DNS resolvers flood authoritative servers with duplicate queries

A recent analysis of DNS traffic reveals widespread over-querying by recursive resolvers, imposing unnecessary load on authoritative servers. The study, conducted by APNIC Labs, found that 38% of all DNS queries observed on June 1, 2026, were duplicates—identical requests for the same name and record type sent within seconds of the original query. Some networks exhibited duplication rates exceeding 90%, suggesting systemic inefficiencies rather than isolated misconfigurations.

The findings highlight a classic "tragedy of the commons" scenario: since DNS queries carry no direct cost to the resolver, there is little incentive to optimize. Resolvers may duplicate queries to mitigate UDP packet loss or unresponsive nameservers, but the practice shifts the burden to authoritative servers, which must process and respond to redundant requests. While this can improve resolver performance, it does so at the expense of the broader DNS infrastructure.

Measurement methodology

APNIC Labs collected data from 35 million ad-driven measurements across six global regions, each routed to a local authoritative server. By using unique DNS labels for each query, the study bypassed caching and captured raw resolver behavior. The dataset distinguished between original queries and duplicates—defined as identical name-type pairs—revealing stark regional disparities. The Indian Subcontinent recorded the highest duplication rate at 61%, followed by China/Hong Kong at 47%. North America and Europe, by contrast, showed rates of 28% and 27%, respectively.

Most duplicates (58%) occurred as a single repeat of the original query, but some resolvers generated dozens of redundant requests. The highest observed count was 8,771 duplicates for a single query over 24 hours. Timing analysis further clarified the behavior: 45% of duplicates arrived within 10 milliseconds of the original query, far too soon to reflect UDP timeout retries. This suggests resolvers are sending queries in rapid succession—possibly to multiple nameservers or over both IPv4 and IPv6—to hedge against latency or packet loss.

Network-level patterns

The study identified specific networks driving the highest duplication rates. Reliance Jio (India) and Bharti Airtel (India) topped the list, with duplication rates of 14% and 27% of their total query volumes, respectively. Vietnamese providers VNPT and Viettel, along with Indonesia’s Telekomunikasi Selular, also ranked among the worst offenders. Notably, open resolvers like Google (0% duplication) and Cloudflare (3%) exhibited far more conservative behavior, suggesting that commercial operators may prioritize efficiency over aggressive redundancy.

A deeper dive into resolver IP addresses revealed that some systems duplicated queries in over 90% of cases. For example, a resolver operated by Fibercom Technologies in Pakistan duplicated 98% of its queries, while One Hungary and Optimum Telecom Algeria exceeded 90%. The pattern suggests these are not deliberate optimizations but likely unintended consequences of load-balancing front ends in resolver farms. When a single query is mistakenly routed to multiple backend engines, the farm may generate duplicate requests without the operator’s knowledge.

Implications for DNS infrastructure

While duplicate queries do not break resolution, they inflate traffic volumes and increase operational costs for authoritative server operators. The study estimates that nearly 14% of all observed query sets involved a single resolver sending redundant requests to the same authoritative server—behavior that offers no performance benefit. For high-traffic networks, this can translate to millions of unnecessary queries per day.

The findings underscore the need for better monitoring of resolver behavior, particularly in regions with high duplication rates. Since the issue often stems from misconfigured load balancers or transient overload conditions, operators may be unaware of the problem. APNIC Labs’ data suggests that caching masks much of this inefficiency in normal operations, making it difficult to detect without targeted measurement.