{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,4]],"date-time":"2026-04-04T18:06:56Z","timestamp":1775326016317,"version":"3.50.1"},"reference-count":82,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT2","funder":[{"name":"German Federal Ministry of Education and Research","award":["16KIS1370"],"award-info":[{"award-number":["16KIS1370"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2025,6,8]]},"abstract":"<jats:p>DNS is one of the cornerstones of the Internet. Nowadays, a substantial fraction of DNS queries are handled by public resolvers (e.g., Google Public DNS and Cisco's OpenDNS) rather than ISP nameservers. This behavior makes it difficult for authoritative nameservers to provide answers based on the requesting resolver. The impact is especially important for entities that make client origin inferences to perform DNS-based load balancing (e.g., CDNS). The EDNS0 Client Subnet (ECS) option adds the client's IP prefix to DNS queries, which allows authoritative nameservers to provide prefix-based responses. Previous work showed the potential of data collected during ECS scans. Infrastructure can be uncovered, and operators' subnet-specific behavior can be observed. In this study, we introduce a new method for conducting ECS scans. Our method significantly reduces the required number of queries by up to 97% compared to state-of-the-art techniques and allows us to provide new insights into ECS behavior. Our approach is also the first to facilitate ECS scans for IPv6. Due to its vast address space, we have developed and analyzed different IPv6 scanning approaches. We conduct a comprehensive evaluation of the ECS landscape, examining the usage and implementation of ECS across various services. Overall, 53% of all nameservers support prefix-based responses. Furthermore, we find that Google nameservers do not comply with the Google Public DNS guidelines. Additionally, we observe that certain operators (e.g., AWS Route53) exclusively employ a single specific scope prefix length without aggregation, potentially affecting resolver cache efficiency. Lastly, we make our tool and data publicly available to foster further research in the area.<\/jats:p>","DOI":"10.1145\/3730977","type":"journal-article","created":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T20:29:36Z","timestamp":1751401776000},"page":"1-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["ECSeptional DNS Data: Evaluating Nameserver ECS Deployments with Response-Aware Scanning"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9375-3113","authenticated-orcid":false,"given":"Patrick","family":"Sattler","sequence":"first","affiliation":[{"name":"Technical University of Munich, Munich, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2918-016X","authenticated-orcid":false,"given":"Johannes","family":"Zirngibl","sequence":"additional","affiliation":[{"name":"Max Planck Institute for Informatics, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8123-4496","authenticated-orcid":false,"given":"Fahad","family":"Hilal","sequence":"additional","affiliation":[{"name":"Max Planck Institute for Informatics, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3425-9331","authenticated-orcid":false,"given":"Oliver","family":"Gasser","sequence":"additional","affiliation":[{"name":"IPinfo, Seattle, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6168-7887","authenticated-orcid":false,"given":"Kevin","family":"Vermeulen","sequence":"additional","affiliation":[{"name":"LIX, CNRS, Ecole Polytechnique, Palaiseau, France"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2347-1839","authenticated-orcid":false,"given":"Georg","family":"Carle","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Munich, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5174-9140","authenticated-orcid":false,"given":"Mattijs","family":"Jonker","sequence":"additional","affiliation":[{"name":"University of Twente, Enschede, Netherlands"}]}],"member":"320","published-online":{"date-parts":[[2025,6,9]]},"reference":[{"key":"e_1_2_2_1_1","unstructured":"2024. University of Oregon Route Views Project. http:\/\/www.routeviews.org\/routeviews\/"},{"key":"e_1_2_2_2_1","unstructured":"Akamai. 