"2022091610474628000_ref25","first-page":"8","volume-title":"Proceedings of IMC 2018","author":"Moura","year":"2018"},{"key":"2022091610474628000_ref26","first-page":"101","volume-title":"Proceedings of IMC 2019","author":"Moura","year":"2019"},{"key":"2022091610474628000_ref27","first-page":"18","volume-title":"Proceedings of RAID 2010","author":"Antonakakis","year":"2010"},{"volume-title":"Proceedings of NDSS 2008","year":"2008","author":"Dagon","key":"2022091610474628000_ref28"},{"volume-title":"Proceedings of Workshop on Securing and Trusting Internet Names (SATIN)","year":"2011","author":"Weaver","key":"2022091610474628000_ref29"},{"key":"2022091610474628000_ref30","first-page":"214","volume-title":"Proceedings of PAM 2014","author":"Schomp","year":"2014"},{"key":"2022091610474628000_ref31","article-title":"Measures for making DNS more resilient against forged answers","author":"Hubert","year":"2009","journal-title":"RFC 5452"},{"key":"2022091610474628000_ref32","article-title":"Clarifications to the DNS specification","author":"Elz","year":"1997","journal-title":"RFC 2181"},{"key":"2022091610474628000_ref33","article-title":"Domain names - concepts and facilities","author":"Mockapetris","year":"1987","journal-title":"RFC 1034"},{"key":"2022091610474628000_ref34","article-title":"Protocol standard for a NetBIOS service on a TCP\/UDP transport: concepts and methods","author":"Network Working Group","year":"1987","journal-title":"RFC 1001"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/65\/9\/2276\/45882142\/bxab063.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/65\/9\/2276\/45882142\/bxab063.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,16]],"date-time":"2022-09-16T10:49:15Z","timestamp":1663325355000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/65\/9\/2276\/6281324"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,5,22]]},"references-count":34,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2021,5,22]]},"published-print":{"date-parts":[[2022,9,16]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxab063","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"type":"print","value":"0010-4620"},{"type":"electronic","value":"1460-2067"}],"subject":[],"published-other":{"date-parts":[[2022,9]]},"published":{"date-parts":[[2021,5,22]]}}}