Speaker
Description
Many Internet services use composite DNS queries, where one domain is embedded within a query to another service. Translation platforms, email link protection systems, reputation services, and content delivery networks rely on this approach. While these services provide valuable functionality, they also make it harder to determine the true destination from DNS data alone, creating a visibility gap for DNS monitoring and security systems.
In this talk, we present a measurement study of composite DNS queries observed in production DNS traffic. We identify the major classes of services that generate composite DNS queries, analyze the domains embedded within them, and evaluate their contribution to DNS traffic and visibility. Our results show that a meaningful portion of domain activity is observable only through composite queries, highlighting an important gap in traditional DNS analysis.
Finally, we discuss why decisions based solely on the Response Policy Zones (RPZ) are often insufficient for disrupting threats that use composite queries. By combining service classification with analysis of the embedded destination, security systems can make decisions on individual queries without disrupting legitimate services.
| Talk duration | 20 Minutes (+5 for Q&A) |
|---|