2024. What is ECS (EDNS0 Client Subnet)? https:\/\/community.akamai.com\/customers\/s\/article\/What-is-ECSEDNS0- Client-Subnet?language=en_US"},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355586"},{"key":"e_1_2_2_4_1","volume-title":"Proc. ACM Internet Measurement Conference (IMC). https:\/\/doi.org\/10","author":"Amann Johanna","year":"2017","unstructured":"Johanna Amann, Oliver Gasser, Quirin Scheitle, Lexi Brent, Georg Carle, and Ralph Holz. 2017. Mission Accomplished? HTTPS Security after DigiNotar. In Proc. ACM Internet Measurement Conference (IMC). https:\/\/doi.org\/10.1145\/ 3131365.3131401"},{"key":"e_1_2_2_5_1","unstructured":"Apple Inc. 2024. Access IP geolocation feeds. Retrieved 2024--12-02 from https:\/\/mask-api.icloud.com\/egress-ipranges. csv"},{"key":"e_1_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2600428.2609627"},{"key":"e_1_2_2_7_1","doi-asserted-by":"publisher","unstructured":"Rob Austein. 2007. DNS Name Server Identifier (NSID) Option. RFC 5001. https:\/\/doi.org\/10.17487\/RFC5001","DOI":"10.17487\/RFC5001"},{"key":"e_1_2_2_8_1","unstructured":"AWS. 2024. Geolocation routing. https:\/\/docs.aws.amazon.com\/Route53\/latest\/DeveloperGuide\/routing-policygeo. html"},{"key":"e_1_2_2_9_1","unstructured":"AWS. 2024. IP-based routing. https:\/\/docs.aws.amazon.com\/Route53\/latest\/DeveloperGuide\/routing-policyipbased. html"},{"key":"e_1_2_2_10_1","unstructured":"AWS. 2024. IP Ranges. https:\/\/ip-ranges.amazonaws.com\/ip-ranges.json"},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330744"},{"key":"e_1_2_2_12_1","doi-asserted-by":"publisher","unstructured":"Randy Bush Massimo Candela Warren ''Ace'' Kumari and Russ Housley. 2021. Finding and Using Geofeed Data. RFC 9092. https:\/\/doi.org\/10.17487\/RFC9092","DOI":"10.17487\/RFC9092"},{"key":"e_1_2_2_13_1","unstructured":"CAIDA. 2007. Archipelago Globally Distributed Active Measurement Platform (Ark). https:\/\/www.caida.org\/projects\/ark\/"},{"key":"e_1_2_2_14_1","unstructured":"CAIDA. 2010. Scamper: a Scalable and Extensible Packet Prober for Active Measurement of the Internet. https:\/\/ www.caida.org\/catalog\/software\/scamper\/"},{"key":"e_1_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504754"},{"key":"e_1_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.23919\/TMA.2019.8784530"},{"key":"e_1_2_2_17_1","unstructured":"Cisco. 2024. Umbrella Top 1M List. https:\/\/umbrella.cisco.com\/blog\/cisco-umbrella-1-million"},{"key":"e_1_2_2_18_1","unstructured":"Cloudflare. 2024. Cloudflare Radar. https:\/\/radar.cloudflare.com\/"},{"key":"e_1_2_2_19_1","unstructured":"Cloudflare. 2024. The Cloudflare global network. https:\/\/www.cloudflare.com\/network\/"},{"key":"e_1_2_2_20_1","unstructured":"Cloudflare Docs. 2024. EDNS Client Subnet (ECS) support. https:\/\/developers.cloudflare.com\/load-balancing\/understandbasics\/ traffic-steering\/steering-policies\/#edns-client-subnet-ecs-support"},{"key":"e_1_2_2_21_1","doi-asserted-by":"publisher","unstructured":"Carlo Contavalli Wilmer van der Gaast David C Lawrence and Warren ''Ace'' Kumari. 