On this page, we provide technical background information about our forward DNS (fDNS) measurement. This information is targeted at DNS operators and academic researchers.
The goal of the OpenINTEL project is to capture daily snapshots of the state of large parts of the global Domain Name System. Because the DNS plays a key role in almost all Internet services, recording this information allows us to track changes on the Internet, and thus its evolution, over longer periods of time. By performing active measurements we build consistent and reliable time series of the state of the DNS.
Our fDNS measurement is seeded with domain names that we extract from zone files of specific TLDs or from list-based sources. The notable difference between these two measurement bases is that zone files are largely complete in terms of covering all registered (actively delegated) domain names under the respective TLD (e.g., .com), whereas lists can cover something other than a TLD (e.g., popular domains).
Our fDNS measurement covers a number of list-based sources. We measure several lists of Top-ranked domain names such as the Tranco Top 1 million and Cisco Umbrella. We download the latest versions of these lists at least once daily. We also measure ccTLD domain names extracted from Certificate Transparency (CT) logs, which provides partial coverage of TLDs for which we do not have the zone file (the SeeSeeTLD page offers more information on these lists). Finally, we resolve the names our fDNS measurement encounters in so-called infrastructure records (i.e., the A/AAAA records for name servers {NS} and mail exchangers {MX}) and we perform TLSA queries for infrastructure names.
Infrastructure measurement we are currently running:
| Name | Description | Since | Status | Type |
|---|---|---|---|---|
| Infrastructure | Measurement of A/AAAA for NS, MX and TLSA for names extracted from OpenINTEL | 2017-01-23 | Active | Closed |
If you are a DNS operator and you feel our measurement is impacting your infrastructure, please go to our Problems page for information on how to contact us and how you can block our traffic if necessary.
For forward measurements, the measurement system uses a fixed set of DNS queries, which it sends once every 24 hours for every registered domain name under a TLD.
The set of queries currently consists of the following queries:
A (1)AAAA (1)TLSA (2)NS and MX names extracted from OpenINTEL.
MX names extracted from OpenINTEL,
we resolve associated TLSA records for ports 25, 465 and 587.
All response records, including full CNAME expansions and RRSIG signature
records are stored.
The data dictionary describes the data format, including type and explanation of the fields.
The data collected by the OpenINTEL platform has numerous applications in network and network security research. To support these efforts, we make our open data available on the download page or through the links provided in the coverage overview above, under the terms and conditions outlined on our terms page. As using our data may require specialized knowledge and specific analysis infrastructure, we encourage academic researchers to contact us to discuss your needs.
Closed data may be available upon request (more information here). If you have an interest in licencing access to our data for commercial purposes feel free to contact us.