Is Protective DNS Blocking the Wild West?

2025-10-29

AI Summary

Protective DNS services in academic and research networks suffer from disorganized blocklists—characterized by inconsistent naming conventions, opaque targeting criteria, untraceable sources, and insufficient oversight—hindering their efficacy and accountability. Method: Leveraging hundreds of millions of real-world DNS query logs from educational institutions and integrating multiple public threat-domain feeds, this study conducts the first large-scale, passive measurement–based empirical comparison of DNS blocklist performance. Contribution/Results: We find that the absence of standardized blocklist specifications leads to high false-positive rates, poor inter-list coordination, and degraded service reliability. Blocklists exhibit low coverage overlap and substantial semantic ambiguity, severely undermining security policy interpretability and auditability. To address these challenges, we propose a governance framework for DNS blocklists tailored to academic networks, offering empirically grounded recommendations and technical pathways for standardization and regulatory practice.

Technology Category

• Application Domains: Misinformation & Fake News
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)

Application Category

• Security and Privacy: Blockchains and distributed ledgers
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

We perform a passive measurement study investigating how a Protective DNS service might perform in a Research & Education Network serving hundreds of member institutions. Utilizing freely-available DNS blocklists consisting of domain names deemed to be threats, we test hundreds of millions of users' real DNS queries, observed over a week's time, to find which answers would be blocked because they involve domain names that are potential threats. We find the blocklists disorderly regarding their names, goals, transparency, and provenance making them quite difficult to compare. Consequently, these Protective DNS underpinnings lack organized oversight, presenting challenges and risks in operation at scale.

Problem

• Evaluating Protective DNS performance in large education networks
• Testing DNS blocklists against millions of real user queries
• Identifying disorganized oversight in DNS threat protection systems

Innovation

• Utilizing freely-available DNS blocklists for threat detection
• Testing hundreds of millions of real DNS queries
• Analyzing blocklists for transparency and provenance issues