2016. Client Subnet in DNS Queries. RFC 7871. https:\/\/doi.org\/10.17487\/RFC7871","DOI":"10.17487\/RFC7871"},{"key":"e_1_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC6891"},{"key":"e_1_2_2_23_1","doi-asserted-by":"crossref","unstructured":"David Dittrich Erin Kenneally et al. 2012. The Menlo Report: Ethical principles guiding information and communication technology research. US Department of Homeland Security (2012).","DOI":"10.2139\/ssrn.2445102"},{"key":"e_1_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663755"},{"key":"e_1_2_2_25_1","volume-title":"Proc. USENIX Security Symposium.","author":"Durumeric Zakir","unstructured":"Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. 2013. ZMap: Fast Internet-wide Scanning and Its Security Applications. In Proc. USENIX Security Symposium."},{"key":"e_1_2_2_26_1","doi-asserted-by":"publisher","unstructured":"Xun Fan Ethan Katz-Bassett and John Heidemann. 2015. Assessing Affinity Between Users and CDN Sites. In Traffic Monitoring and Analysis. https:\/\/doi.org\/10.1007\/978--3--319--17172--2_7","DOI":"10.1007\/978--3--319--17172--2_7"},{"key":"e_1_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278564"},{"key":"e_1_2_2_28_1","unstructured":"Gasser Oliver and Zirngibl Johannes and Steger Lion. 2024. IPv6 Hitlist Service. Retrieved 2024--12-02 from https: \/\/ipv6hitlist.github.io"},{"key":"e_1_2_2_29_1","unstructured":"gdnsd. 2024. gdnsd. Retrieved 2024--12-02 from https:\/\/gdnsd.org"},{"key":"e_1_2_2_30_1","unstructured":"Google. 2022. EDNS Client Subnet (ECS) Guidelines. Retrieved 2024--12-02 from https:\/\/developers.google.com\/speed\/ public-dns\/docs\/ecs"},{"key":"e_1_2_2_31_1","unstructured":"Google. 2024. Chrome User Experience Report. https:\/\/developer.chrome.com\/docs\/crux"},{"key":"e_1_2_2_32_1","unstructured":"Google Cloud. 2024. Global load-balancing architectures using DNS routing policies. https:\/\/cloud.google.com\/ architecture\/global-load-balancing-architectures-for-dns-routing-policies"},{"key":"e_1_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3656300"},{"key":"e_1_2_2_34_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Hoang Nguyen Phong","year":"2021","unstructured":"Nguyen Phong Hoang, Arian Akhavan Niaki, Jakub Dalek, Jeffrey Knockel, Pellaeon Lin, Bill Marczak, Masashi Crete-Nishihata, Phillipa Gill, and Michalis Polychronakis. 2021. How Great is the Great Firewall? Measuring China's DNS Censorship. In 30th USENIX Security Symposium (USENIX Security 21). 3381--3398."},{"key":"e_1_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068856"},{"key":"e_1_2_2_36_1","doi-asserted-by":"publisher","unstructured":"Ralph Holz Jens Hiller Johanna Amann Abbas Razaghpanah Thomas Jost Narseo Vallina-Rodriguez and Oliver Hohlfeld. 2020. Tracking the deployment of TLS 1.3 on the web: a story of experimentation and centralization. SIGCOMM Comput. Commun. Rev. (2020). https:\/\/doi.org\/10.1145\/3411740.3411742","DOI":"10.1145\/3411740.3411742"},{"key":"e_1_2_2_37_1","unstructured":"IANA. 2021. IPv4 Special-Purpose Address Registry. Retrieved 2024--12-02 from https:\/\/www.iana.org\/assignments\/ianaipv4- special-registry\/iana-ipv4-special-registry.xhtml"},{"key":"e_1_2_2_38_1","unstructured":"IANA. 2023. Address Family Numbers. Retrieved 2024--12-02 from https:\/\/www.iana.org\/assignments\/address-familynumbers\/ address-family-numbers.xhtml"},{"key":"e_1_2_2_39_1","unstructured":"ICANN. 2021. Centralized Zone Data Service. https:\/\/czds.icann.org\/home"},{"key":"e_1_2_2_40_1","unstructured":"Apple Inc. 2021. iCloud Private Relay Overview. (2021). https:\/\/www.apple.com\/privacy\/docs\/ iCloud_Private_Relay_Overview_Dec2021.PDF"},{"key":"e_1_2_2_41_1","volume-title":"BIND: Using the GeoIP Features. Retrieved 2024--12-02 from https:\/\/kb.isc.org\/ docs\/aa-01149","author":"Internet Systems Consortium (ISC).","year":"2020","unstructured":"Internet Systems Consortium (ISC). 