Another Man’s Treasure: Security and Privacy Risks of Junk DNS Queries

Speaker: Ms Elizabeth Boswell | University of Glasgow AS112 is an anycast DNS deployment that responds to junk queries, i.e. leaked queries from internal networks, which should have been handled locally. This includes reverse DNS queries for RFC1918 and link local addresses, and queries for home.arpa and service.arpa. Unlike other anycast deployments, AS112 is volunteer-run and uncoordinated. Anyone can contribute to AS112 by setting up a DNS server, announcing the AS112 anycast prefixes, and responding to queries. The choice to run AS112 as an uncoordinated volunteer-run network relies on the implicit assumption that any traffic that goes to AS112 is “harmless”, i.e. that a malicious volunteer operator could not misuse these queries. However, it is not clear that this assumption is justified. I will present preliminary results from an analysis of query logs from three sites, gathered through the 2025 DNS-OARC Day in the Life data collection. I will show that AS112 receives a substantial amount of traffic that could be misused by a malicious operator, such as DNS dynamic updates, DNS service discovery and service queries, and queries for domains that were lame-delegated to AS112. Presentation Materials available at: https://indico.dns-oarc.net/event/56/... #DNS #OARC46 #AS112