2020. BIND: Using the GeoIP Features. Retrieved 2024--12-02 from https:\/\/kb.isc.org\/ docs\/aa-01149"},{"key":"e_1_2_2_42_1","unstructured":"Internet Systems Consortium (ISC). 2024. BIND 9. Retrieved 2024--12-02 from https:\/\/www.isc.org\/bind\/"},{"key":"e_1_2_2_43_1","unstructured":"IPinfo. 2024. Anycast Dataset. https:\/\/ipinfo.io\/tags\/anycast"},{"key":"e_1_2_2_44_1","unstructured":"IPinfo. 2024. IP geolocation database. https:\/\/ipinfo.io\/products\/ip-geolocation-database"},{"key":"e_1_2_2_45_1","volume-title":"Codes for the representation of names of countries and their subdivisions. Standard","author":"ISO","unstructured":"ISO 3166--1:2020 2020. Codes for the representation of names of countries and their subdivisions. Standard. International Organization for Standardization, Geneva, CH."},{"key":"e_1_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9000"},{"key":"e_1_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487844"},{"key":"e_1_2_2_48_1","doi-asserted-by":"publisher","unstructured":"Erik Kline Krzysztof Duleba Zoltan Szamonek Stefan Moser and Warren ''Ace'' Kumari. 2020. A Format for Self- Published IP Geolocation Feeds. RFC 8805. https:\/\/doi.org\/10.17487\/RFC8805","DOI":"10.17487\/RFC8805"},{"key":"e_1_2_2_49_1","unstructured":"KNOT DNS. 2024. geoip Extension. Retrieved 2024--12-02 from https:\/\/www.knot-dns.cz\/docs\/3.0\/singlehtml\/ index.html#geoip-geography-based-responses"},{"key":"e_1_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/1283920.1283929"},{"key":"e_1_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278568"},{"key":"e_1_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24343"},{"key":"e_1_2_2_53_1","doi-asserted-by":"publisher","unstructured":"Warren ''Ace'' Kumari Evan Hunt Roy Arends Wes Hardaker and David C Lawrence. 2020. Extended DNS Errors. RFC 8914. https:\/\/doi.org\/10.17487\/RFC8914","DOI":"10.17487\/RFC8914"},{"key":"e_1_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3676869"},{"key":"e_1_2_2_55_1","unstructured":"Majestic. 2024. The Majestic Million. https:\/\/majestic.com\/reports\/majestic-million\/"},{"key":"e_1_2_2_56_1","unstructured":"Massimo Candela. 2024. geofeed-finder. Retrieved 2024--12-02 from https:\/\/github.com\/massimocandela\/geofeed-finder"},{"key":"e_1_2_2_57_1","unstructured":"MaxMind. 2024. GeoIP Databases. Retrieved 2024--12-02 from https:\/\/www.maxmind.com\/en\/geoip-databases"},{"key":"e_1_2_2_58_1","unstructured":"MaxMind. 2024. GeoLite2 Free Geolocation Data. https:\/\/dev.maxmind.com\/geoip\/geolite2-free-geolocation-data"},{"key":"e_1_2_2_59_1","unstructured":"MaxMind. 2024. MaxMind GeoIP\u00ae Databases. https:\/\/www.maxmind.com\/en\/geoip-databases"},{"key":"e_1_2_2_60_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC1918"},{"key":"e_1_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398831"},{"key":"e_1_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/2896816"},{"key":"e_1_2_2_63_1","unstructured":"PowerDNS. 2024. Authoritative Server Settings - edns-subnet-processing. Retrieved 2024--12-02 from https:\/\/ doc.powerdns.com\/authoritative\/settings.html#edns-subnet-processing"},{"key":"e_1_2_2_64_1","volume-title":"FIRM: An Intelligent Fine-grained Resource Management Framework for SLO-Oriented Microservices. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20)","author":"Qiu Haoran","unstructured":"Haoran Qiu, Subho S. Banerjee, Saurabh Jha, ZbigniewT. Kalbarczyk, and Ravishankar K. Iyer. 2020. FIRM: An Intelligent Fine-grained Resource Management Framework for SLO-Oriented Microservices. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). https:\/\/www.usenix.org\/conference\/osdi20\/presentation\/qiu"},{"key":"e_1_2_2_65_1","unstructured":"RIPE NCC. [n. d.]. Routing Information Service (RIS). https:\/\/www.ripe.net\/analyse\/internet-measurements\/routinginformation- service-ris"},{"key":"e_1_2_2_66_1","volume-title":"10th USENIX Symposium on Networked Systems Design and Implementation (NSDI 13)","author":"S\u00e1nchez Mario A.","year":"2013","unstructured":"Mario A. S\u00e1nchez, John S. Otto, Zachary S. Bischof, David R. Choffnes, Fabi\u00e1n E. Bustamante, Balachander Krishnamurthy, and Walter Willinger. 2013. Dasu: Pushing Experiments to the Internet's Edge. In 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI 13). https:\/\/www.usenix.org\/conference\/nsdi13\/technicalsessions\/ presentation\/sanchez"},{"key":"e_1_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561426"},{"key":"e_1_2_2_68_1","unstructured":"Patrick Sattler and Mattijs Jonker. 2025. Ark-interoperable Adaptation of ECSplorer. https:\/\/github.com\/sattler\/ark-ecs"},{"key":"e_1_2_2_69_1","unstructured":"Patrick Sattler Roland Reif and Patrick Grossmann. 2025. ECSplorer - A Response-aware ECS Scanner. https: \/\/github.com\/tumi8\/ecsplorer"},{"key":"e_1_2_2_70_1","doi-asserted-by":"publisher","unstructured":"Patrick Sattler Johannes Zirngibl Fahad Hilal Oliver Gasser Georg Carle and Mattijs Jonker. 2025. ECS Scan Results at TUM University Library. https:\/\/doi.org\/10.14459\/2025mp1779517 doi:10.14459\/2025mp1779517.","DOI":"10.14459\/2025mp1779517"},{"key":"e_1_2_2_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/3629146"},{"key":"e_1_2_2_72_1","doi-asserted-by":"publisher","DOI":"10.23919\/TMA58422.2023.10199073"},{"key":"e_1_2_2_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504767"},{"key":"e_1_2_2_74_1","unstructured":"TUM I8. 2024. Goscanner. https:\/\/github.com\/tumi8\/goscanner"},{"key":"e_1_2_2_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/3143361.3143365"},{"key":"e_1_2_2_76_1","unstructured":"Wikimedia. 2024. Data centers. Retrieved 2024--12-02 from https:\/\/wikitech.wikimedia.org\/wiki\/Data_centers"},{"key":"e_1_2_2_77_1","unstructured":"Wikimedia. 2024. Geographic DNS. Retrieved 2024--12-02 from https:\/\/wikitech.wikimedia.org\/wiki\/ DNS#Geographic_DNS"},{"key":"e_1_2_2_78_1","volume-title":"Northward Datacentre Switchover (March","year":"2024","unstructured":"Wikimedia. 2024. Northward Datacentre Switchover (March 2024). Retrieved 2024--12-02 from https:\/\/ phabricator.wikimedia.org\/T357547"},{"key":"e_1_2_2_79_1","unstructured":"ZDNS. 2024. ZDNS - Fast CLI DNS Lookup Tool. https:\/\/github.com\/zmap\/zdns"},{"key":"e_1_2_2_80_1","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487826"},{"key":"e_1_2_2_81_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-56252-5_13"},{"key":"e_1_2_2_82_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561440"}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3730977","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T15:34:35Z","timestamp":1774280075000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3730977"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,8]]},"references-count":82,"journal-issue":{"issue":"CoNEXT2","published-print":{"date-parts":[[2025,6,8]]}},"alternative-id":["10.1145\/3730977"],"URL":"https:\/\/doi.org\/10.1145\/3730977","relation":{},"ISSN":["2834-5509"],"issn-type":[{"value":"2834-5509","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,8]]},"assertion":[{"value":"2025-06-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}